ci: fix release workflow permissions and improve version handling

- Add required permissions for contents write and id-token write
- Update actions/setup-python from v4 to v5
- Improve version extraction to handle 'v' prefix properly
- Enhance sed commands for better regex matching
- Add package verification step with twine check
- Improve commit logic to avoid unnecessary commits

Change-Id: Ie8f19d8298de90fc8ecb5fc48f1de2696b407893

Author: OhYee

.github/workflows/release.yml

@@ -7,39 +7,60 @@ on:
 jobs:
   release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
     steps:
     - uses: actions/checkout@v4
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
         ref: main
+        fetch-depth: 0
     - name: Set up Python
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
       with:
         python-version: '3.10'
     - name: Extract version
-      run: echo "VERSION=${{ github.event.release.tag_name }}" >> $GITHUB_ENV
+      run: |
+        VERSION="${{ github.event.release.tag_name }}"
+        VERSION="${VERSION#v}"  # 移除 v 前缀
+        echo "VERSION=${VERSION}" >> $GITHUB_ENV
+        echo "Extracted version: ${VERSION}"
     - name: Update pyproject.toml
-      run: sed -i "s/version = \".*\"/version = \"${VERSION}\"/" pyproject.toml
+      run: |
+        sed -i 's/version = "[^"]*"/version = "'${VERSION}'"/' pyproject.toml
+        echo "Updated pyproject.toml version to ${VERSION}"
     - name: Update __version__ in __init__.py
       run: |
         if grep -q "__version__" agentrun/__init__.py; then
-          sed -i "s/__version__ = \".*\"/__version__ = \"${VERSION}\"/" agentrun/__init__.py
+          sed -i 's/__version__ = "[^"]*"/__version__ = "'${VERSION}'"/' agentrun/__init__.py
         else
-          sed -i '1a __version__ = \"${VERSION}\"' agentrun/__init__.py
+          sed -i '1a __version__ = "'${VERSION}'"' agentrun/__init__.py
         fi
+        echo "Updated __init__.py version to ${VERSION}"
     - name: Commit changes
       run: |
         git config --local user.email "action@github.com"
         git config --local user.name "GitHub Action"
         git add pyproject.toml agentrun/__init__.py
-        git commit -m "Update version to ${VERSION}" || echo "No changes to commit"
-        git push
+        if git diff --staged --quiet; then
+          echo "No version changes to commit"
+        else
+          git commit -m "Update version to ${VERSION}"
+          git push
+        fi
     - name: Build package
       run: |
         python -m pip install --upgrade pip
-        pip install build
+        pip install build twine
         python -m build
+        echo "Package built successfully"
+    - name: Verify package
+      run: |
+        python -m twine check dist/*
+        echo "Package verification completed"
     - name: Publish to PyPI
       uses: pypa/gh-action-pypi-publish@release/v1
       with:
-        password: ${{ secrets.PYPI_API_TOKEN }}
+        password: ${{ secrets.PYPI_API_TOKEN }}
+        verify-metadata: false