From 3bffd592e86161e95c19c051dac57212cd8f9816 Mon Sep 17 00:00:00 2001
From: Davis Vann Bennett <davis.v.bennett@gmail.com>
Date: Mon, 23 Mar 2026 16:40:52 +0100
Subject: [PATCH 1/2] Removes testpypi as a target for the
 workflow-dispatch-triggered release workflow.

Zarr Python is not configured for OIDC on TestPyPI, and there was a bug in the previous
workflow that prevented command line declaration of the PyPI target (real or test) from
being evaluated correctly. To simplify this, TestPyPI is removed, and only RealPyPI can
be the target for publishing.
---
 .github/workflows/releases.yml | 14 +-------------
 1 file changed, 1 insertion(+), 13 deletions(-)

diff --git a/.github/workflows/releases.yml b/.github/workflows/releases.yml
index 50d68d45df..a57a65d51a 100644
--- a/.github/workflows/releases.yml
+++ b/.github/workflows/releases.yml
@@ -11,11 +11,6 @@ on:
         description: 'Git tag to build and publish (e.g. v3.1.6)'
         required: true
         type: string
-      test_pypi:
-        description: 'Publish to Test PyPI instead of PyPI'
-        required: false
-        type: boolean
-        default: true
 
 permissions:
   contents: read
@@ -77,7 +72,7 @@ jobs:
       || github.event_name == 'workflow_dispatch'
     environment:
       name: releases
-      url: ${{ (github.event_name == 'workflow_dispatch' && inputs.test_pypi) && 'https://test.pypi.org/p/zarr' || 'https://pypi.org/p/zarr' }}
+      url: https://pypi.org/p/zarr
     permissions:
       id-token: write
       attestations: write
@@ -93,10 +88,3 @@ jobs:
           subject-path: dist/*
       - name: Publish package to PyPI
         uses: pypa/gh-action-pypi-publish@v1.13.0
-        if: ${{ !(github.event_name == 'workflow_dispatch' && inputs.test_pypi) }}
-
-      - name: Publish package to Test PyPI
-        uses: pypa/gh-action-pypi-publish@v1.13.0
-        if: ${{ github.event_name == 'workflow_dispatch' && inputs.test_pypi }}
-        with:
-          repository-url: https://test.pypi.org/legacy/

From 2d1b0f5269d0732f899991030d986ae3fe80a761 Mon Sep 17 00:00:00 2001
From: Max Jones <14077947+maxrjones@users.noreply.github.com>
Date: Mon, 23 Mar 2026 12:57:42 -0400
Subject: [PATCH 2/2] update

---
 .github/workflows/releases.yml | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/releases.yml b/.github/workflows/releases.yml
index a57a65d51a..d0f1fda3be 100644
--- a/.github/workflows/releases.yml
+++ b/.github/workflows/releases.yml
@@ -21,7 +21,26 @@ concurrency:
 
 jobs:
 
+  validate_tag:
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Validate tag format
+        run: |
+          if [[ ! "${{ inputs.tag }}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([a-z]+[0-9]*)?$ ]]; then
+            echo "::error::Invalid tag format '${{ inputs.tag }}'. Expected format: v1.2.3, v1.2.3a1, v1.2.3rc1"
+            exit 1
+          fi
+      - name: Verify tag exists
+        run: |
+          git ls-remote --tags "${{ github.server_url }}/${{ github.repository }}" "${{ inputs.tag }}" | grep -q "${{ inputs.tag }}" || {
+            echo "::error::Tag '${{ inputs.tag }}' does not exist in the repository"
+            exit 1
+          }
+
   build_artifacts:
+    needs: [validate_tag]
+    if: always() && (needs.validate_tag.result == 'success' || needs.validate_tag.result == 'skipped')
     name: Build wheel on ubuntu-latest
     runs-on: ubuntu-latest
     strategy:
@@ -69,7 +88,7 @@ jobs:
     runs-on: ubuntu-latest
     if: >-
       (github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/v'))
-      || github.event_name == 'workflow_dispatch'
+      || (github.event_name == 'workflow_dispatch' && startsWith(inputs.tag, 'v'))
     environment:
       name: releases
       url: https://pypi.org/p/zarr