run publish workflow on merge, block merge without version bumps

.github/workflows/ci.yaml

@@ -59,6 +59,31 @@ jobs:
       - name: Run pure unit tests
         run: pytest tests/ -m "not spark"
 
+  version-bump-check:
+    name: Version bump check
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Check version was bumped
+        env:
+          LABELS: ${{ toJson(github.event.pull_request.labels.*.name) }}
+        run: |
+          if echo "$LABELS" | grep -q '"skip-version-bump"'; then
+            echo "Skipping version bump check (skip-version-bump label present)"
+            exit 0
+          fi
+          CURRENT=$(grep '^version' pyproject.toml | cut -d '"' -f 2)
+          BASE=$(git show origin/${{ github.base_ref }}:pyproject.toml | grep '^version' | cut -d '"' -f 2)
+          if [ "$CURRENT" = "$BASE" ]; then
+            echo "::error::Version not bumped. Update the version in pyproject.toml before merging (current: $CURRENT)."
+            exit 1
+          fi
+          echo "Version bumped: $BASE -> $CURRENT"
+
   spark-compatibility-tests:
     name: Spark compatibility tests (Python ${{ matrix.python-version }}, PySpark ${{ matrix.pyspark-version }})
     runs-on: ubuntu-latest

.github/workflows/publish-on-version-bump.yaml

@@ -0,0 +1,80 @@
+name: Publish to PyPI on Version Bump
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - pyproject.toml
+
+jobs:
+  publish:
+    name: Build and publish to PyPI
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Get version
+        id: version
+        run: |
+          VERSION=$(grep '^version' pyproject.toml | cut -d '"' -f 2)
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Build
+        run: |
+          python3 -m pip install --upgrade build
+          python3 -m build
+
+      - name: Tag release commit
+        uses: actions/github-script@v7
+        with:
+          script: |
+            try {
+              await github.rest.git.createRef({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                ref: 'refs/tags/v${{ steps.version.outputs.version }}',
+                sha: context.sha
+              });
+            } catch (e) {
+              if (e.status !== 422) throw e;
+              core.warning('Tag v${{ steps.version.outputs.version }} already exists, skipping.');
+            }
+
+      - name: Publish
+        run: |
+          python3 -m pip install --upgrade twine
+          python3 -m twine upload dist/* -u __token__ -p "${{ secrets.PYPI_API_KEY }}"
+
+      - name: Get previous tag
+        id: prev_tag
+        run: |
+          PREV=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")
+          echo "tag=$PREV" >> $GITHUB_OUTPUT
+
+      - name: Build Changelog
+        id: github_release
+        uses: mikepenz/release-changelog-builder-action@v4
+        with:
+          fromTag: ${{ steps.prev_tag.outputs.tag }}
+          toTag: v${{ steps.version.outputs.version }}
+          configurationJson: |
+            {
+              "template": "#{{CHANGELOG}}\n\n## Changelog\n#{{UNCATEGORIZED}}",
+              "pr_template": " - #{{TITLE}} ( PR: ##{{NUMBER}} )"
+            }
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: v${{ steps.version.outputs.version }}
+          name: v${{ steps.version.outputs.version }}
+          body: ${{ steps.github_release.outputs.changelog }}
+          draft: false