Reorganize paperspec commands and pin dependency versions (#2)

Reviewed-on: #2

.gitea/workflows/publish.yml

@@ -0,0 +1,66 @@
+# Publishes the paperspec Python package to this instance's PyPI registry when a version tag (v0.1.1) is
+# pushed; see deploy/README.md for the secrets it needs and how to install from the registry.
+# The package version comes from the tag through setuptools-scm, so the job refuses to upload unless the
+# built version equals the tag. Run it by hand only on a tag, for example after adding the secrets.
+name: publish
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: publish-${{ github.ref }}
+  cancel-in-progress: false
+defaults:
+  run:
+    shell: bash
+jobs:
+  publish:
+    runs-on: linux-base
+    container:
+      image: git.scient.ing/infra/linux-base:26.10.7
+    timeout-minutes: 30
+    env:
+      REGISTRY: ${{ github.server_url }}/api/packages/${{ github.repository_owner }}/pypi
+    steps:
+      - name: Require a version tag
+        run: |
+          if [[ "$GITHUB_REF" != refs/tags/v* ]]; then
+            echo "Publish runs on a version tag such as v0.1.1; $GITHUB_REF is not one."
+            exit 1
+          fi
+      # The whole history, so setuptools-scm finds the tag and computes the release version.
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Check the repository
+        run: pixi run --locked check
+      - name: Build the sdist and wheel
+        run: pixi run --locked -e dev dist
+      - name: Confirm the built version is the tag
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          wheels=(dist/paperspec-*.whl)
+          built="$(basename "${wheels[0]}" | cut -d- -f2)"
+          echo "tag $GITHUB_REF_NAME, built $built"
+          if [ "${#wheels[@]}" -ne 1 ] || [ "$built" != "$tag" ]; then
+            echo "The built version is not the tag's; is the tag on the commit this job checked out?"
+            exit 1
+          fi
+      - name: Check the package metadata
+        run: pixi run --locked -e dev twine check --strict dist/*
+      # --skip-existing makes a rerun on the same tag succeed instead of failing on the files already there.
+      - name: Upload to the package registry
+        env:
+          TWINE_USERNAME: ${{ secrets.PACKAGE_USER }}
+          TWINE_PASSWORD: ${{ secrets.PACKAGE_TOKEN }}
+          TWINE_REPOSITORY_URL: ${{ env.REGISTRY }}
+        run: |
+          if [ -z "$TWINE_USERNAME" ] || [ -z "$TWINE_PASSWORD" ]; then
+            echo "The secrets PACKAGE_USER and PACKAGE_TOKEN are not set; deploy/README.md says how."
+            exit 1
+          fi
+          pixi run --locked -e dev twine upload --non-interactive --skip-existing dist/*
+          echo "Published to $REGISTRY: pip install --index-url $REGISTRY/simple/ paperspec"