fix(): Improve PyPI approval release context

[benflexcompute]

What changed

• update the collect-approval-context job to checkout the tagged commit instead of the workflow ref
• add a Release tag/version row to the approval summary table
• add a flow360/version.py row that links to the version file at the tagged commit and shows the parsed __version__

Why

In workflow_dispatch, the workflow ref can be the release branch HEAD rather than the tagged commit being approved. That makes the approval summary less trustworthy for manual release inspection. Checking out the tagged commit and showing both the requested release tag/version and the actual flow360/version.py value makes approval easier and safer.

Impact

Approvers can verify the exact version metadata for the commit that will be published without leaving the approval summary.

Validation

• inspected the workflow diff to confirm only collect-approval-context changed
• ran git diff --check -- .github/workflows/pypi-publish.yml
• ran a local node regex parse against flow360/version.py to verify the __version__ extraction logic

---

Note

Medium Risk
Changes a release/publish GitHub Actions workflow, so a mistake could block or mislead manual approvals, but it only affects the approval-context job and adds read-only metadata parsing.

Overview
The collect-approval-context job now checks out the tagged commit SHA (not the workflow ref) and includes flow360/version.py in the sparse checkout so the approval context is anchored to what will be published.

The approval summary adds a release tag/version row and a flow360/version.py row that links to the file at the tagged commit and displays the parsed __version__ value.

^{Reviewed by Cursor Bugbot for commit 167dc6a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 167dc6a. Configure here.}

[cursor]

Sparse-checkout cone mode incompatible with file path

Low Severity

The sparse-checkout list now includes flow360/version.py, which is a file path, but actions/checkout@v4 defaults sparse-checkout-cone-mode to true. Cone mode is designed for directory patterns, not individual files. Git treats flow360/version.py as a directory, which causes it to include all files in the parent flow360/ directory rather than just version.py. The file ends up being checked out (as a side effect of parent-directory inclusion), but this relies on an undocumented behavior that could change across git versions. Adding sparse-checkout-cone-mode: false would make the intent explicit and reliable.

 

^{Reviewed by Cursor Bugbot for commit 167dc6a. Configure here.}