ci: fix release automation dispatch

.github/workflows/auto-tag.yml

@@ -9,6 +9,7 @@ jobs:
   tag:
     runs-on: ubuntu-latest
     permissions:
+      actions: write
       contents: write
     steps:
       - uses: actions/checkout@v4
@@ -36,3 +37,9 @@ jobs:
         run: |
           git tag ${{ steps.version.outputs.tag }}
           git push origin ${{ steps.version.outputs.tag }}
+
+      - name: Run release workflow
+        if: steps.check.outputs.exists == 'false'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh workflow run release.yml --ref main -f tag=${{ steps.version.outputs.tag }}

.github/workflows/release.yml

@@ -4,6 +4,12 @@ on:
   push:
     tags:
       - "v*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag to publish, for example v0.1.6"
+        required: true
+        type: string
 
 jobs:
   publish:
@@ -14,17 +20,40 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v3
+        uses: astral-sh/setup-uv@v4
 
       - name: Build
         run: uv build
 
+      - name: Verify package metadata
+        run: |
+          uvx twine check dist/*
+          python - <<'PY'
+          import pathlib
+          import tarfile
+
+          readme = pathlib.Path("README.md").read_text()
+          sdist = next(pathlib.Path("dist").glob("*.tar.gz"))
+
+          with tarfile.open(sdist) as tar:
+              member = next(m for m in tar.getmembers() if m.name.endswith("/PKG-INFO"))
+              metadata = tar.extractfile(member).read().decode()
+
+          if readme.strip() not in metadata:
+              raise SystemExit("README.md was not embedded in package metadata")
+          PY
+
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
 
       - name: Create GitHub Release
         env:
           GH_TOKEN: ${{ github.token }}
-        run: gh release create ${{ github.ref_name }} --generate-notes
+          RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
+        run: |
+          gh release view "$RELEASE_TAG" >/dev/null 2>&1 ||
+            gh release create "$RELEASE_TAG" --verify-tag --generate-notes

README.md

@@ -11,6 +11,8 @@ A local-first memory sidecar for agent applications. One SQLite DB. One port: 87
 
 HotMem provides fast, queryable working memory with hybrid vector + keyword search. Store facts, retrieve them ranked, and get back LLM-ready message objects you can stitch directly into prompts.
 
+Supports Python 3.11, 3.12, 3.13, and 3.14.
+
 ## Install
 
 ```bash