[jonathan-kosgei]

Summary

A merge to main that bumps $VERSION in lib/Net/IPData.pm is now enough to tag vX.Y.Z, create the GitHub release and upload the distribution to CPAN. Nothing is tagged by hand any more, and a merge whose version is already tagged publishes nothing.

• ci.yml: a release job after the test matrix (pushes to the default branch only) and a publish job that calls the CPAN upload workflow when a tag was created.
• release.yml: now also callable (workflow_call with a tag input). The release: published trigger is kept, so a release published by hand still uploads its tag. The build and upload steps and the secrets they use are unchanged.
• README: a maintainer-facing "Releasing" section after "Testing". Changes: an Unreleased entry, since this file logs CI changes too.

How it works

1. release runs after every matrix leg has passed, only for push events on the repository's default branch, with contents: write and the release concurrency group (no cancellation), so two merges in a row are handled one after the other.
2. It reads the version with sed -nE "s/.*VERSION *= *['\"]([^'\"]+)['\"].*/\1/p" lib/Net/IPData.pm | head -1 and derives the tag v<version>.
3. git ls-remote --exit-code --tags origin "refs/tags/$TAG" decides: exit 0 means the tag exists (nothing to do, output created=false); exit 2 means it is missing, so gh release create "$TAG" --target "$GITHUB_SHA" --title "$TAG" --generate-notes creates the tag and the release in one step (created=true); any other exit status fails the job.
4. A tag created with the workflow's own GITHUB_TOKEN does not start other workflow runs, so the upload has to happen in the same run: publish (needs: release, if: needs.release.outputs.created == 'true') calls release.yml with the tag and secrets: inherit. The called workflow checks out the tag it was given (falling back to github.event.release.tag_name on the release trigger), then builds, tests, builds the distribution and runs cpan-upload exactly as before.
5. Pull request CI is unchanged: release and publish are skipped there.

Verification

• Both workflows parse with PyYAML; actionlint 1.7.12 (with shellcheck 0.9.0) reports nothing.
• The version command prints 1.1.0 for the checked-out lib/Net/IPData.pm; git ls-remote --exit-code --tags origin refs/tags/v9.9.9 exits with 2 for a missing tag and with 0 for the existing v1.1.0.
• The two scripts of the release job were run locally with bash -e, a stub gh and a temporary GITHUB_OUTPUT: existing tag -> created=false; missing tag -> gh release create v9.9.9 --target <sha> --title v9.9.9 --generate-notes and created=true; a failing ls-remote -> the job fails with its status; a module file without $VERSION -> the job fails.
• perl Makefile.PL && make && make test (180 tests) and make dist succeed on this branch; the tarball carries the updated Changes and README.
• Not verifiable before the merge: the push-triggered release job itself and its call into release.yml. The first run on main will find v1.1.0 already tagged and publish nothing; the next version bump exercises the full path.

🤖 Generated with Claude Code