Releasing with a VERSION file has a footgun #155

If you have a version_file setup and push a tag, the release template that pull in the version info from the file will be used regardless of the value of that tag. We just encountered an issue where we were trying to release an rc prerelease package, so we pushed a tag v2.1.0rc1 and this created the package 2.1.0 by looking directly at the VERSION file. This is definitely on us since we had an LLM cook up the scripts and didn't see through it's faulty assumptions.

I think what we want is the tag be compared against the called out version in the version_file; see that it is compatible since it's a pre, final, or post release; and then use the tag's value over the VERSION file. But in cases where there is no tag, it uses the VERSION file with the derived dev count in the dev template. I would expect we would have to fill in tag_formatter (since tags are currently v{version}) or switch to using the actual PEP compliant version number as the tag.

That all can be accomplished right now with a custom version callback. My questions are.

1. Should what I described be standard behavior?
2. Maybe optional behavior behind a flag?
3. Instead of 1 or in addition to 2, I feel there needs to be a strict check that the tag and version are equal, just to prevent this footgun from shooting someone else.