ci(cron-conda): gate conda-tag and conda-dist on a dev-release version (#2458)

Mirror create-release.yml's #2452 dev-release gate in cron-conda.yml, which
has its own independent, schedule/workflow_run-reachable route to publishing
with no check against __version__ carrying a PEP 440 .devN suffix.

- conda-update's Get Version step computes PCAPKIT_DEV_RELEASE from
  packaging.version.Version(...).is_devrelease, deliberately not
  is_prerelease, which is also true for a real alpha/beta/rc this project has
  shipped and must not block.
- conda-tag's `if:` adds the clause as a top-level conjunct; conda-dist's adds
  it inside its publishing branch only, so a build-only manual run still
  builds and smoke-tests a dev version without uploading it.
- tests/project/test_conda_dev_release_gate_2458.py: text and behavioural
  checks over both jobs' `if:`, and the step script run directly against a
  1.5.0b14 (real beta) vs 1.6.0.dev3 (dev) stub to show PCAPKIT_DEV_RELEASE
  and is_prerelease actually disagree.

actionlint 1.7.12 (shellcheck 0.10.0): zero findings. New test file: 13
passed, 20 subtests passed, and verified to fail without the workflow change.
tests/project/test_release_gates.py and every other conda-* test still pass
unmodified (127 passed/451 subtests; 386 passed across the conda+release_gate
filter).

Author: JarryShaw

.github/workflows/cron-conda.yml

@@ -322,6 +322,17 @@ jobs:
           esac
 
       # A build-only run builds whether or not anything changed.
+      #
+      # #2458: `PCAPKIT_DEV_RELEASE` is `is_devrelease`, not `is_prerelease` --
+      # the latter is also `true` for a deliberately-tagged alpha/beta/rc this
+      # project has shipped for real (e.g. 1.5.0b14), and gating on it would
+      # silently block one. `is_devrelease` is `true` only for a PEP 440
+      # dev-release suffix (X.Y.Z.devN), the work-in-progress signal `conda-tag`
+      # and `conda-dist` read below so that a scheduled or `workflow_run`
+      # trigger never tags or uploads a dev version with no human in the path.
+      # Independent of create-release.yml's own `PCAPKIT_DEV_RELEASE`
+      # (`version_check`'s): this workflow has no `version_check` job to share
+      # it with, so it is computed here too.
       - name: Get Version
         if: steps.bump.outputs.bump == 'true' || needs.mode.outputs.publishes != 'true'
         id: get_version
@@ -330,6 +341,7 @@ jobs:
 
           {
             echo "PCAPKIT_VERSION=$(python -c 'import pcapkit; print(pcapkit.__version__)')"
+            echo "PCAPKIT_DEV_RELEASE=$(python -c 'from packaging.version import Version; import pcapkit; print(str(Version(pcapkit.__version__).is_devrelease).lower())')"
             echo "PCAPKIT_CONDA_LABEL=$(python -c 'from packaging.version import Version; import pcapkit; print("dev" if Version(pcapkit.__version__).is_prerelease else "main")')"
             echo "PCAPKIT_BUILD=$(cat conda/build)"
           } >> "$GITHUB_OUTPUT"
@@ -432,6 +444,9 @@ jobs:
       # The commit Push Changes put on `main`, and the one `conda-tag` tags.
       CONDA_COMMIT: ${{ steps.push-changes.outputs.commit }}
       PCAPKIT_VERSION: ${{ steps.get_version.outputs.PCAPKIT_VERSION }}
+      # #2458: read by `conda-tag` and `conda-dist` below, to block tagging and
+      # uploading a dev-release version.
+      PCAPKIT_DEV_RELEASE: ${{ steps.get_version.outputs.PCAPKIT_DEV_RELEASE }}
       PCAPKIT_CONDA_LABEL: ${{ steps.get_version.outputs.PCAPKIT_CONDA_LABEL }}
       PCAPKIT_BUILD: ${{ steps.get_version.outputs.PCAPKIT_BUILD }}
       PYTHON_CONDA: ${{ steps.python-versions.outputs.conda }}
@@ -462,10 +477,16 @@ jobs:
     # outputs, is never tagged. Same shape as create-release.yml's `tag` job.
     #
     # Never on a build-only run, which pushed nothing to tag.
+    #
+    # #2458: nor on a dev-release version (`__version__` carrying a PEP 440
+    # `.devN` suffix) -- a scheduled run or the `workflow_run` trigger above is
+    # enough to reach this job with no human in the path, as for
+    # create-release.yml's publishers.
     if: >-
       !cancelled() && needs.mode.outputs.publishes == 'true' &&
       needs.conda-update.result == 'success' &&
-      needs.conda-update.outputs.CONDA_CHANGED == 'true'
+      needs.conda-update.outputs.CONDA_CHANGED == 'true' &&
+      needs.conda-update.outputs.PCAPKIT_DEV_RELEASE != 'true'
     permissions:
       contents: write
     steps:
@@ -533,11 +554,20 @@ jobs:
     # pins the tag, which names the pushed commit only then, and `conda-tag`
     # skips only when no bump was pushed. A build-only run, which never tags,
     # builds the dispatched commit with `conda-update`'s changes applied.
+    #
+    # #2458: the dev-release check is checked again here, inside the
+    # publishing branch only, so a build-only run still builds and
+    # smoke-tests a dev version -- it uploads nothing regardless. On the
+    # publishing path it is also redundant with `conda-tag`'s own gate, which
+    # already leaves `needs.conda-tag.result` at `'skipped'` rather than
+    # `'success'`; kept explicit anyway, as create-release.yml's publishers
+    # each read it rather than relying on one another's cascade.
     if: >-
       !cancelled() && needs.conda-update.result == 'success' &&
       (needs.mode.outputs.publishes != 'true' || (
         needs.conda-tag.result == 'success' &&
-        needs.conda-update.outputs.CONDA_CHANGED == 'true'
+        needs.conda-update.outputs.CONDA_CHANGED == 'true' &&
+        needs.conda-update.outputs.PCAPKIT_DEV_RELEASE != 'true'
       ))
     permissions:
       contents: write