chore: block VCS deps from usage in release

Signed-off-by: Brian Harring <ferringb@gmail.com>

Author: ferringb

.github/workflows/release.yml

@@ -20,6 +20,17 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v4
 
+    - name: Reject any VCS dependencies
+      shell: python
+      run: |
+        import re, tomllib
+        manifest = tomllib.load(open('pyproject.toml', 'rb'))
+        deps = manifest['build-system']['requires']
+        deps.extend(manifest['project']['dependencies'])
+        if rejects := list(filter(re.compile(r'@[^+]+').search, deps)):
+          rejects = "  \n".join(sorted(rejects))
+          raise Exception(f'VCS dependencies were detected in [build-system]:\n  {rejects}')
+
     - name: Set up Python 3.13
       uses: actions/setup-python@v5
       with: