infra: fix manual trigger for the "release python" github workflow

.github/workflows/release_python.yml

@@ -23,10 +23,11 @@ on:
     types:
       - completed
   workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.workflow_run.head_branch }}-${{ github.event_name }}
-  cancel-in-progress: true
+    inputs:
+      release_tag:
+        description: 'Release tag (e.g., v0.4.0 or v0.4.0-rc.1)'
+        required: true
+        type: string
 
 permissions:
   contents: read
@@ -46,12 +47,20 @@ jobs:
       cargo-version: ${{ steps.validate.outputs.cargo-version }}
       is-rc: ${{ steps.validate.outputs.is-rc }}
     steps:
+      - uses: actions/checkout@v6
+        if: ${{ github.event_name == 'workflow_dispatch' }}
+
       - name: Validate release tag format
         id: validate
+        # Use input for workflow_dispatch, otherwise use `workflow_run.head_branch`
         # Note, `workflow_run.head_branch` does not contain `refs/tags/` prefix, just the tag name, i.e. `v0.4.0` or `v0.4.0-rc.1`
         # Valid formats: v<major>.<minor>.<patch> OR v<major>.<minor>.<patch>-rc.<release_candidate>
         run: |
-          RELEASE_TAG="${{ github.event.workflow_run.head_branch }}"
+          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
+            RELEASE_TAG="${{ github.event.inputs.release_tag }}"
+          else
+            RELEASE_TAG="${{ github.event.workflow_run.head_branch }}"
+          fi
           echo "Validating release tag: $RELEASE_TAG"
           if [[ ! "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-rc\.[0-9]+)?$ ]]; then
             echo "❌ Invalid release tag format: $RELEASE_TAG"
@@ -65,6 +74,26 @@ jobs:
           CARGO_VERSION="${RELEASE_TAG#v}"
           echo "Cargo version (without v prefix): $CARGO_VERSION"
 
+          # For manual triggers, validate that the tag matches the version in Cargo.toml
+          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
+            # Extract base version (without -rc.X suffix) for comparison with Cargo.toml
+            BASE_VERSION="${CARGO_VERSION%-rc.*}"
+            echo "Base version (for Cargo.toml comparison): $BASE_VERSION"
+
+            # Read version from Cargo.toml and validate it matches
+            CARGO_TOML_VERSION=$(grep '^version = ' bindings/python/Cargo.toml | head -1 | sed 's/version = "\(.*\)"/\1/')
+            echo "Version in bindings/python/Cargo.toml: $CARGO_TOML_VERSION"
+
+            if [ "$BASE_VERSION" != "$CARGO_TOML_VERSION" ]; then
+              echo "❌ Version mismatch!"
+              echo "   Release tag base version: $BASE_VERSION"
+              echo "   bindings/python/Cargo.toml version: $CARGO_TOML_VERSION"
+              echo "Please ensure the release tag matches the version in Cargo.toml"
+              exit 1
+            fi
+            echo "✅ Version matches bindings/python/Cargo.toml"
+          fi
+
           # Check if this is a release candidate
           if [[ "$RELEASE_TAG" =~ -rc\.[0-9]+$ ]]; then
             IS_RC="true"