Set environment variable to fail build if repo is dirty

[lordmauve]

setuptools-scm allows building from a dirty repository by appending a .dev0+gHASH.dYYYYMMDD version. If the repository has been accidentally dirtied in a release workflow, this can lead to accidentally releasing artifacts with incorrect version numbers.

There are existing features to override the version, but this means that what is released may not be what is committed at that version - the dirtiness should be investigated.

It would be preferable to stop and fix the workflow.

We should add an environment variable (e.g., SETUPTOOLS_SCM_DISALLOW_DIRTY) that, if set, causes the build to fail immediately if the repo is dirty.

While I could add this assertion myself outside of setuptools-scm, it is always possible that build frontends like build, or other abstractions like uv tool run are the things causing the modification. It's more reliable if the check is based on exactly the state that setuptools_scm sees.

The failure message should explain exactly why the repo was detected as dirty.

[RonnyPfannschmidt]

We could provide a version scheme that raises a exception on changes and the overrides feature would allows to use it

It should be part of the official release recommendation for release pipelines