CI: Test that any bump to changelog has a corresponding tag

Prevents forgetting to sign the tag, which is currently done out of band and independently of review.

.gitlab-ci.yml

@@ -84,3 +84,13 @@ test:
   script:
     - apt-get -y build-dep .
     - ninja -C _build test
+
+check_release:
+  <<: *tags
+  stage: test
+  only:
+    refs:
+      - master
+  script:
+    - apt-get install git python3
+    - (head -n 1 ./debian/changelog && git tag) | ./debian/check_release.py

debian/check_release.py

@@ -0,0 +1,10 @@
+#!/usr/bin/env python3
+
+"""Checks tag before release.
+Feed it the first changelog line, and then all available tags.
+"""
+
+import re, sys
+tag = "v" + re.findall("\\((.*)\\)", input())[0]
+if tag not in map(str.strip, sys.stdin.readlines()):
+    raise Exception("Changelog's current version doesn't have a tag. Push the tag!")