dev: make hackageupload: do it only from a release branch

To avoid mishaps like yesterday's upload of 1.24.99, this will now
only work from a branch named VERSION-branch or (possible future
naming) VERSION-release.

This means major releases from master are no longer allowed; a release
branch is always required,

Makefile

@@ -913,8 +913,8 @@ tag-project: $(call def-help,tag-project, make a git release tag for the project
 # 	for p in $(PACKAGES); do cabal upload $$p/dist/$$p-$(VERSION).tar.gz -v2 --check; done
 
 hackageupload: \
-	$(call def-help,hackageupload, upload all packages to hackage	)
-	for p in $(PACKAGES); do stack upload $$p; done
+	$(call def-help,hackageupload, upload all packages to hackage	from a release branch)
+	tools/hackageupload $(PACKAGES)
 
 # showreleasestats stats: \
 # 	showreleasedays \

tools/hackageupload

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -e
+
+BRANCH=$(git rev-parse --abbrev-ref HEAD)
+if [[ $BRANCH =~ ^[0-9.]*-(branch|release) ]]; then
+    PACKAGES=$*
+    printf "\nReady to publish on hackage.haskell.org:\n\n"
+    for P in $PACKAGES; do
+        printf "%s %s\n" "$P" "$(grep ^version: "$P"/"$P".cabal | sed -E 's/version: +//')"
+    done
+    echo
+    read -rp "Ok ? Press enter to confirm, ctrl-c to abort: "
+    for P in $PACKAGES; do 
+        stack upload "$P"
+    done
+else
+    printf "%s: in $BRANCH branch, please upload from the latest release branch.\n" "$(basename "$0")"
+    printf "Perhaps: git switch %s\n" $(git branch | grep -E '[0-9.]+-(branch|release)' | tail -1)
+fi