Add a pipeline stage to compare the git tag (when applied) to the version specified in galaxy.yml
When the Gitlab CI/CD pipeline is triggered by a git tag, it should make sure that the git tag value matches the value of "version" in galaxy.yml. Add a job to the .gitlab-ci.yml to do this comparison and exit with an error state if the values don't match.
The final job should only run in situations where a git tag has been applied, but during testing you might want to allow the job to run in the branch since that's really the only way you can test.
There's lots of examples of how to create and configure CI/CD jobs in our Gitlab already, but you might want to familiarize yourself with the Gitlab CI/CD process in the official Gitlab Docs.
For getting the version from galaxy.yml, I'd suggest making use of of yq.