refactor(ci): GitHub and PyPI release on tag

transition to PyPI Trusted Publisher https://docs.pypi.org/trusted-publishers/

Author: thekaveman

.github/workflows/.python-version

@@ -0,0 +1,62 @@
+name: Release to GitHub and PyPI
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - "v[2-9].[0-9]+.[0-9]+"
+      - "v[2-9].[0-9]+.[0-9]+-pre[0-9]?"
+
+jobs:
+  test:
+    uses: ./.github/workflows/test.yml
+
+  release:
+    runs-on: ubuntu-latest
+    environment: release
+    needs: test
+    permissions:
+      # https://github.com/softprops/action-gh-release#permissions
+      contents: write
+      # IMPORTANT: this permission is mandatory for trusted publishing
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v4
+        with:
+          python-version: "3.11"
+          cache: pip
+          cache-dependency-path: "**/pyproject.toml"
+
+      - name: Install build dependencies
+        run: pip install build
+
+      - name: Build package
+        run: python -m build
+
+      - name: Release
+        id: release
+        uses: softprops/action-gh-release@v1
+        with:
+          files: |
+            ./dist/*.whl
+            ./dist/*.tar.gz
+          prerelease: ${{ contains(github.ref, '-pre') }}
+          generate_release_notes: ${{ !contains(github.ref, '-pre') }}
+
+      - name: Publish to Test PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1.5
+        if: ${{ contains(github.ref, '-pre') }}
+        with:
+          repository_url: https://test.pypi.org/legacy/
+          print_hash: true
+          skip_existing: true
+          verbose: true
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1.5
+        if: ${{ !contains(github.ref, '-pre') }}
+        with:
+          print_hash: true