add separate publish workflow

Author: terraputix

.github/workflows/publish.yml

@@ -0,0 +1,102 @@
+name: Publish
+
+on:
+  workflow_dispatch:
+    inputs:
+      publish_to_pypi:
+        description: "Publish to PyPI"
+        required: true
+        default: "false"
+        type: choice
+        options:
+          - "false"
+          - "true"
+
+jobs:
+  # # First check if CI workflow succeeded
+  # check-ci:
+  #   runs-on: ubuntu-latest
+  #   steps:
+  #     - name: Check CI workflow status
+  #       uses: actions/github-script@v7
+  #       id: check-status
+  #       with:
+  #         script: |
+  #           const ref = context.sha;
+  #           const workflow_name = 'Build and Test';
+
+  #           const workflow_runs = await github.rest.actions.listWorkflowRuns({
+  #             owner: context.repo.owner,
+  #             repo: context.repo.repo,
+  #             workflow_id: workflow_name,
+  #             head_sha: ref,
+  #           });
+
+  #           const latest_run = workflow_runs.data.workflow_runs[0];
+  #           if (!latest_run || latest_run.conclusion !== 'success') {
+  #             core.setFailed('CI workflow has not succeeded for this commit');
+  #             return false;
+  #           }
+  #           return true;
+
+  publish:
+    if: ${{ startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch' }}
+    # needs: check-ci
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: write
+      attestations: write
+    steps:
+      - name: Download all wheel artifacts
+        uses: actions/download-artifact@v4
+        with:
+          workflow: build-and-test.yml
+          commit: ${{ github.sha }}
+          path: artifact-download
+
+      # Create dist directory
+      - name: Create dist directory
+        run: mkdir -p dist
+        shell: bash
+
+      # Move all wheels to dist directory
+      - name: Collect wheels
+        run: |
+          find artifact-download -name "*.whl" -o -name "*.tar.gz" | xargs -I{} cp {} dist/
+          echo "Package files in dist directory:"
+          ls -la dist/
+        shell: bash
+
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: "dist/*"
+
+      # Publish to TestPyPI
+      - name: Publish to TestPyPI
+        uses: PyO3/maturin-action@v1
+        env:
+          MATURIN_PYPI_TOKEN: ${{ secrets.TEST_PYPI_API_TOKEN }}
+          MATURIN_REPOSITORY: testpypi
+        with:
+          command: upload
+          args: --non-interactive --skip-existing dist/*
+
+      # Only publish to PyPI if the publish_to_pypi input is true
+      - name: Publish to PyPI
+        if: ${{ github.event.inputs.publish_to_pypi == 'true' }}
+        uses: PyO3/maturin-action@v1
+        env:
+          MATURIN_PYPI_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
+        with:
+          command: upload
+          args: --non-interactive --skip-existing dist/*
+
+    # # Create a GitHub release when a tag is created
+    # - name: Create GitHub Release
+    #   if: ${{ inputs.publish_to_pypi }}
+    #   uses: softprops/action-gh-release@v1
+    #   with:
+    #     generate_release_notes: true
+    #     files: dist/*