Move PyPI publish to a separate step

.github/workflows/choreolib.yml

@@ -139,7 +139,7 @@ jobs:
           path: combiner/products/build/allOutputs
 
       - name: Flatten Artifacts
-        run: rsync -a --delete combiner/products/build/allOutputs/*/* combiner/products/build/allOutputs/
+        run: rsync -a --delete combiner/products/build/allOutputs/*/* combiner/products/build/allOutputs
 
       - uses: actions/setup-java@v4
         with:
@@ -157,7 +157,12 @@ jobs:
 
   build-python:
     name: "Build Python"
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
+    environment:
+      name: pypi
+      url: https://pypi.org/p/sleipnirgroup-jormungandr
+    permissions:
+      id-token: write
     steps:
       - uses: actions/checkout@v4
         with:
@@ -179,10 +184,22 @@ jobs:
       - uses: actions/upload-artifact@v4
         with:
           name: dist
-          path: ./choreolib/py/dist/
-
+          path: ./choreolib/py/dist
+
+  pypi-publish:
+    name: Upload release to PyPI
+    runs-on: ubuntu-24.04
+    needs: [build-python]
+    if: github.repository_owner == 'SleipnirGroup' && github.ref == 'refs/heads/main'
+    environment:
+      name: pypi
+      url: https://pypi.org/p/sleipnirgroup-choreolib
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          path: dist
+          pattern: 'dist'
       - name: Publish package distributions to PyPI
-        if: startsWith(github.ref, 'refs/tags/v')
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          packages_dir: ./choreolib/py/dist/