feat(ci): publish to pypi from ci

.github/workflows/ci.yml

@@ -0,0 +1,35 @@
+name: Tests
+
+on:
+  push:
+    branches: ["*"]
+    tags: ["v*"]
+  pull_request:
+    branches: [master]
+
+permissions:
+  contents: read
+
+jobs:
+  tests:
+    name: Run Tests
+    uses: ./.github/workflows/tests.yml
+
+  pypi-publish:
+    name: Upload to PyPI
+    needs: tests
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+    environment:
+      name: pypi
+      url: https://pypi.org/p/barnhunt
+    permissions:
+      id-token: write
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          skip-existing: true

.github/workflows/tests.yml

@@ -1,10 +1,9 @@
 name: Tests
 
 on:
-  push:
-    branches: ["*"]
-  pull_request:
-    branches: [main]
+  workflow_call:
+    # https://docs.github.com/en/actions/using-workflows/reusing-workflows
+  workflow_dispatch:
 
 jobs:
   tests:
@@ -93,3 +92,20 @@ jobs:
     - run: pre-commit run -a
     - run: tox r -e lint
       if: ${{ success() || failure() }}
+
+  build:
+    name: Build python package
+    needs: [coverage, lint]
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - run: python -m pip install --upgrade pip
+    - run: python -m pip install build
+    - run: python -m build .
+    - uses: actions/upload-artifact@v4
+      with:
+        name: dist
+        path: dist/
+        retention-days: 1       # save money