Add a release workflow

.github/workflows/ci.yaml

@@ -8,15 +8,15 @@ on:
 
 jobs:
   lint:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
 
     steps:
     - uses: actions/checkout@v4
 
     - uses: actions/setup-python@v5
       with:
-        python-version: '3.11'
+        python-version: "3.12"
 
     - uses: actions/cache@v4
       with:
@@ -34,15 +34,15 @@ jobs:
         TOX_PARALLEL_NO_SPINNER: 1
 
   docs:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
 
     steps:
     - uses: actions/checkout@v4
 
     - uses: actions/setup-python@v5
       with:
-        python-version: "3.11"
+        python-version: "3.12"
 
     - uses: actions/cache@v4
       with:

.github/workflows/release.yaml

@@ -0,0 +1,54 @@
+name: Release
+
+on:
+  push:
+    tags: [ "treq-*" ]
+  pull_request:
+    branches: [ trunk ]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-24.04
+
+    steps:
+    - uses: actions/checkout@v4
+
+    - uses: actions/setup-python@v5
+      with:
+        python-version: '3.12'
+
+    - run: pip install build twine
+
+    - run: python3 -m build
+
+    - run: twine check dist/*.*
+
+    - uses: actions/upload-artifact@v4
+      with:
+        name: dist
+        path: dist/*.*
+        if-no-files-found: error
+
+  pypi-publish:
+    runs-on: ubuntu-24.04
+    if: startsWith(github.ref, 'refs/tags/treq-')
+    needs: [build]
+
+    environment:
+      name: PyPI.org
+      url: https://pypi.org/project/treq
+
+    permissions:
+      id-token: write
+
+    steps:
+
+    - uses: actions/download-artifact@v4
+      with:
+        name: dist
+        path: dist/
+
+    - uses: pypa/gh-action-pypi-publish@release/v1