ci: publish on version tag push rather than release PR

.github/workflows/matrix-tests.yml

@@ -3,8 +3,9 @@
 # to main or release, we want to exercise the full matrix.
 name: Run Matrix Tests
 on:
+  workflow_call:
   push:
-    branches: [main, release]
+    branches: main
 jobs:
   test:
     strategy:

.github/workflows/pythonpublish.yml

@@ -4,48 +4,70 @@
 name: Upload Python Package
 on:
   push:
-    branches: [release]
+    tags:
+      - v[0-9]+.**
 jobs:
-  deploy:
+  tests:
+    uses: ./.github/workflows/tests.yml
+    secrets: inherit
+
+  matrix-tests:
+    uses: ./.github/workflows/matrix-tests.yml
+    secrets: inherit
+
+  publish:
     runs-on: ubuntu-latest
+    needs:
+      - tests
+      - matrix-tests
+    permissions:
+      contents: write  # allows creating a GitHub Release
+      id-token: write  # allows signing the dists with Sigstore
     steps:
       - uses: actions/checkout@v4
+
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
           python-version: "3.x"
+
+      - name: Check that VERSION in _version.py and the tag are consistent
+        env:
+          VERSION: ${{ github.ref_name }}
+        run: echo "VERSION = \"${VERSION#v}\"" | diff - readalongs/_version.py"
+
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
           pip install build twine
-      - name: Build and publish
-        env:
-          TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
-          TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
-        run: |
-          python -m build --sdist --wheel
-          twine upload dist/*
-      - name: Determine tag
-        id: determine_tag
-        run: |
-          echo "TAG_VERSION=$(ls dist/readalongs-*.tar.gz | sed -e 's/.*readalongs-//' -e 's/.tar.gz.*//')" >> $GITHUB_OUTPUT
-      - name: Bump version and push tag
-        id: tag_version
-        uses: mathieudutour/[email protected]
+
+      - name: Build
+        run: python -m build --sdist --wheel
+
+      - name: Sign the dists with Sigstore
+        uses: sigstore/[email protected]
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          custom_tag: ${{ steps.determine_tag.outputs.TAG_VERSION }}
-          create_annotated_tag: true
+          inputs: >-
+            ./dist/*.tar.gz
+            ./dist/*.whl
+
+      - name: Update CHANGELOG
+        id: changelog
+        uses: requarks/changelog-action@v1
+        with:
+          token: ${{ github.token }}
+          tag: ${{ github.ref_name }}
+
       - name: Create a GitHub release
         uses: ncipollo/release-action@v1
         with:
-          tag: ${{ steps.tag_version.outputs.new_tag }}
-          name: Release ${{ steps.tag_version.outputs.new_tag }}
-          body: ${{ steps.tag_version.outputs.changelog }}
-      - name: Submit a PR for the bumped version
-        uses: peter-evans/create-pull-request@v4
-        with:
-          commit-message: "chore: commit version"
-          delete-branch: true
-          base: main
-          add-paths: readalongs/_version.py
+          tag: ${{ github.ref_name }}
+          name: ${{ github.ref_name }}
+          body: ${{ steps.changelog.outputs.changes }}
+          token: ${{ github.token }}
+
+      - name: Publish to PyPI
+        env:
+          TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
+          TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
+        run: twine upload dist/*

.github/workflows/tests.yml

@@ -2,6 +2,7 @@ name: Run Tests
 on:
   - pull_request
   - push
+  - workflow_call
 
 jobs:
   test: