ci: Migrate release workflow to Trusted Publishing #80

	name: Release

	on:
	pull_request:
	types: [closed]
	branches: [main]

	defaults:
	run:
	shell: bash

	jobs:
	create-release:
	name: Create GitHub Release
	if: github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'version-bump')
	runs-on: ubuntu-latest
	permissions:
	contents: write
	steps:
	- name: Generate token
	id: generate-token
	uses: actions/create-github-app-token@v1
	with:
	app-id: ${{ vars.WORKOS_BOT_APP_ID }}
	private-key: ${{ secrets.WORKOS_BOT_PRIVATE_KEY }}

	- name: Checkout
	uses: actions/checkout@v4
	with:
	token: ${{ steps.generate-token.outputs.token }}

	- name: Get version from pyproject.toml
	id: get-version
	run: \|
	VERSION=$(grep '^version = ' pyproject.toml \| sed 's/version = "$.*$"/\1/')
	echo "version=$VERSION" >> $GITHUB_OUTPUT

	- name: Create Release
	uses: softprops/action-gh-release@v2
	with:
	tag_name: v${{ steps.get-version.outputs.version }}
	name: v${{ steps.get-version.outputs.version }}
	generate_release_notes: true
	token: ${{ steps.generate-token.outputs.token }}

	publish:
	name: Publish to PyPI
	needs: create-release
	runs-on: ubuntu-latest
	permissions:
	id-token: write
	contents: read
	steps:
	- name: Checkout
	uses: actions/checkout@v4
	- name: Install uv
	uses: astral-sh/setup-uv@v6
	- name: Build
	run: uv build
	- name: Publish
	run: uv publish

Provide feedback