ci: publish to pypi

Author: drainpixie

.github/workflows/cd-publish.yml

@@ -1,7 +1,6 @@
 name: "CD: Build & Publish"
 
 # TODO: Notify
-# TODO: Publish to PyPI
 
 on:
   pull_request:
@@ -157,3 +156,38 @@ jobs:
           files: dist/*
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  pypi-publish:
+    name: Publish to PyPI
+    runs-on: ubuntu-latest
+    needs: [build]
+    permissions:
+      id-token: write
+    steps:
+      - name: "[INIT] Checkout"
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: "[DOWNLOAD] Artifacts"
+        uses: actions/download-artifact@v4
+        with:
+          name: dist-artifacts
+          path: dist/
+
+      - name: "[INIT] Install Nix"
+        uses: cachix/install-nix-action@v31
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+          github_access_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: "[INIT] Setup Cachix"
+        uses: cachix/cachix-action@v15
+        with:
+          name: amperser
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
+      - name: "[PUBLISH] PyPI via uv"
+        if: ${{ github.event_name == 'workflow_dispatch' }}
+        run: |
+          nix develop --command uv publish