feat: automatic release process

.github/workflows/python-publish.yml

@@ -0,0 +1,63 @@
+# .github/workflows/upload-python-package.yml
+name: Upload Python Package
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Existing release tag (e.g., v1.2.3)"
+        required: true
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Resolve tag
+        id: resolve
+        shell: bash
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "TAG=${{ inputs.tag }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "TAG=${{ github.event.release.tag_name }}" >> "$GITHUB_OUTPUT"
+          fi
+          echo "Resolved tag: $(cat $GITHUB_OUTPUT)"
+
+      # Check out the code exactly at the release tag so you publish the right bits
+      - name: Check out
+        uses: actions/checkout@v4
+        with:
+          ref: refs/tags/${{ steps.resolve.outputs.TAG }}
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.x"
+
+      - name: Install build & twine
+        run: |
+          python -m pip install --upgrade pip
+          pip install build twine bump2version
+
+      - name: Bump version to release tag
+        run: |
+          # Extract version from tag (e.g., v1.2.3 -> 1.2.3)
+          VERSION="${{ steps.resolve.outputs.TAG }}"
+          VERSION="${VERSION#v}"  # Remove 'v' prefix if present
+          echo "Bumping version to: $VERSION"
+          # Update version in files without committing/tagging
+          bumpversion --new-version "$VERSION" --allow-dirty --no-commit --no-tag patch
+
+      - name: Build dists
+        run: python -m build
+
+      - name: Upload to PyPI
+        env:
+          # tip: many projects use TWINE_USERNAME="__token__" and TWINE_PASSWORD=<pypi token>
+          TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
+          TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
+        run: |
+          twine upload --skip-existing --verbose dist/*