ci: auto-publish to PyPI on version tag via Trusted Publishing

Push a `v*` tag to build (uv build) and publish to PyPI. Uses OIDC
Trusted Publishing — no token stored in the repo. A guard fails the run
if the tag does not match the version in pyproject.toml.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CHb1FkoMGfDfwmeJR5hBG6

Author: luohaha

.github/workflows/release.yml

@@ -0,0 +1,41 @@
+name: Release to PyPI
+
+# Push a version tag (e.g. `v0.1.0`) to build and publish to PyPI.
+# Auth is PyPI Trusted Publishing (OIDC) — no token/secret in the repo.
+# One-time setup: on pypi.org add a publisher for project `goaloop`
+#   owner: luohaha   repo: GoaLoop   workflow: release.yml   environment: pypi
+
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/goaloop
+    permissions:
+      id-token: write   # mint the OIDC token Trusted Publishing needs
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+
+      - name: Verify tag matches package version
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          ver=$(grep -m1 '^version' pyproject.toml | sed -E 's/.*"([^"]+)".*/\1/')
+          echo "tag=$tag  pyproject=$ver"
+          if [ "$tag" != "$ver" ]; then
+            echo "::error::tag v$tag does not match pyproject version $ver — bump pyproject.toml first"
+            exit 1
+          fi
+
+      - name: Build sdist + wheel
+        run: uv build
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1