release with dispatch

.github/workflows/release.yml

@@ -1,15 +1,50 @@
-name: Upload Python Package
+name: Bump version and publish
 
 on:
-  push:
+  workflow_dispatch:
+  workflow_run:
+    workflows: [ "CI" ]
+    types: [ completed ]
 
 jobs:
-  build:
+  tag:
+    permissions:
+      contents: write
+
+    if: >
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.workflow_run.conclusion == 'success' &&
+       github.event.workflow_run.head_branch == 'main')
+
     runs-on: ubuntu-latest
+
     steps:
       - name: Checkout [${{ github.repository }}]
         uses: actions/checkout@v4
 
-      - uses: ./actions/uv/build
+      - name: Generate Tag
+        uses: ./actions/uv/tag
         with:
-          working-directory: '.github/hello-world'
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
+  publish:
+    needs: tag
+    runs-on: ubuntu-latest
+    environment: release
+
+    permissions:
+      contents: read
+      # This permission is required for trusted publishing.
+      id-token: write
+
+    steps:
+      - name: Checkout [${{ github.repository }}]
+        uses: actions/checkout@v4
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1