ci: Subdivide release job

This is needed because the SLSA provenance reusable workflow cannot be
used as a step within a job, but must be used as a job on its own.  This
commit therefore subdivides the `release` job into a `release` job,
which runs `python-semantic-release` to create a new release, if
applicable, and then a `publish` job, to publish the release to PyPI and
GitHub Releases, if one was created.  We'll then be able to insert the
SLSA provenance job between the two.

Author: jmgate

.github/workflows/semantic-release.yml

@@ -8,10 +8,12 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: release
+
 jobs:
   release:
     runs-on: ubuntu-latest
-    concurrency: release
     environment: release
     permissions:
       id-token: write
@@ -37,12 +39,42 @@ jobs:
         ssh_private_signing_key: ${{ secrets.SEMANTIC_RELEASE_PRIVATE_KEY }}
         ssh_public_signing_key: ${{ secrets.SEMANTIC_RELEASE_PUBLIC_KEY }}
 
+    - name: Upload Build Artifacts
+      if: steps.release.outputs.released == 'true'
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      with:
+        name: dist
+        path: dist/
+
+    outputs:
+      released: ${{ steps.release.outputs.released }}
+
+  publish:
+    runs-on: ubuntu-latest
+    needs: release
+    if: ${{ needs.release.outputs.released == 'true' }}
+    environment: release
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
+      with:
+        egress-policy: audit
+
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        fetch-depth: 0
+        token: ${{ secrets.GH_TOKEN }}
+
+    - name: Download Artifacts
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      with:
+        name: dist
+        path: dist
+
     - name: Publish to PyPI
       uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # release/v1
-      if: steps.release.outputs.released == 'true'
 
     - name: Publish to GitHub Releases
       uses: python-semantic-release/publish-action@b717f67f7e7e9f709357bce5a542846503ce46ec # v10.2.0
-      if: steps.release.outputs.released == 'true'
       with:
         github_token: ${{ secrets.GH_TOKEN }}