ci: One-shot CodeArtifact publish workflow (to be reverted)

beep boop

Author: khvn26

.github/workflows/publish-codeartifact.yml

@@ -0,0 +1,34 @@
+name: Publish to CodeArtifact
+
+on:
+  pull_request:
+    paths: ['.github/workflows/publish-codeartifact.yml']
+  workflow_dispatch:
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: astral-sh/setup-uv@v7
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::084060095745:role/codeartifact-github-actions-production
+          aws-region: eu-west-2
+      - name: Get CodeArtifact token
+        run: |
+          TOKEN=$(aws codeartifact get-authorization-token \
+            --domain flagsmith-production --domain-owner 084060095745 \
+            --query authorizationToken --output text)
+          echo "::add-mask::$TOKEN"
+          echo "CODEARTIFACT_TOKEN=$TOKEN" >> "$GITHUB_ENV"
+      - run: uv build
+      - run: |
+          uv publish \
+            --publish-url https://flagsmith-production-084060095745.d.codeartifact.eu-west-2.amazonaws.com/pypi/flagsmith-pypi-production/ \
+            --username aws --password "$CODEARTIFACT_TOKEN" \
+            dist/*