ci: publish PyPI from release-please on master (#1169)

Co-authored-by: MilesCranmerBot <milescranmerbot@users.noreply.github.com>
Co-authored-by: Miles Cranmer <miles.cranmer@gmail.com>

Author: MilesCranmerBot

.github/workflows/pypi_deploy.yml

@@ -1,9 +1,11 @@
 name: Deploy PyPI
 on:
-  push:
-    tags:
-      - 'v*.*.*'
   workflow_dispatch:
+    inputs:
+      publish_ref:
+        description: Tag or ref to publish manually (for backfills, e.g. v1.5.10)
+        required: true
+        type: string
 
 jobs:
   pypi:
@@ -12,26 +14,29 @@ jobs:
       name: pypi
       url: https://pypi.org/p/pysr
     permissions:
+      contents: read
       id-token: write
     steps:
-      - name: "Checkout"
+      - name: Checkout
         uses: actions/checkout@v6
-      - name: "Set up Python"
+        with:
+          ref: ${{ inputs.publish_ref }}
+      - name: Set up Python
         uses: actions/setup-python@v6
         with:
           python-version: 3.10.8
-      - name: "Install building tools"
+      - name: Install building tools
         run: pip install build
-      - name: "Build package"
+      - name: Build package
         run: python -m build
-      - name: "Publish distribution 📦 to Test PyPI"
+      - name: Publish distribution 📦 to Test PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
           password: ${{ secrets.TEST_PYPI_API_TOKEN }}
           repository-url: https://test.pypi.org/legacy/
           skip-existing: true
           verbose: true
-      - name: "Publish distribution 📦 to PyPI"
+      - name: Publish distribution 📦 to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
           password: ${{ secrets.PYPI_API_TOKEN }}

.github/workflows/release-please.yml

@@ -13,11 +13,51 @@ permissions:
 jobs:
   release-please:
     runs-on: ubuntu-latest
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
+      sha: ${{ steps.release.outputs.sha }}
     steps:
-      - uses: googleapis/release-please-action@v4
+      - id: release
+        uses: googleapis/release-please-action@v4
         with:
-          command: manifest
           token: ${{ secrets.GITHUB_TOKEN }}
           target-branch: master
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
+
+  publish-pypi:
+    needs: release-please
+    if: ${{ needs.release-please.outputs.release_created == 'true' }}
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/pysr
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Checkout released revision
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.release-please.outputs.sha }}
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: 3.10.8
+      - name: Install building tools
+        run: pip install build
+      - name: Build package
+        run: python -m build
+      - name: Publish distribution 📦 to Test PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          password: ${{ secrets.TEST_PYPI_API_TOKEN }}
+          repository-url: https://test.pypi.org/legacy/
+          skip-existing: true
+          verbose: true
+      - name: Publish distribution 📦 to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          password: ${{ secrets.PYPI_API_TOKEN }}
+          verbose: true