chore: github fucking sucks

Signed-off-by: Brian Harring <ferringb@gmail.com>

Author: ferringb

.github/workflows/release.yml

@@ -82,9 +82,55 @@ jobs:
         if-no-files-found: error
 
   publish:
-    if: github.ref_type == 'tag' || ( github.ref_type == 'branch' || github.ref_name == 'release-test-pypi' )
+    if: github.ref_type == 'tag'
     needs: [build]
-    uses: ./.github/workflows/_publish.yml
-    with:
-      is_test: ${{ github.ref_type == 'tag' }}
-      release-artifact-ids: ${{ needs.build.outputs.release-artifact-id }},${{ needs.build.outputs.wheel-artifact-id }}
+    environment: release
+    permissions:
+      id-token: write # Used to authenticate to PyPI via OIDC
+      contents: read
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Download artifacts
+      uses: actions/download-artifact@v5
+      with:
+        artifact-ids: ${{ needs.build.outputs.release-artifact-id }},${{ needs.build.outputs.wheel-artifact-id }}
+
+    - name: debug
+      run: find .
+
+    - name: Publish github source
+      uses: softprops/action-gh-release@v2
+      with:
+        files: 'release-source/*.tar.*'
+        fail_on_unmatched_files: true
+        draft: true
+
+    - name: Publish to PyPi server
+      uses: pypa/gh-action-pypi-publish@release/v1.13
+      with:
+        packages-dir: wheel-source/
+
+  test-publish:
+    if: github.ref == '/refs/heads/release-test-pypi'
+    needs: [build]
+    environment: test-release
+    permissions:
+      id-token: write # Used to authenticate to PyPI via OIDC
+      contents: read
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Download artifacts
+      uses: actions/download-artifact@v5
+      with:
+        artifact-ids: ${{ needs.build.outputs.wheel-artifact-id }}
+
+    - name: debug
+      run: find .
+
+    - name: Publish to Test PyPi server
+      uses: pypa/gh-action-pypi-publish@release/v1.13
+      with:
+        packages-dir: wheel-source/
+        repository-url: https://test.pypi.org/legacy