Add new publishing workflow.

Author: akustiker

.github/workflows/publish_pypi.yml

@@ -0,0 +1,62 @@
+name: publish-pypi
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  build-and-publish:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Verify tag matches pyproject.toml version
+        if: startsWith(github.ref, 'refs/tags/')
+        run: |
+          python - <<'PY'
+          import os
+          import tomllib
+
+          tag = os.environ["GITHUB_REF_NAME"]
+          if not tag.startswith("v"):
+            raise SystemExit(f"Tag must start with 'v', got {tag!r}")
+
+          tag_version = tag[1:]
+          with open("pyproject.toml", "rb") as f:
+            pyproject = tomllib.load(f)
+
+          project_version = pyproject["project"]["version"]
+          if project_version != tag_version:
+            raise SystemExit(
+              f"Version mismatch: tag {tag_version} != pyproject.toml {project_version}"
+            )
+
+          print(f"OK: {tag} matches pyproject.toml version {project_version}")
+          PY
+
+      - name: Build distributions
+        run: |
+          python -m pip install -U pip build
+          python -m build
+
+      - name: Check distributions
+        run: |
+          python -m pip install -U twine
+          python -m twine check dist/*
+
+      - name: Publish to PyPI (Trusted Publishing)
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: pypa/gh-action-pypi-publish@release/v1