feat(ci): publish to PyPI and GitHub release on tag

.github/workflows/release.yml

@@ -0,0 +1,69 @@
+name: Publish release
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - "202[3-9].[0-9][0-9].[0-9]+"
+      - "202[3-9].[0-9][0-9].[0-9]+-rc[0-9]+"
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  test:
+    uses: ./.github/workflows/pytest.yml
+
+  release:
+    runs-on: ubuntu-latest
+    environment: release
+    needs: test
+    permissions:
+      # https://github.com/softprops/action-gh-release#permissions
+      contents: write
+      # https://docs.pypi.org/trusted-publishers/using-a-publisher/
+      id-token: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+          cache: pip
+          cache-dependency-path: "**/pyproject.toml"
+
+      - name: Install build dependencies
+        run: pip install build
+
+      - name: Build package
+        run: python -m build
+        working-directory: ./toggl_py
+
+      - name: Publish to Test PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        if: ${{ contains(github.ref, '-rc') }}
+        with:
+          packages-dir: toggl_py/
+          repository_url: https://test.pypi.org/legacy/
+          print_hash: true
+          skip_existing: true
+          verbose: true
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        if: ${{ !contains(github.ref, '-rc') }}
+        with:
+          packages-dir: toggl_py/
+          print_hash: true
+
+      - name: Release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            ./toggl_py/dist/*.tar.gz
+            ./toggl_py/dist/*.whl
+          prerelease: ${{ contains(github.ref, '-rc') }}
+          generate_release_notes: ${{ !contains(github.ref, '-rc') }}