chore: fix release upload (#377)

.github/workflows/ci.yml

@@ -99,29 +99,49 @@ jobs:
           run: dbus-run-session -- poetry run pytest --no-cov -vvvvv --codspeed tests/benchmarks
 
   release:
-    runs-on: ubuntu-latest
-    environment: release
-    outputs:
-      newest_release_tag: ${{ steps.release_tag.outputs.newest_release_tag }}
-    if: github.ref == 'refs/heads/main'
     needs:
       - test
       - lint
       - commitlint
 
+    runs-on: ubuntu-latest
+    environment: release
+    concurrency: release
+    permissions:
+      id-token: write
+      contents: write
+    outputs:
+      released: ${{ steps.release.outputs.released }}
+      newest_release_tag: ${{ steps.release_tag.outputs.newest_release_tag }}
+
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          ref: ${{ github.head_ref || github.ref_name }}
 
-      # Run semantic release:
-      # - Update CHANGELOG.md
-      # - Update version in code
-      # - Create git tag
-      # - Create GitHub release
-      # - Publish to PyPI
-      - name: Python Semantic Release
+      # Do a dry run of PSR
+      - name: Test release
         uses: python-semantic-release/python-semantic-release@v9.16.1
+        if: github.ref_name != 'main'
+        with:
+          root_options: --noop
+
+      # On main branch: actual PSR + upload to PyPI & GitHub
+      - name: Release
+        uses: python-semantic-release/python-semantic-release@v9.16.1
+        id: release
+        if: github.ref_name == 'main'
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        if: steps.release.outputs.released == 'true'
+
+      - name: Publish package distributions to GitHub Releases
+        uses: python-semantic-release/upload-to-gh-release@main
+        if: steps.release.outputs.released == 'true'
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
 
@@ -136,6 +156,7 @@ jobs:
 
   build_wheels:
     needs: [release]
+    if: needs.release.outputs.released == 'true'
 
     name: Build wheels on ${{ matrix.os }} with arch ${{ matrix.arch }}
     runs-on: ${{ matrix.os }}
@@ -146,18 +167,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
+          ref: "v${{ needs.release.outputs.newest_release_tag }}"
           fetch-depth: 0
-          ref: "main"
-
       # Used to host cibuildwheel
       - name: Set up Python
         uses: actions/setup-python@v5
 
-      - uses: actions/checkout@v4
-        with:
-          ref: "v${{ needs.release.outputs.newest_release_tag }}"
-          fetch-depth: 0
-
       - name: Install cibuildwheel
         run: python -m pip install cibuildwheel==2.22.0