release following push to main (#461)

.github/workflows/ci.yml

@@ -1,4 +1,4 @@
-name: "ci"
+name: "CI"
 
 on:
 - push

.github/workflows/release.yml

@@ -1,38 +1,48 @@
-name: Upload Python Package
+name: Bump version and publish
 
 on:
-  release:
-    types: [published]
+  workflow_run:
+    workflows: [ "CI" ]
+    types: [ completed ]
 
 jobs:
-  build:
+  tag:
+    permissions:
+      contents: write
+
+    if: >
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.head_branch == 'main'
+
     runs-on: ubuntu-latest
+
     steps:
       - name: Checkout [${{ github.repository }}]
         uses: actions/checkout@v4
 
-      - uses: cvxgrp/.github/actions/uv/[email protected]
+      - name: Generate Tag
+        uses: cvxgrp/.github/actions/uv/[email protected]
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
 
-  deploy:
+  publish:
+    needs: tag
     runs-on: ubuntu-latest
-    needs: build
     environment: release
 
     permissions:
+      contents: read
       # This permission is required for trusted publishing.
       id-token: write
 
     steps:
       - name: Checkout [${{ github.repository }}]
         uses: actions/checkout@v4
 
-      # download dist from build
       - uses: actions/download-artifact@v4
         with:
           name: dist
           path: dist
 
       - name: Publish package distributions to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          repository-url: https://upload.pypi.org/legacy/