ci: update release process

Author: vincentsarago

.github/workflows/ci.yml

@@ -58,12 +58,11 @@ jobs:
         uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
           version: "0.9.*" 
-          enable-cache: true
           python-version: ${{ env.LATEST_PY_VERSION }}
 
       - name: Install dependencies
         run: |
-          uv sync --group benchmark
+          uv sync --group benchmark --frozen
 
       - name: Run Benchmark
         run: |
@@ -84,41 +83,3 @@ jobs:
           # Make a commit on `gh-pages` only if main
           auto-push: ${{ github.ref == 'refs/heads/main' }}
           benchmark-data-dir-path: dev/benchmarks
-
-  publish:
-    needs: [tests]
-    runs-on: ubuntu-latest
-    if: startsWith(github.event.ref, 'refs/tags') || github.event_name == 'release'
-    steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-      
-      - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
-        with:
-          version: "0.9.*" 
-          enable-cache: true
-          python-version: ${{ env.LATEST_PY_VERSION }}
-
-      - name: Install dependencies
-        run: |
-          uv sync --group deploy
-
-      - name: Set tag version
-        id: tag
-        run: |
-          echo "version=${GITHUB_REF#refs/*/}"
-          echo "version=${GITHUB_REF#refs/*/}" >> $GITHUB_OUTPUT
-
-      - name: Set module version
-        id: module
-        run: |
-          echo "version=$(uv run hatch --quiet version)" >> $GITHUB_OUTPUT
-
-      - name: Build and publish
-        if: ${{ steps.tag.outputs.version }} == ${{ steps.module.outputs.version}}
-        env:
-          HATCH_INDEX_USER: ${{ secrets.PYPI_USERNAME }}
-          HATCH_INDEX_AUTH: ${{ secrets.PYPI_PASSWORD }}
-        run: |
-          uv run hatch build 
-          uv run hatch publish

.github/workflows/release.yml

@@ -0,0 +1,73 @@
+name: Release
+
+on:
+  push:
+    tags:
+    - '*'
+env:
+  LATEST_PY_VERSION: '3.14'
+
+jobs:
+  build:
+    name: Build dist
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          version: "0.9.*" 
+          enable-cache: true
+          python-version: ${{ env.LATEST_PY_VERSION }}
+
+      - name: Install dependencies
+        run: |
+          uv sync --group deploy
+
+      - name: Set tag version
+        id: tag
+        run: |
+          echo "version=${GITHUB_REF#refs/*/}"
+          echo "version=${GITHUB_REF#refs/*/}" >> $GITHUB_OUTPUT
+
+      - name: Set module version
+        id: module
+        run: |
+          echo "version=$(uv run hatch --quiet version)" >> $GITHUB_OUTPUT
+
+      - name: Check version match
+        run: |
+          if [ "${{ steps.tag.outputs.version }}" != "${{ steps.module.outputs.version }}" ]; then
+            echo "Tag version (${{ steps.tag.outputs.version }}) does not match module version (${{ steps.module.outputs.version }})"
+            exit 1
+          fi
+
+      - name: Build
+        run: |
+          uv run hatch build
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          path: ./dist/
+
+  upload_pypi:
+    name: Upload release to PyPI
+    needs: [build]
+    runs-on: ubuntu-latest
+    environment:
+      # Note: this environment must be configured in the repo settings
+      name: pypi-release
+      url: https://pypi.org/p/morecantile
+    permissions:
+      id-token: write # IMPORTANT: this permission is mandatory for trusted publishing
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: artifact
+          path: dist
+          merge-multiple: true
+
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1