Refactor GitHub Actions workflow for PyPI publishing

Author: Pymmdrza

.github/workflows/publish-to-pypi.yml

@@ -31,12 +31,16 @@ jobs:
 
       - name: Run Bump script
         id: bump
+        shell: bash
         run: |
+          set -e
           NEW_VERSION=$(python bump_version.py libcrypto)
           echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT
 
       - name: Bump version (commit)
+        shell: bash
         run: |
+          set -e
           git config --global user.name 'github-actions'
           git config --global user.email '[email protected]'
           git add setup.py pyproject.toml src/libcrypto/__init__.py
@@ -69,10 +73,22 @@ jobs:
         run: |
           twine check dist/*
 
+      - name: Upload distributions
+        if: success()
+        uses: actions/upload-artifact@v4
+        with:
+          name: python-package-distributions
+          path: dist/
+
   publish-to-pypi:
-    name: Publish to PyPI
     needs: build
+    name: Publish to PyPI
     runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/libcrypto
+    permissions:
+      id-token: write
     steps:
       - name: Download distribution artifacts
         uses: actions/download-artifact@v4
@@ -88,16 +104,21 @@ jobs:
           verbose: true
 
   create-github-release:
-    name: Create GitHub Release
     needs: publish-to-pypi
+    name: Create GitHub Release
     runs-on: ubuntu-latest
-    if: github.event_name == 'workflow_dispatch'
+    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
     permissions:
       contents: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Derive version from tag (optional)
+        if: github.event_name == 'workflow_dispatch'
+        run: |
+          echo "NEW_VERSION=${{ needs.build.outputs.new_version }}" >> $GITHUB_ENV
+
       - name: Create GitHub Release
         id: create_release
         uses: softprops/action-gh-release@v2
@@ -128,7 +149,7 @@ jobs:
             ```bash
             pip3 install libcrypto
             # or 
-            pip3 install libcrypto==${{ needs.build.outputs.new_version }}
+            pip install libcrypto==${{ needs.build.outputs.new_version }}
             ```
 
             ##### upgrade : `pip3 install libcrypto --upgrade`