chore(ci): Upload attested package to (test)PyPI

Author: effigies

.github/workflows/test.yml

@@ -9,6 +9,8 @@ on:
     branches:
       - master
       - maint/*
+    tags:
+      - '*'
   pull_request: {}
   schedule:
     # 8am EST / 9am EDT Mondays
@@ -112,3 +114,44 @@ jobs:
         with:
           files: cov.xml
           token: ${{ secrets.CODECOV_TOKEN }}
+
+  test-publish:
+    name: Push package to test.pypi.org
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    needs: [build]
+    permissions:
+      attestations: write
+      id-token: write
+
+    steps:
+      - name: Download packages built by build-and-inspect-python-package
+        uses: actions/download-artifact@v4
+        with:
+          name: Packages
+          path: dist
+
+      - name: Upload package to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          skip-existing: true
+
+  publish:
+    name: Publish released package to pypi.org
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
+    runs-on: ubuntu-latest
+    needs: [test, test-publish]
+    permissions:
+      attestations: write
+      id-token: write
+
+    steps:
+      - name: Download packages built by build-and-inspect-python-package
+        uses: actions/download-artifact@v4
+        with:
+          name: Packages
+          path: dist
+
+      - name: Upload package to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1