ci: add publish step

.github/workflows/ci.yaml

@@ -11,8 +11,41 @@ jobs:
     uses: ./.github/workflows/test.yaml
   tag:
     name: Tag
+    timeout-minutes: 2
     needs: test
     permissions:
       contents: write
-    uses: ./.github/workflows/tag.yaml
-  # TODO: Publish to Pypi.
+    outputs:
+      new-version: ${{ steps.bump-version.outputs.new_version }}
+    steps:
+      - name: Check out
+        uses: actions/checkout@v4
+      - name: Bump version and create tag
+        id: bump-version
+        uses: mathieudutour/[email protected]
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+  publish:
+    name: Publish package to PyPI
+    timeout-minutes: 3
+    runs-on: ubuntu-latest
+    needs: tag
+    if: needs.tag.outputs.new-version != ''
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Check out
+        uses: actions/checkout@v4
+      - name: Set up
+        uses: ./.github/actions/setup
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Set version
+        run: |
+          poetry version "${{ needs.tag.outputs.new-version }}"
+      - name: Publish
+        run: |
+          poetry publish --build
+        env:
+          POETRY_PYPI_TOKEN_PYPI: ${{ secrets.PYPI_TOKEN }}