CI: Run twine check, add publish step

Author: effigies

.github/workflows/wheels.yml

@@ -84,7 +84,29 @@ jobs:
       - uses: actions/download-artifact@v3
         with:
           path: dist/
-      - run: ls -lR
-      - run: mv dist/*/*.{tar.gz,whl} dist
-      - run: rmdir dist/*/
-      - run: ls -lR
+      - name: Check artifacts
+        run: ls -lR
+      - name: Consolidate and re-check
+        run: |
+          mv dist/*/*.{tar.gz,whl} dist
+          rmdir dist/*/
+          ls -lR
+      - run: pipx run twine dist/*
+
+  publish:
+    runs-on: ubuntu-latest
+    environment: "Package deployment"
+    needs: [pre-publish]
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
+    steps:
+      - uses: actions/download-artifact@v3
+        with:
+          path: dist/
+      - name: Consolidate artifacts
+        run: |
+          mv dist/*/*.{tar.gz,whl} dist
+          rmdir dist/*/
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          user: __token__
+          password: ${{ secrets.PYPI_API_TOKEN }}