Add build and publish steps to build.yml

.github/workflows/build.yml

@@ -1,20 +1,25 @@
-name: Python package
+name: Python Test | Build | Deploy
 
-on: [ push ]
+on:
+  push:
+  pull_request:
+  release:
+    types: [published]
 
 permissions:
   contents: read
 
 jobs:
-  build:
-
+  test:
+    name: Run Tests
     runs-on: ubuntu-latest
     strategy:
       matrix:
         python-version: [ '3.9', '3.10', '3.11', '3.12', '3.13' ]
-
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5
         with:
@@ -26,3 +31,52 @@ jobs:
       - name: Test with pytest
         run: |
           pytest
+
+  build:
+    name: Build Python Package
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: Install build dependencies
+        run: |
+          pip install build twine
+      - name: Build Package
+        run: |
+          python -m build
+      - name: Check Package
+        run: |
+          twine check --strict dist/*
+      - name: Save Artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-artifacts
+          path: dist/
+          if-no-files-found: error
+
+  publish:
+    name: Publish to PyPi
+    runs-on: ubuntu-latest
+
+    needs: build
+    environment: publish
+    permissions:
+      id-token: write
+
+#    if: github.event.release && github.event.action == 'published'
+    steps:
+      - name: Dowload Artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: dist/
+          merge-multiple: true
+      - name: Publish to PyPi
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+