Add build and publish-pypi jobs

.github/workflows/ci.yml

@@ -3,6 +3,7 @@ name: Run CI
 on:
   push:
     branches: main
+    tags: v*
 
 permissions:
   contents: read
@@ -11,14 +12,40 @@ concurrency:
   group: ci
   cancel-in-progress: false
 
+env:
+  PYPI_PACKAGE: hexdoc
+
 jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v4
+        with:
+          python-version: '3.11'
+
+      - name: Install dependencies
+        run: pip install . build
+
+      - name: Build package
+        run: python -m build
+
+      - name: Upload package artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: python-build
+          path: dist
+
   test:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
         with:
           submodules: true
-
       - uses: actions/setup-python@v4
         with:
           python-version: '3.11'
@@ -33,3 +60,31 @@ jobs:
 
       - name: Run Nox
         run: nox
+
+  publish-pypi:
+    runs-on: ubuntu-latest
+    needs: [build, test]
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
+
+    environment:
+      name: pypi
+      url: https://pypi.org/p/${{ env.PYPI_PACKAGE }}
+
+    permissions:
+      id-token: write
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Update release tags
+        uses: rickstaa/action-update-semver@v1
+
+      - name: Download package artifact
+        uses: actions/download-artifact@v3
+        with:
+          name: python-build
+          path: dist
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1