ci: add pypi publication

Add PyPI publishing job to semantic release workflow that:
- Triggers after successful test and release jobs on push events
- Uses official PyPI publishing action with proper permissions
- Downloads build artifacts and publishes to PyPI
- Provides configurable environment with PyPI project URL

Author: LittleCoinCoin

.github/workflows/semantic-release.yml

@@ -18,21 +18,25 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v5
         with:
-          python-version: '3.12'
+          python-version: "3.12"
 
       - name: Install Python dependencies
         run: |
           python -m pip install --upgrade pip
           pip install -e .
 
-      - name: Run tests
+      - name: Run import test
         run: |
           python -c "import hatch; print('Hatch package imports successfully')"
 
   release:
     needs: test
     runs-on: ubuntu-latest
     if: github.event_name == 'push'
+    outputs:
+      released: ${{ steps.release.outputs.released }}
+      version: ${{ steps.release.outputs.version }}
+      tag: ${{ steps.release.outputs.tag }}
     steps:
       - name: Generate GitHub App Token
         id: generate_token
@@ -61,4 +65,46 @@ jobs:
       - name: Release
         env:
           GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
-        run: npx semantic-release
+          GH_TOKEN: ${{ steps.generate_token.outputs.token }}
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          npx semantic-release
+
+      - name: Build Python Package
+        if: success()
+        run: |
+          python -m pip install build
+          python -m build
+
+      - name: Upload Build Artifacts
+        if: success()
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist-package
+          path: dist/
+          retention-days: 30
+
+  publish-pypi:
+    name: Publish to PyPI
+    runs-on: ubuntu-latest
+    needs: [test, release]
+    if: success() && github.event_name == 'push'
+    environment:
+      name: pypi
+      url: https://pypi.org/project/hatch-xclam/
+    permissions:
+      id-token: write
+
+    steps:
+      - name: Download Build Artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: dist-package
+          path: dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          print-hash: true
+          verbose: true