Extend CI workflow to include PyPI dist publishing

[Zymrael]

Minor PR, title says it all.

Publishing is triggered only by release events. To work, the addition requires setup of a PyPI password in repo secrets.

Addresses this.

[google-cla[bot]]

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

:memo: Please visit https://cla.developers.google.com/ to sign.

Once you've signed (or fixed any issues), please reply here with @googlebot I signed it! and we'll verify it.

---

What to do if you already signed the CLA

Individual signers

• It's possible we don't have your GitHub username or you're using a different email address on your commit. Check your existing CLA data and verify that your email is set on your git commits.

Corporate signers

• Your company has a Point of Contact who decides which employees are authorized to participate. Ask your POC to be added to the group of authorized contributors. If you don't know who your Point of Contact is, direct the Google project maintainer to go/cla#troubleshoot (Public version).
• The email used to register you as an authorized contributor must be the email used for the Git commit. Check your existing CLA data and verify that your email is set on your git commits.
• The email used to register you as an authorized contributor must also be attached to your GitHub account.

ℹ️ Googlers: Go here for more info.

[Zymrael]

@googlebot I signed it!

[patrick-kidger]

So I note that this will trigger on quite a lot of things, including a cron schedule. It would be preferred to have it trigger only when we merge a pull request into master; moreover it'd need to check that the version number has been incremented, to prevent PyPI failures.

That said, I'd be keen to have this happen, as it's realistic that waiting for me or @lxuechen to push a button will be a bottleneck in the process... :D If you can rewrite it as above I'd be happy to have this in.

[Zymrael]

It sure will trigger the entire workflow but it will skip the publishing step. That last step (atm) is only triggered via release events. There seems to be a check for version increases in the current workflow put into place by @lxuechen.

Of course if you'd prefer we can split the current workflow into two. Remove the current release check, and instead have a secondary publishing workflow that only triggers on PR merges if the existing version check passes.

Should be quick but since there are roughly infinity ways of doing this I'll await for you to state your preference first :)

[patrick-kidger]

Ah yes, I see the if statement now. I think the if statement will never trigger though, because the on: section above doesn't include release events?

So I think creating a separate workflow that does this, and triggers on release events, would probably be smoothest?

Pinging @lxuechen as the only one who can actually add the necessary secret (the PyPI key) for this.

[lxuechen]

Ah yes, I see the if statement now. I think the if statement will never trigger though, because the on: section above doesn't include release events?

So I think creating a separate workflow that does this, and triggers on release events, would probably be smoothest?

Pinging @lxuechen as the only one who can actually add the necessary secret (the PyPI key) for this.

I agree with Patrick here. What's more, it seems this publishing step will be ran more than once due to the multiple run environments constructed by the build matrix. Splitting the publishing step to a separate workflow is a good idea. Enforcing dependencies among workflows is a little tricky, but can be done with workflow_run.

I have created the necessary secret based on an API token, but might need Patrick to add me to the project on PyPI.

[patrick-kidger]

Right, I think I've done everything that should be necessary to get this working. I've opened three small PRs (#102,#103,#104) to add all the necessary functionality, in place of this one.

[Zymrael]

I will be closing this PR then.