switch to 2-stage publish workflow

Author: chris48s

.github/workflows/publish.yml

@@ -5,9 +5,6 @@ jobs:
   build:
     runs-on: ubuntu-latest
     if: github.event.ref_type == 'tag'
-    permissions:
-      id-token: write  # required for trusted publishing
-    environment: publish
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -22,7 +19,24 @@ jobs:
           python-version: '${{ steps.python-versions.outputs.min }}'
           pre-install: poetry
 
+      - uses: actions/upload-artifact@v4
+        with:
+          path: ./dist
+
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    if: github.event.ref_type == 'tag'
+    permissions:
+      contents: none
+      id-token: write # required for trusted publishing
+    environment: publish
+    steps:
+      - uses: actions/download-artifact@v4
+
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
+          packages-dir: artifact/
           print-hash: true