Improve release workflow

- Trigger on release, rather than tag push
- Also support test runs
- Only ever upload package candidates

.github/workflows/hackage.yml

@@ -1,9 +1,13 @@
-name: hackage
+name: "Release"
 
 on:
   push:
-    tags:
-      - "wai-saml2-*"
+    paths:
+      - ".github/workflows/hackage.yml"
+  release:
+    types:
+      - released
+      - prereleased
 
 jobs:
   publish-to-hackage:
@@ -22,12 +26,16 @@ jobs:
 
       - name: Configure stack
         run: |
+          echo ${{ github.event.action }}
           mkdir -p ${{ steps.install-haskell.outputs.stack-root }}
           echo "save-hackage-creds: false" >> ${{ steps.install-haskell.outputs.stack-root }}/config.yaml
 
+      - name: Check source distribution
+        run: stack sdist .
+
       - name: Publish `wai-saml2`
-        if: startsWith(github.ref, 'refs/tags/wai-saml2-')
-        run: stack upload .
+        if: startsWith(github.ref, 'refs/tags/wai-saml2-') && github.event.action == 'released'
+        run: stack upload . --candidate
         env:
           HACKAGE_USERNAME: ${{ secrets.HACKAGE_USER }}
           HACKAGE_PASSWORD: ${{ secrets.HACKAGE_PASSWORD }}