Trigger on release create, also upload release to github

.github/workflows/build_deploy.yml

@@ -1,12 +1,12 @@
 ---
-name: Build if new version and upload if release
+name: Build and upload
 
 on:  # yamllint disable-line rule:truthy
   push:
     paths-ignore:
       - 'README.md'
   release:
-    types: [published]
+    types: [created]
 
 jobs:
   build_wheels:
@@ -16,9 +16,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
 
-    if: |
-      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v'))
-      || github.event_name == 'release' && github.event.action == 'published'
+    if: github.event_name == 'release' && github.event.action == 'created'
     steps:
       - uses: actions/checkout@v4
 
@@ -34,14 +32,6 @@ jobs:
             && rmdir ugrapheme /s /q
             && pytest
 
-        # env:
-        #   CIBW_SOME_OPTION: value
-        #    ...
-        # with:
-        #   package-dir: .
-        #   output-dir: wheelhouse
-        #   config-file: "{package}/pyproject.toml"
-
       - uses: actions/upload-artifact@v4
         with:
           name: cibw-wheels-${{ matrix.os }}-${{ strategy.job-index }}
@@ -50,9 +40,7 @@ jobs:
   build_sdist:
     name: Build source distribution
     runs-on: ubuntu-latest
-    if: |
-      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v'))
-      || github.event_name == 'release' && github.event.action == 'published'
+    if: github.event_name == 'release' && github.event.action == 'created'
     steps:
       - uses: actions/checkout@v4
 
@@ -70,11 +58,11 @@ jobs:
   upload_pypi:
     needs: [build_wheels, build_sdist]
     runs-on: ubuntu-latest
-    environment: pypi
+    environment: production
     permissions:
       id-token: write
     if: |
-      github.event_name == 'release' && github.event.action == 'published'
+      github.event_name == 'release' && github.event.action == 'created'
       && !endsWith(github.ref, '-test')
     steps:
       - uses: actions/download-artifact@v4
@@ -89,11 +77,11 @@ jobs:
   upload_pypi_test:
     needs: [build_wheels, build_sdist]
     runs-on: ubuntu-latest
-    environment: pypi
+    environment: production
     permissions:
       id-token: write
     if: |
-      github.event_name == 'release' && github.event.action == 'published'
+      github.event_name == 'release' && github.event.action == 'created'
       && endsWith(github.ref, '-test')
     steps:
       - uses: actions/download-artifact@v4
@@ -106,3 +94,29 @@ jobs:
       - uses: pypa/gh-action-pypi-publish@release/v1
         with:
           repository-url: https://test.pypi.org/legacy/
+
+  upload_gh_release:
+    needs: [build_wheels, build_sdist]
+    runs-on: ubuntu-latest
+    environment: production
+    permissions:
+      contents: write
+      id-token: write
+
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          # unpacks all CIBW artifacts into dist/
+          pattern: cibw-*
+          path: dist
+          merge-multiple: true
+
+      - uses: sigstore/gh-action-sigstore-python@v2.1.1
+        with:
+          inputs: >-
+            ./dist/*.tar.gz
+            ./dist/*.whl
+
+      - uses: softprops/action-gh-release@v2
+        with:
+          files: dist/**