ci: use github token with release-please

.github/workflows/deployment.yml

@@ -1,32 +1,64 @@
-name: Publish Python 🐍 distribution 📦 to PyPI
+name: Release
 
-on: push
+on:
+  push:
+    branches:
+      - main
+  # Re-publish an existing tag after a failed publish. Run from main (pypi env).
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing release tag to publish (e.g. v0.1.0)
+        required: true
+
+# Don't cancel: a queued run may be waiting on pypi approval.
+concurrency:
+  group: release
+  cancel-in-progress: false
 
 permissions:
   contents: read
 
 jobs:
+  # Tags created with GITHUB_TOKEN trigger no workflows, so publish happens here.
+  release-please:
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
+    steps:
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
+        id: release
+        with:
+          release-type: simple
+
   build:
     name: Build distribution 📦
+    needs: release-please
     runs-on: ubuntu-latest
-    if: startsWith(github.ref, 'refs/tags/')  # only publish to PyPI on tag pushes
+    if: >-
+      !cancelled() && (
+        needs.release-please.outputs.release_created == 'true' ||
+        github.event_name == 'workflow_dispatch'
+      )
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
+        # hatch-vcs needs the tag to compute the version.
+        ref: ${{ inputs.tag || needs.release-please.outputs.tag_name }}
         persist-credentials: false
     - name: Set up Python
       uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
       with:
         python-version: "3.15"
     - name: Installing dependencies
       run: |
-          python -m pip install \
-              build \
-              python-dateutil \
-              pytz \
-              readme_renderer[md] \
-              requests \
-              setuptools_scm
+          python -m pip install build "readme_renderer[md]"
     - name: Validate README for PyPI
       run: |
         python -m readme_renderer README.md -o /tmp/README.html
@@ -41,12 +73,14 @@ jobs:
   publish:
     name: Publish distribution 📦 to PyPI
     needs: build
+    # A skipped release-please upstream would otherwise skip this job too.
+    if: ${{ !cancelled() && needs.build.result == 'success' }}
     runs-on: ubuntu-latest
     environment:
       name: pypi
       url: https://pypi.org/p/intercede
     permissions:
-      id-token: write  # IMPORTANT: mandatory for trusted publishing
+      id-token: write  # trusted publishing
     steps:
     - name: Download the distribution packages
       uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2