Automate publishing of Python and NPM packages

.github/workflows/ci.yml

@@ -80,3 +80,55 @@ jobs:
         uses: codecov/codecov-action@v3
         with:
           directory: reports/
+
+
+  publish:
+    name: Publish package to PyPI
+    runs-on: ubuntu-latest
+    needs:
+      - tests
+      - e2e_tests
+
+    if: github.repository == 'django-commons/django-cookie-consent' && github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
+
+    environment:
+      name: release
+      url: https://pypi.org/project/django-cookie-consent/
+    permissions:
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: 'js/.nvmrc'
+          cache: npm
+          registry-url: 'https://registry.npmjs.org'
+
+      # Required to ensure the build artifacts are in the packages.
+      - uses: ./.github/actions/build-js
+        with:
+          npm-package: 'true'
+          django-staticfiles: 'true'
+
+      - name: Build sdist and wheel
+        run: |
+          pip install build --upgrade
+          python -m build
+
+      # TODO: enable verified publishing!
+      - name: Publish a Python distribution to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+      - name: Publish NPM package to Github
+        run: |
+          # Strip git ref prefix from version
+          version=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
+
+          npm publish --new-version="$version" --provenance
+        working-directory: js
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}