Add automated release process

.github/workflows/main.yml

@@ -4,6 +4,8 @@ on:
   push:
     branches:
     - main
+    tags:
+    - '**'
   pull_request:
 
 concurrency:
@@ -91,3 +93,26 @@ jobs:
         with:
           name: html-report
           path: htmlcov
+
+  release:
+    needs: [coverage]
+    if: success() && startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-24.04
+    environment: release
+
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: astral-sh/setup-uv@v3
+
+      - name: Build
+        run: uv build
+
+      - name: Verify
+        run: uvx twine check dist/*
+
+      - uses: pypa/gh-action-pypi-publish@release/v1