Separate package build and publish

[jongan69]

Summary

• run package build validation on main, dev, and pull requests
• move PyPI publication into a separate manual, environment-gated workflow
• retain read-only permissions, immutable action SHAs, and non-persistent checkout credentials

Verification

• both workflow files parse as YAML
• the prior main run built version 0.2.2 successfully and failed only because PyPI correctly rejected the existing file
• no new distribution was published

Closes #5

[coderabbitai]

Important

Review available on request

• 🔍 Trigger review

Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment @coderabbitai review to review the latest changes. For a full review, comment @coderabbitai full review.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 6cbabc2f-ce67-46e5-8dc1-15d7dc7e7a0f

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[jongan69]

Manual review completed: ordinary pushes and pull requests only build and install the wheel; PyPI publication is isolated to a manual workflow behind the pypi environment. Both workflows are read-only and SHA-pinned. YAML parsing, hosted package builds, CodeQL, and GitGuardian passed. The earlier run attempted only the already-published 0.2.2 files and PyPI rejected them; no new distribution was published.