Separate package build and publish

.github/workflows/deploy.yml

@@ -1,21 +1,20 @@
-name: Publish Python 🐍 distribution 📦 to PyPI
+name: Python package CI
 
 on:
   push:
-    branches: [main]
-  workflow_dispatch:
+    branches: [main, dev]
+  pull_request:
+    branches: [main, dev]
 
 permissions:
-  id-token: write
   contents: read
 
 env:
   PYTHON_VERSION: '3.x'
 
 jobs:
-  build-and-publish:
+  build:
     runs-on: ubuntu-latest
-    environment: pypi
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
@@ -25,6 +24,4 @@ jobs:
           python-version: ${{ env.PYTHON_VERSION }}
       - run: pip install build
       - run: python -m build
-      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
-        with:
-          password: ${{ secrets.PYPI_API_KEY }}
+      - run: python -m pip install dist/*.whl

.github/workflows/publish.yml

@@ -0,0 +1,27 @@
+name: Publish Python distribution to PyPI
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  PYTHON_VERSION: '3.x'
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment: pypi
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+      - run: pip install build
+      - run: python -m build
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
+        with:
+          password: ${{ secrets.PYPI_API_KEY }}