ci: use a separate job for release

.github/workflows/build.yml

@@ -5,29 +5,18 @@ on: push
 jobs:
   build:
     runs-on: ubuntu-latest
-    # environment: release
-    # permissions:
-    #   contents: write
-    #   id-token: write
     steps:
       - uses: actions/checkout@v4
-      - uses: pdm-project/setup-pdm@v3
+      - uses: pdm-project/setup-pdm@v4
+        with:
+          cache: true
       - name: Build
         run: pdm build
       - uses: actions/upload-artifact@v4
         with:
           name: dist
           path: dist/*
           if-no-files-found: error
-      # - name: Release
-      #   uses: softprops/action-gh-release@v2
-      #   if: startswith(github.ref, 'refs/tags/v')
-      #   with:
-      #     files: dist/*
-      #     generate_release_notes: true
-      - name: Publish to PyPI
-        if: startswith(github.ref, 'refs/tags/v')
-        run: pdm publish --no-build
   pyinstaller:
     runs-on: ${{ matrix.os }}
     strategy:
@@ -58,3 +47,24 @@ jobs:
           name: dist-${{ matrix.os }}
           path: dist/*
           if-no-files-found: error
+  release:
+    runs-on: ubuntu-latest
+    environment: release
+    needs: [build, pyinstaller]
+    permissions:
+      contents: write
+      id-token: write
+    if: startswith(github.ref, 'refs/tags/v')
+    steps:
+      - uses: pdm-project/setup-pdm@v4
+      - uses: actions/download-artifact@v4
+      - name: Release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: dist*/*
+          generate_release_notes: true
+          draft: ${{ contains(github.ref, 'draft') }}
+          prerelease: ${{ contains(github.ref, 'prerelease') }}
+      - name: Publish to PyPI
+        if: ${{ ! (contains(github.ref, 'draft') || contains(github.ref, 'prerelease')) }}
+        run: pdm publish --no-build