chore(cicd): add tests by os #15

	name: Release

	on:
	push:
	tags:
	- '*'

	jobs:
	release:
	runs-on: ubuntu-latest
	permissions:
	# IMPORTANT: this permission is mandatory for trusted publishing
	id-token: write
	steps:
	- uses: actions/checkout@v4
	with:
	fetch-depth: 10
	- name: Set up Python
	uses: actions/setup-python@v4
	with:
	python-version: '3.12'
	- name: Extract version from tag
	run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
	- name: Install uv
	uses: astral-sh/setup-uv@v2
	- name: Use uv with Python version
	run: uv venv --python 3.12
	- run: make install
	- run: make build
	- run: make test
	- name: mint API token
	id: mint-token
	run: \|
	# retrieve the ambient OIDC token
	resp=$(curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
	"$ACTIONS_ID_TOKEN_REQUEST_URL&audience=pypi")
	oidc_token=$(jq -r '.value' <<< "${resp}")

	# exchange the OIDC token for an API token
	resp=$(curl -X POST https://pypi.org/_/oidc/mint-token -d "{\"token\": \"${oidc_token}\"}")
	api_token=$(jq -r '.token' <<< "${resp}")

	# mask the newly minted API token, so that we don't accidentally leak it
	echo "::add-mask::${api_token}"

	# see the next step in the workflow for an example of using this step output
	echo "api-token=${api_token}" >> "${GITHUB_OUTPUT}"
	- name: publish
	# gh-action-pypi-publish uses TWINE_PASSWORD automatically
	uses: pypa/gh-action-pypi-publish@release/v1
	with:
	password: ${{ steps.mint-token.outputs.api-token }}

Provide feedback