ci: add pypi release ci script

.github/workflows/ci_publish.yml

@@ -0,0 +1,59 @@
+name: CI Publish
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  build:
+    name: Build dist
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Install extra dependencies for a python install
+        run: |
+          sudo apt-get update
+          sudo apt -y install --no-install-recommends liblzma-dev libbz2-dev libreadline-dev
+
+      - name: Install asdf cli
+        uses: asdf-vm/actions/setup@b7bcd026f18772e44fe1026d729e1611cc435d47  # v4.0.1
+
+      - name: Install software through asdf
+        uses: asdf-vm/actions/install@b7bcd026f18772e44fe1026d729e1611cc435d47  # v4.0.1
+
+      - name: reshim asdf
+        run: asdf reshim
+
+      - name: ensure poetry using desired python version
+        run: poetry env use $(asdf which python)
+
+      - name: build wheels
+        run: make dist
+
+      - name: store wheels
+        uses: actions/upload-artifact@v5
+        with:
+          name: dve-wheels
+          path: dist/
+
+  publish-to-pypi:
+    name: Publish to PyPi
+    if: startsWith(github.ref, 'refs/tags/')
+    needs:
+      - build
+    runs-on: ubuntu-24.04
+    environment:
+      name: pypi
+      url: https://pypi.org/org/nhs/data-validation-engine
+    permissions:
+      id_token: write   # IMPORTANT: mandatory for trusted publishing
+    steps:
+      - name: download dist
+        uses: actions/download-artifact@v6
+        with:
+          name: dve-wheels
+          path: dist/
+
+      - name: publish
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e  # v1.13.0