chore: bump some GHA deps (#103)

.github/workflows/ci.yml

@@ -43,6 +43,7 @@ jobs:
         os:
           - ubuntu-latest
           - macOS-latest
+          - windows-latest
         extension:
           - "skip_cython"
           - "use_cython"
@@ -120,32 +121,51 @@ jobs:
           run: poetry run pytest --no-cov -vvvvv --codspeed tests/benchmarks
 
   release:
-    runs-on: ubuntu-latest
-    environment: release
-    if: github.ref == 'refs/heads/main'
-    outputs:
-      newest_release_tag: ${{ steps.release_tag.outputs.newest_release_tag }}
     needs:
       - test
       - lint
       - commitlint
 
+    runs-on: ubuntu-latest
+    environment: release
+    concurrency: release
+    permissions:
+      id-token: write
+      contents: write
+    outputs:
+      released: ${{ steps.release.outputs.released }}
+      newest_release_tag: ${{ steps.release_tag.outputs.newest_release_tag }}
+
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          ref: ${{ github.head_ref || github.ref_name }}
 
-      # Run semantic release:
-      # - Update CHANGELOG.md
-      # - Update version in code
-      # - Create git tag
-      # - Create GitHub release
-      # - Publish to PyPI
-      - name: Python Semantic Release
-        uses: python-semantic-release/[email protected]
+      # Do a dry run of PSR
+      - name: Test release
+        uses: python-semantic-release/[email protected]
+        if: github.ref_name != 'main'
+        with:
+          root_options: --noop
+
+      # On main branch: actual PSR + upload to PyPI & GitHub
+      - name: Release
+        uses: bluetooth-devices/python-semantic-release@311
+        id: release
+        if: github.ref_name == 'main'
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        if: steps.release.outputs.released == 'true'
+
+      - name: Publish package distributions to GitHub Releases
+        uses: python-semantic-release/upload-to-gh-release@main
+        if: steps.release.outputs.released == 'true'
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
-          pypi_token: ${{ secrets.PYPI_TOKEN }}
 
       - name: Install python-semantic-release
         run: python3 -m pip install python-semantic-release==7.34.6
@@ -158,6 +178,7 @@ jobs:
 
   build_wheels:
     needs: [release]
+    if: needs.release.outputs.released == 'true'
 
     name: Build wheels on ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
@@ -174,6 +195,7 @@ jobs:
             musl: "musllinux"
           - os: macos-latest
             musl: "musllinux"
+
     steps:
       - uses: actions/checkout@v4
         with:
@@ -184,7 +206,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: "3.10"
+          python-version: "3.11"
 
       - name: Install cibuildwheel
         run: python -m pip install cibuildwheel==2.22.0
@@ -214,11 +236,11 @@ jobs:
         with:
           # unpacks default artifact into dist/
           # if `name: artifact` is omitted, the action will create extra parent dir
-          pattern: wheels-*
           path: dist
+          pattern: wheels-*
           merge-multiple: true
 
-      - uses: pypa/[email protected].3
+      - uses: pypa/[email protected].4
         with:
           user: __token__
           password: ${{ secrets.PYPI_TOKEN }}