Update GHAs workflows

.github/actions/build-and-test/action.yaml

@@ -0,0 +1,27 @@
+name: build-and-test
+description: |
+  Set up Python and run the build and test steps.
+
+runs:
+  using: composite
+  steps:
+    - name: Set up Python
+      uses: ./.github/actions/setup-python
+    # TODO: move dependencies to a separate file (e.g. a requirements.txt file)
+    - name: Install dependencies
+      shell: bash
+      run: |
+        python -m pip install pytest build
+    - name: Run build
+      shell: bash
+      run: python -m build
+    - name: Show dist files
+      shell: bash
+      run: |
+        echo "Dist files:"
+        ls -lh dist/
+    - name: Run pytest
+      shell: bash
+      run: |
+        python -m pip install -e .
+        pytest

.github/actions/setup-python/action.yaml

@@ -0,0 +1,11 @@
+name: build-and-test
+description: |
+  This action lets the Python version for CI be specified in a single place.
+
+runs:
+  using: composite
+  steps:
+    - name: Set up Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: "3.12"

.github/workflows/merge.yaml

@@ -0,0 +1,20 @@
+# This workflow builds and tests code that is pushed to the `master` branch.
+
+name: merge
+
+on:
+  push:
+    branches:
+      - master
+
+jobs:
+  merge:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4
+        with:
+          fetch-tags: true
+          fetch-depth: 0
+      - name: Build and test
+        uses: ./.github/actions/build-and-test

.github/workflows/pr.yaml

@@ -0,0 +1,17 @@
+# This workflow builds and tests code in pull requests.
+
+name: pr
+
+on: pull_request
+
+jobs:
+  pr:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4
+        with:
+          fetch-tags: true
+          fetch-depth: 0
+      - name: Build and test
+        uses: ./.github/actions/build-and-test

.github/workflows/release.yaml

@@ -0,0 +1,48 @@
+# This workflow initiates a release of the project.
+
+name: release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Release version (e.g. `v0.4.5`)
+        type: string
+        required: true
+
+jobs:
+  release:
+    permissions:
+      # `contents: write` is required to create tags and create releases
+      # `id-token: write` is required for PyPI attestations
+      contents: write
+      id-token: write
+    runs-on: ubuntu-latest
+    env:
+      RELEASE_VERSION: ${{ inputs.version }}
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4
+        with:
+          fetch-tags: true
+          fetch-depth: 0
+      - name: Create local lightweight tag
+        run: git tag "${RELEASE_VERSION}"
+      - name: Build and test
+        uses: ./.github/actions/build-and-test
+      - name: Push tag
+        run: git push origin "${RELEASE_VERSION}"
+      - name: Create release from tag
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh api \
+            --method POST \
+            "/repos/${GITHUB_REPOSITORY}/releases" \
+            -f "tag_name=${RELEASE_VERSION}" \
+            -f "name=${RELEASE_VERSION}" \
+            -F "draft=false" \
+            -F "prerelease=false" \
+            -F "generate_release_notes=true"
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1