Update release action

.github/workflows/release.yaml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       new_version:
-        description: 'New version, for example: 1.1.0'
+        description: "New version, for example: 1.1.0"
         required: true
       is_rerun:
         type: boolean
@@ -18,6 +18,8 @@ jobs:
   release:
     name: Release BridgeStan
     runs-on: ubuntu-latest
+    outputs:
+      sha: ${{ steps.commit.outputs.sha }}
 
     steps:
       - name: Check out github
@@ -33,12 +35,6 @@ jobs:
       - name: Set up Julia
         uses: julia-actions/setup-julia@v2
 
-      - name: Install LLVM and Clang
-        uses: KyleMayes/install-llvm-action@v2
-        with:
-          version: "15.0"
-          directory: ${{ runner.temp }}/llvm
-
       - name: Update version numbers
         if: ${{ !inputs.is_rerun }}
         run: |
@@ -97,16 +93,31 @@ jobs:
           replacesArtifacts: true
           skipIfReleaseExists: true
 
-      - name: Upload PyPI wheels
-        if: ${{ !inputs.dry_run }}
+  publish:
+    name: Publish BridgeStan
+    if: ${{ !inputs.dry_run }}
+    runs-on: ubuntu-latest
+    needs: release
+    environment: publishing
+    permissions:
+      id-token: write
+
+    steps:
+      - name: Check out github
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Download release artifacts
+        uses: actions/download-artifact@v4
+
+      - name: Publish on PyPI
         uses: pypa/gh-action-pypi-publish@v1.12.2
         with:
-          password: ${{ secrets.PYPI_TOKEN }}
-          packages_dir: python/dist/
-          skip_existing: true
+          packages-dir: python/dist/
+          skip-existing: true
 
-      - name: Publish Rust crate
-        if: ${{ !inputs.dry_run }}
+      - name: Publish on crates.io
         run: |
           cd rust/
           cargo publish --token ${CRATES_TOKEN}
@@ -120,7 +131,7 @@ jobs:
         if: ${{ !inputs.dry_run }}
         uses: peter-evans/commit-comment@v3
         with:
-          sha: ${{ steps.commit.outputs.sha }}
+          sha: ${{ needs.release.outputs.sha }}
           body: |
             @JuliaRegistrator register subdir=julia