ci: 加并发取消与构建 job，新增 tag 触发的 PyPI 发布工作流（Trusted Publishing）

.github/workflows/ci.yml

@@ -6,6 +6,10 @@ on:
   pull_request:
   workflow_dispatch:
 
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   lint:
     name: ruff + pyright + pytest
@@ -37,3 +41,24 @@ jobs:
 
       - name: pytest 单元测试
         run: uv run pytest
+
+  build:
+    name: 构建发行包
+    runs-on: ubuntu-latest
+    steps:
+      - name: 检出代码
+        uses: actions/checkout@v4
+
+      - name: 安装 uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+
+      - name: 构建 sdist 与 wheel
+        run: uv build
+
+      - name: 上传构建产物
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/

.github/workflows/publish.yml

@@ -0,0 +1,31 @@
+name: 发布到 PyPI
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  publish:
+    name: 构建并发布
+    runs-on: ubuntu-latest
+    permissions:
+      # Trusted Publishing（OIDC）需要显式声明 id-token 写权限
+      id-token: write
+    steps:
+      - name: 检出代码
+        uses: actions/checkout@v4
+
+      - name: 安装 uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+
+      - name: 构建 sdist 与 wheel
+        run: uv build
+
+      # 走 Trusted Publishing：无 token，发布身份由 GitHub OIDC 签发。
+      # 前置条件（一次性）：pypi.org → qqbotsdk-py → Publishing →
+      # Add pending publisher（owner: snowy-yang，repo: qqbotsdk，
+      # workflow: publish.yml）
+      - name: 发布
+        run: uv publish