ci(workflows): add PyPI publishing workflow with manual approval (#1428)

* ci(workflows): add PyPI publishing workflow with manual approval

Add publish-pypi-approval.yml workflow that triggers after successful builds on version tags. Includes manual approval gate, version validation, PyPI publishing via trusted publishing, draft GitHub release creation.

Author: Pouyanpi

.github/workflows/publish-pypi-approval.yml

@@ -0,0 +1,95 @@
+name: Publish to PyPI (with Approval)
+
+on:
+  workflow_run:
+    workflows: ["Build and Test Distribution"]
+    types:
+      - completed
+
+jobs:
+  publish-pypi:
+    if: github.event.workflow_run.conclusion == 'success' && startsWith(github.event.workflow_run.head_branch, 'v')
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi-production
+      url: https://pypi.org/project/nemoguardrails/
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Extract version from tag
+        id: version
+        run: |
+          TAG_NAME="${{ github.event.workflow_run.head_branch }}"
+          VERSION="${TAG_NAME#v}"
+          echo "version=${VERSION}" >> $GITHUB_OUTPUT
+          echo "tag=${TAG_NAME}" >> $GITHUB_OUTPUT
+          echo "artifact_name=${TAG_NAME}-build" >> $GITHUB_OUTPUT
+
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ steps.version.outputs.tag }}
+          sparse-checkout: |
+            pyproject.toml
+            CHANGELOG.md
+
+      - name: Validate version matches tag
+        run: |
+          VERSION_IN_FILE=$(grep '^version = ' pyproject.toml | sed 's/version = "\(.*\)"/\1/')
+          TAG_VERSION="${{ steps.version.outputs.version }}"
+          if [ "$VERSION_IN_FILE" != "$TAG_VERSION" ]; then
+            echo "❌ Version mismatch: pyproject.toml=$VERSION_IN_FILE, tag=$TAG_VERSION"
+            exit 1
+          fi
+          echo "✅ Version validated: $VERSION_IN_FILE matches tag $TAG_VERSION"
+
+      - name: Download artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: ${{ steps.version.outputs.artifact_name }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          repository: ${{ github.repository }}
+          run-id: ${{ github.event.workflow_run.id }}
+
+      - name: List files
+        run: ls -la
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          verbose: true
+          packages-dir: ./
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          TAG_NAME="${{ steps.version.outputs.tag }}"
+
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+
+          CHANGELOG_SECTION=$(awk -v version="${{ steps.version.outputs.version }}" '
+            /^## \[/ {
+              if (found) exit
+              if ($0 ~ "\\[" version "\\]") {
+                found=1
+                next
+              }
+            }
+            found && /^## \[/ { exit }
+            found { print }
+          ' CHANGELOG.md || echo "No changelog entry found for this version.")
+
+          echo "$CHANGELOG_SECTION" > release_notes.md
+
+          gh release create "$TAG_NAME" \
+            --draft \
+            --title "$TAG_NAME" \
+            --notes-file release_notes.md \
+            --repo ${{ github.repository }} \
+            || echo "Release already exists or failed to create"
+
+          rm -f release_notes.md