Add release workflow (#3)

This is based on the revised workflow at
Qiskit/qiskit-addon-utils#212.

Author: garrison

.github/workflows/release.yml

@@ -0,0 +1,82 @@
+name: Build and publish
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - "[0-9]+.[0-9]+.[0-9]+"
+    branches:
+      - main
+      - 'stable/**'
+
+jobs:
+
+  build_sdist:
+    name: Build source distribution
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: Build distribution
+        run: |
+          pipx run build --sdist
+      - name: Store the distribution packages
+        uses: actions/upload-artifact@v7
+        with:
+          name: pkg-sdist
+          path: dist/*.tar.gz
+
+  # PyPI is published before the GitHub release because a PyPI upload is
+  # irreversible (a version can be yanked, but the filename can never be
+  # reused), whereas a GitHub release can simply be deleted and recreated. If
+  # only one of the two succeeds, it should be the one that cannot be redone.
+  pypi:
+    name: Publish to pypi
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+    needs:
+      - build_sdist
+    environment:
+      name: pypi
+      url: https://pypi.org/p/sbd-eigensolver
+    permissions:
+      id-token: write
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@v8
+        with:
+          pattern: pkg-*
+          path: dist
+          merge-multiple: true
+      - name: Publish release to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+  github:
+    name: Publish to GitHub
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+    needs:
+      - build_sdist
+      - pypi
+    permissions:
+      contents: write
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@v8
+        with:
+          pattern: pkg-*
+          path: dist
+          merge-multiple: true
+      - name: Generate checksums
+        working-directory: dist
+        run: sha256sum -- * > checksums.sha256
+      - name: Publish release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: >-
+          gh release create
+          '${{ github.ref_name }}'
+          --repo '${{ github.repository }}'
+          --title '${{ github.ref_name }}'
+          --generate-notes
+          --verify-tag
+          dist/*