Rework release pipeline

Signed-off-by: Martin Styk <mart.styk@gmail.com>

.github/workflows/publish.yml

@@ -0,0 +1,67 @@
+name: Publish
+
+on: [pull_request]
+
+
+jobs:
+  build-python-package:
+    strategy:
+      matrix:
+        component: ["Common", "Client"]
+    runs-on: ubuntu-latest
+    outputs:
+      hash: ${{ steps.hash.outputs.hash }}
+    steps:
+    - name: Checkout source code
+      uses: actions/checkout@v3
+    - name: Set up Python
+      uses: actions/setup-python@v4
+      with:
+        python-version: '3.x'
+    - name: Install python dependencies
+      run: pip install --upgrade pip && pip install build
+    - name: Build python package
+      run: cd ${{ matrix.component }} && python -m build
+    - name: Generate hash
+      id: hash
+      run: cd ${{ matrix.component }}/dist && echo "hash=$(sha256sum * | base64 -w0)" >> $GITHUB_OUTPUT
+    - name: Upload python artifacts
+      uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32
+      with:
+        path: ${{ matrix.component }}/dist
+  provenance:
+    needs: [build-python-package]
+    permissions:
+      actions: read
+      id-token: write
+      contents: write
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0
+    with:
+      base64-subjects: ${{ needs.build-python-package.outputs.hash }}
+
+#
+#  pypi-publish-common:
+#    name: Upload beaker-common release to PyPI
+#    runs-on: ubuntu-latest
+#    environment: production
+#    permissions:
+#      id-token: write
+#    steps:
+#      -
+#      - name: Publish package distributions to PyPI
+#        uses: pypa/gh-action-pypi-publish@release/v1
+#        with:
+#          packages-dir: artifacts/
+#
+#  pypi-publish-client:
+#    name: Upload beaker-client release to PyPI
+#    runs-on: ubuntu-latest
+#    environment: production
+#    permissions:
+#      id-token: write
+#    steps:
+#      -
+#      - name: Publish package distributions to PyPI
+#        uses: pypa/gh-action-pypi-publish@release/v1
+#        with:
+#          packages-dir: artifacts/