Add inmutable releases

[jiep]

No description provided.

[Copilot]

Pull request overview

Updates the tag-triggered release workflow to make releases effectively “immutable” by publishing only if a release for the tag doesn’t already exist, and by reusing the previously built distribution artifacts from the build job.

Changes:

• Replace in-workflow build steps with downloading the wheel-package artifact into dist/.
• Switch GitHub Release creation from ncipollo/release-action to gh release create, with a pre-check to skip if the release already exists.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

.github/workflows/release.yml:77

• The provenance attestation is generated in the release job, but the actual build now happens in a separate reusable workflow/job (wheel.yml). For stronger/clearer provenance, consider generating the attestation in the build job immediately after building (or otherwise ensuring the attestation clearly corresponds to the build environment rather than the release job that only downloads artifacts).

    - name: Generate attestation
      uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
      with:
        subject-path: "dist/*"

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.