Add PyPI publish workflow with reusable build-wheels

[shaia]

• Add workflow_call trigger to build-wheels.yml for reusability
• Create publish.yml that reuses build-wheels workflow
• Support release, tag push (v*), and manual dispatch triggers
• Publish to TestPyPI (manual) or PyPI (release/tag)
• Use trusted publishing (OIDC) for secure authentication
• Clean up debug steps from build-wheels workflow

[Copilot]

Pull request overview

This PR establishes an automated PyPI publishing pipeline for the cfd-python package, implementing secure OIDC-based authentication and supporting multiple deployment targets (PyPI, TestPyPI) with flexible trigger mechanisms.

Key Changes:

• Created a new publish.yml workflow that orchestrates wheel building, source distribution creation, and publishing to PyPI/TestPyPI
• Made build-wheels.yml reusable via workflow_call trigger and removed debug/diagnostic steps
• Implemented OIDC trusted publishing for secure, token-less authentication with PyPI registries

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.

File	Description
.github/workflows/publish.yml	New workflow that builds wheels/sdist and publishes to PyPI or TestPyPI based on release events, tag pushes, or manual triggers
.github/workflows/build-wheels.yml	Added workflow_call trigger for reusability, added CFD_USE_STABLE_ABI environment variable, and cleaned up debug logging steps

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.

[Copilot]

[nitpick] The artifact uploads in the build jobs don't specify a retention period. For a publish workflow that may run frequently (especially with manual dispatch), consider adding retention-days to prevent excessive artifact storage costs.

Example:

- uses: actions/upload-artifact@v4
  with:
    name: sdist
    path: dist/*.tar.gz
    retention-days: 5

Suggested change

	path: dist/*.tar.gz
	path: dist/*.tar.gz
	retention-days: 5

[Copilot]

[nitpick] The publish jobs have id-token: write for OIDC authentication, but they may also need contents: read permission to properly interact with release artifacts and repository content when triggered by release events.

Consider adding:

permissions:
  id-token: write
  contents: read

[Copilot]

[nitpick] The publish jobs have id-token: write for OIDC authentication, but they may also need contents: read permission to properly interact with release artifacts and repository content when triggered by release events.

Consider adding:

permissions:
  id-token: write
  contents: read

[Copilot]

The release trigger and push with tags: v* may fire simultaneously when a GitHub release is published (since releases create tags). This could result in duplicate workflow runs attempting to publish the same version to PyPI.

Consider using only the release trigger for production releases, or add logic to prevent duplicate publishes (e.g., using a workflow concurrency group or removing one of the triggers).

Suggested change

	push:
	tags:
	- 'v*'