fix: release drafter

.github/workflows/release.yml

@@ -4,11 +4,14 @@ on:
   push:
     branches:
       - main
+      - release-drafter
 
 jobs:
-  release:
-    name: Release
+  build:
+    name: Build
     runs-on: ubuntu-latest
+    outputs:
+      version-tag: ${{ steps.check-version.outputs.tag }}
     environment:
       name: pypi
       url: https://pypi.org/p/merge-stardist-masks
@@ -59,20 +62,48 @@ jobs:
         run: |
           poetry build --ansi
 
+      - name: Save build as artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: build
+          path: "dist/"
+
+  publish:
+    name: Publish
+    runs-on: ubuntu-latest
+    needs: build
+    environment:
+      name: pypi
+      url: https://pypi.org/p/merge-stardist-masks
+    permissions:
+      id-token: write
+    steps:
+      - name: Download build artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: build
+
       - name: Publish package on PyPI
-        if: steps.check-version.outputs.tag
+        if: needs.build.outputs.version-tag
         uses: pypa/[email protected]
 
       - name: Publish package on TestPyPI
-        if: "! steps.check-version.outputs.tag"
+        if: "! needs.build.outputs.version-tag"
         uses: pypa/[email protected]
         with:
           repository-url: https://test.pypi.org/legacy/
 
+  release-draft:
+    name: Release drafter
+    runs-on: ubuntu-latest
+    needs: build
+    permissions:
+      contents: write
+    steps:
       - name: Publish the release notes
         uses: release-drafter/[email protected]
         with:
-          publish: ${{ steps.check-version.outputs.tag != '' }}
-          tag: ${{ steps.check-version.outputs.tag }}
+          publish: ${{ needs.build.outputs.version-tag != '' }}
+          tag: ${{ needs.build.outputs.version-tag }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}