CI: add publish step for version tags

.github/workflows/ci.yml

@@ -5,6 +5,8 @@ on:
     branches:
       - master
       - '*-maint'
+    tags:
+      - 'v*'
   pull_request:
     branches:
       - master
@@ -76,3 +78,23 @@ jobs:
         with:
           name: dist
           path: dist
+  publish:
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
+    needs:
+      - build
+    runs-on: ubuntu-latest
+    environment:
+      name: release
+      url: https://pypi.org/p/babel/
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v3
+        with:
+          name: dist
+          path: dist/
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          verbose: true
+          print-hash: true