📦 Build release artifacts in CI

This is a narrowly scoped initial integration of `reusable-tox.yml`
into the project's CI/CD infra. It makes use of the following external
action and reusable workflow repositories, some are optional:
* `codecov/codecov-action` (transitively, via `tox-dev/workflow`)
* `irongut/CodeCoverageSummary` (transitively, via `tox-dev/workflow`)
* `re-actors/cache-python-deps` « (directly; and also transitively,
  via `tox-dev/workflow`)
* `re-actors/checkout-python-sdist` «
  (transitively, via `tox-dev/workflow`)
* `test-summary/action` (transitively, via `tox-dev/workflow`)
* `tox-dev/workflow` « (directly)

The marked projects are under my control.

This patch plugs the main CI workflow as reusable into the release
one. The CI workflow gets two new jobs — pre-setup that computes a
number of variables, and build that makes the artifacts and stores
them for later consumption by the PyPI upload job. The build job
also double-checks that the artifacts are created with expected
names.

The invocation of `pypa/build` moved to tox so that it's possible to
run the same process locally.

In follow-up PRs, these dists will also be used in testing.

Author: webknjaz

.github/actions/cache-keys/action.yml

@@ -0,0 +1,48 @@
+---
+
+name: placeholder
+description: placeholder
+
+outputs:
+  cache-key-for-dep-files:
+    description: >-
+      A cache key string derived from the dependency declaration files.
+    value: ${{ steps.calc-cache-key-files.outputs.files-hash-key }}
+
+runs:
+  using: composite
+  steps:
+  - name: >-
+      Calculate dependency files' combined hash value
+      for use in the cache key
+    id: calc-cache-key-files
+    run: |
+      from os import environ
+      from pathlib import Path
+
+      FILE_APPEND_MODE = 'a'
+
+      files_derived_hash = '${{
+          hashFiles(
+            'tox.ini',
+            'pyproject.toml',
+            '.pre-commit-config.yaml',
+            'pytest.ini',
+            'dependencies/**',
+            'dependencies/*/**',
+            'setup.cfg'
+          )
+      }}'
+
+      print(f'Computed file-derived hash is {files_derived_hash}.')
+
+      with Path(environ['GITHUB_OUTPUT']).open(
+              mode=FILE_APPEND_MODE,
+      ) as outputs_file:
+          print(
+              f'files-hash-key={files_derived_hash}',
+              file=outputs_file,
+          )
+    shell: python
+
+...

.github/reusables/tox-dev/workflow/reusable-tox/hooks/post-tox-run/action.yml

@@ -0,0 +1,82 @@
+---
+
+inputs:
+  calling-job-context:
+    description: A JSON with the calling job inputs
+    type: string
+  current-job-steps:
+    description: >-
+      The `$ {{ steps }}` context passed from the reusable workflow's
+      tox job encoded as a JSON string. The caller passes it this input
+      as follows:
+      `current-job-steps: $ {{ toJSON(steps) }}`.
+    type: string
+  job-dependencies-context:
+    default: >-
+      {}
+    description: >-
+      The `$ {{ needs }}` context passed from the calling workflow
+      encoded as a JSON string. The caller is expected to form this
+      input as follows:
+      `job-dependencies-context: $ {{ toJSON(needs) }}`.
+    required: false
+    type: string
+
+runs:
+  using: composite
+  steps:
+  - name: Verify that the artifacts with expected names got created
+    if: fromJSON(inputs.calling-job-context).toxenv == 'build-dists'
+    run: >
+      # Verify that the artifacts with expected names got created
+
+
+      ls -1
+      'dist/${{
+        fromJSON(
+          inputs.job-dependencies-context
+        ).pre-setup.outputs.sdist-artifact-name
+      }}'
+      'dist/${{
+        fromJSON(
+          inputs.job-dependencies-context
+        ).pre-setup.outputs.wheel-artifact-name
+      }}'
+    shell: bash
+  - name: Store the distribution packages
+    if: fromJSON(inputs.calling-job-context).toxenv == 'build-dists'
+    uses: actions/upload-artifact@v4
+    with:
+      name: >-
+        ${{
+          fromJSON(
+            inputs.job-dependencies-context
+          ).pre-setup.outputs.dists-artifact-name
+        }}
+      # NOTE: Exact expected file names are specified here
+      # NOTE: as a safety measure — if anything weird ends
+      # NOTE: up being in this dir or not all dists will be
+      # NOTE: produced, this will fail the workflow.
+      path: |
+        dist/${{
+          fromJSON(
+            inputs.job-dependencies-context
+          ).pre-setup.outputs.sdist-artifact-name
+        }}
+        dist/${{
+          fromJSON(
+            inputs.job-dependencies-context
+          ).pre-setup.outputs.wheel-artifact-name
+        }}
+      retention-days: >-
+        ${{
+            fromJSON(
+              fromJSON(
+                inputs.job-dependencies-context
+              ).pre-setup.outputs.release-requested
+            )
+            && 90
+            || 30
+        }}
+
+...