chore: publish python release (#1221)

<!-- ELLIPSIS_HIDDEN -->


> [!IMPORTANT]
> Adds GitHub Actions workflow for automating Python package publishing
to PyPI and updates dependencies.
> 
>   - **Workflow Addition**:
> - Adds `.github/workflows/publish-python-release.yaml` to automate
publishing to PyPI on push to `sam/py-release3`.
> - Uses concurrency group `${{ github.workflow }}-${{ github.ref
}}-build-python` to prevent deadlocks.
>   - **Job Configuration**:
> - Runs on `ubuntu-latest` with steps for `actions/checkout@v4`,
`actions/setup-python@v5` (Python 3.8), and
`actions/download-artifact@v4`.
> - Publishes package using `PyO3/maturin-action@v1` with `upload`
command.
>   - **Dependencies**:
>     - Adds `maturin>=1.7.8` to `dependencies` in `pyproject.toml`.
>   - **Misc**:
> - Removes pinned `maturin` version `1.7.6` in
`build-python-release.reusable.yaml`.
> 
> <sup>This description was created by </sup>[<img alt="Ellipsis"
src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=BoundaryML%2Fbaml&utm_source=github&utm_medium=referral)<sup>
for 5f44944. It will automatically
update as commits are pushed.</sup>


<!-- ELLIPSIS_HIDDEN -->

.github/workflows/build-python-release.reusable.yaml

@@ -65,13 +65,6 @@ jobs:
         env: ${{ matrix._.env || fromJSON('{}') }}
         with:
           target: ${{ matrix._.target }}
-          # TODO: unpin the maturin version
-          # 1.7.7+ builds wheels that gh-action-pypi-publish can't upload
-          # see:
-          #   - release failure: https://github.com/BoundaryML/baml/actions/runs/12154379580/job/33894619438
-          #   - maturin changelog: https://github.com/PyO3/maturin/blob/ba4d482809a73669242bd7fe7dd5f9106f42702f/Changelog.md?plain=1#L13
-          #   - gh-action-pypi-publish issue: https://github.com/pypa/gh-action-pypi-publish/issues/310
-          maturin-version: "1.7.6"
           command: build
           # building in engine/ ensures that we pick up .cargo/config.toml
           working-directory: engine

.github/workflows/release.yml

@@ -123,13 +123,29 @@ jobs:
       - uses: actions/download-artifact@v4
         with:
           pattern: wheels-*
+          path: dist
+          merge-multiple: true
+
+      # Verify we have the expected number of wheels
+      - name: Verify wheel count
+        run: |
+          set -euo pipefail
+          ls dist/
+          wheel_count=$(ls dist/*.whl 2>/dev/null | wc -l)
+          if [ "$wheel_count" -lt 7 ]; then
+            echo "Error: Expected at least 7 wheels, but found $wheel_count"
+            exit 1
+          fi
+          echo "Found $wheel_count wheels"
 
-      - run: mkdir dist && mv wheels-*/* dist
       # authz is managed via OIDC configured at https://pypi.org/manage/project/baml-py/settings/publishing/
       # it is pinned to this github actions filename, so renaming this file is not safe!!
       - name: Publish package to PyPI
         if: ${{ startsWith(github.ref, 'refs/tags/') && !startsWith(github.ref, 'refs/tags/test-release') }}
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: PyO3/maturin-action@v1
+        with:
+          command: upload
+          args: dist/*
 
   publish-to-npm:
     environment: release
@@ -267,11 +283,7 @@ jobs:
   release-github:
     runs-on: ubuntu-latest
     if: github.ref_type == 'tag'
-    needs:
-      - publish-to-pypi
-      - publish-to-npm
-      - publish-to-rubygems
-      # - publish-vscode
+    needs: [assert-all-builds-passed]
     steps:
       - uses: actions/checkout@v4
 
@@ -280,7 +292,13 @@ jobs:
         run: |
           echo "::set-output name=changelog::$(awk '/^## \[/{if (p) exit; p=1} p' CHANGELOG.md)"
 
+      - uses: actions/download-artifact@v4
+        with:
+          path: gh-artifacts
+          merge-multiple: true
+
       - name: Create Release
         uses: mikepenz/action-gh-release@v1 #softprops/action-gh-release
         with:
           body: ${{steps.latest_release.outputs.changelog}}
+          files: gh-artifacts/*