Tag and release together (#11)

.github/workflows/publish.yml

@@ -1,9 +1,14 @@
 name: Release Cross-build environment
 
 on:
-  push:
-    tags:        
-      - '*' 
+  schedule:
+    # Run at 00:00 UTC on the 1st, 10th, and 20th of every month
+    - cron: '0 0 1,10,20 * *'
+  workflow_dispatch:
+    inputs:
+      release_version:
+        description: 'The version to release'
+        required: true
 
 concurrency:
   group: release-${{ github.workflow }}-${{ github.ref }}
@@ -17,8 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [build]
     if: >-
-      github.repository == 'pyodide/pyodide-build-environment-nightly' &&
-      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags'))
+      github.repository == 'pyodide/pyodide-build-environment-nightly'
     permissions:
       # Required to sign the attestations
       id-token: write
@@ -42,7 +46,11 @@ jobs:
         id: release_version
         shell: bash
         run: |
-          echo "release_version=${{ github.ref_name  }}" >> $GITHUB_OUTPUT
+          if [[ ${{ github.event_name }} == 'schedule' ]]; then
+            echo "release_version=$(date +'%Y%m%d')" >> $GITHUB_OUTPUT
+          else
+            echo "release_version=${{ github.event.inputs.release_version }}" >> $GITHUB_OUTPUT
+          fi
 
           cat $GITHUB_OUTPUT
 
@@ -52,11 +60,22 @@ jobs:
         shell: bash
         run: |
           gh attestation verify dist/xbuildenv.tar.bz2 --repo ${{ github.repository }}
+      
+      - name: Create and push tag
+        run: |
+          git config --global user.name "Pyodide CI"
+          git config --global user.email "[email protected]"
+          TAG_NAME=${{ steps.release_version.outputs.release_version }}
+          git tag $TAG_NAME
+          git push origin $TAG_NAME
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Create GitHub release with these wheels
         uses: softprops/action-gh-release@01570a1f39cb168c169c802c3bceb9e93fb10974 # v2.1.0
         with:
           files: |
             dist/*.tar.bz2
+          tag_name: ${{ steps.release_version.outputs.release_version }}
           fail_on_unmatched_files: true
           name: ${{ steps.release_version.outputs.release_version }}