fix: upload dist artifact before signing to avoid .pem/.sig in PyPI publish (#18)

Move upload-artifact step to right after build, before Cosign signing
adds .sig and .pem files to dist/. The PyPI publish action only accepts
valid Python distributions (.whl, .tar.gz).

Signed-off-by: Igor Racic <iracic82@gmail.com>

Author: iracic82

.github/workflows/release.yml

@@ -30,6 +30,12 @@ jobs:
       - name: Build wheel and sdist
         run: python -m build
 
+      - name: Upload dist artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
       - name: Install package for SBOM
         run: pip install dist/*.whl
 
@@ -61,12 +67,6 @@ jobs:
             sbom.json.sig
             sbom.json.pem
 
-      - name: Upload dist artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: dist
-          path: dist/
-
   publish-to-pypi:
     name: Publish to PyPI
     needs: build