Combine test and release

When test and release are separate, then a release can happen even if
the testing run fails. We move the release code into the CI code so that
all releases are as tested as we can make them

.github/workflows/tox.yml

@@ -1,11 +1,7 @@
 name: Test with Ansible
 
 on:
-  push:
-    branches:
-      - '*'
-    tags-ignore:
-      - '*'  # A build will already happen for the commit, don't also build the tag
+  push: {}
   pull_request: {}
   schedule:
     - cron: '12 0 * * *'
@@ -72,3 +68,31 @@ jobs:
           mv ansible_collections ~/work/
           cd ~/work/${{ env.checkout_path }}
           tox --ansible-role ${{ matrix.role }}
+
+  release:
+    needs: build  # Only release if the build is good
+    if: startsWith(github.ref, 'refs/tags/')  # Only release if there is a tag that's been pushed to the repo
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          submodules: 'recursive'
+      - name: Setup Python
+        uses: actions/setup-python@v1
+        with:
+          python-version: 3.8
+      - name: Install pip
+        run: |
+          python -m pip install --upgrade pip
+          pip install ansible
+      - name: Create release artifacts
+        run: |
+          ansible-galaxy collection build
+          ansible-galaxy collection publish *.tar.gz --api-key ${{ secrets.GALAXY_API_KEY }}
+      - name: Release artifacts to Git Hub
+        uses: ncipollo/release-action@v1
+        with:
+          artifacts: ./oasis_roles-system*.tar.gz
+          allowUpdates: true
+          name: Rlease ${{ github.ref }}
+          token: ${{ secrets.GITHUB_TOKEN }}