Produce stable artifacts

[jakirkham]

GitHub autogenerated source artifact from tags regularly have unstable checksums. As part of the release process it would be great if we could produce stable source artifacts (with checksums) and attach them to the release tag. This way we could more reliably consume the source in other places where we have builds (like conda-forge)

A few examples:

• https://github.com/conda-forge/cuda-python-feedstock/pull/83#issuecomment-2192435776
• https://github.com/conda-forge/cuda-python-feedstock/pull/79
• https://github.com/conda-forge/cuda-python-feedstock/pull/23#discussion_r1044055112

[leofang]

This should be done indeed. IIRC NumPy etc do this too by uploading artifacts. @jakirkham any chance you know off top of your head a reference for us to follow? (No worries if not, I'll figure it out later.)

[jakirkham]

Certainly we did this for conda and conda-build. Here is the workflow conda uses. Maybe that would be a good starting point?

[leofang]

@sandeepd-nv Would you take a look when you have a chance plz? 🙂 Thanks!

[leofang]

cc @m3vaz for vis