ci: trigger publish based on another workflow completion

because github actions doesnt allow us to listen to published events
for a release from an automatically triggered workflow, we instead
need to check if another workflow has run to completion, and if so,
we will run publish. We therefore trigger a trigger-publish workflow,
if a release has been created, that we listen to in the publish
workflow, and will then trigger

Refs: equinor/ecalc-internal#433

Author: tj098895

.github/workflows/publish.yml

@@ -1,8 +1,14 @@
 name: Publish libeCalc package to PyPI
 
 on:
-  release: # Trigger automatically, when a new release is made (with release-please)
-    types: [published]
+  workflow_run:
+    workflows: [trigger-publish]
+    types:
+      - completed
+  # Note! We cannot trigger on published event, since that can only be triggered when done manually.
+  # Therefore we trigger this workflow independently, after the trigger-publish workflow has run, in
+  # order for this workflow to be the owner of the PyPI publishing job, and can be verified. This limits
+  # us to only allow this workflow to be allowed to publish to PyPI trustedly.
 
   workflow_dispatch: # Trigger manually, if needed
 

.github/workflows/release-please.yml

@@ -17,3 +17,8 @@ jobs:
     outputs:
       release_created: ${{ steps.release.outputs.release_created }}
       tag_name: ${{ steps.release.outputs.tag_name }}
+
+  deploy_prod:
+    needs: release-please
+    uses: equinor/ecalc/.github/workflows/trigger-publish.yml@main
+    if: ${{ needs.release-please.outputs.release_created }}

.github/workflows/trigger-publish.yml

@@ -0,0 +1,15 @@
+name: trigger-publish
+
+# NOTE! This workflow is needed in order to trigger the publish workflow, which is not possible from within a reusable workflow.
+# If this is triggered, we will publish, as this should only trigger when a release is created by the release-please workflow.
+
+on:
+  workflow_dispatch: # Workflow dispatch is used for manual triggers.
+  workflow_call: # Workflow call is used for called from another workflow.
+
+jobs:
+  trigger-publish:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: trigger-publish
+        run: echo "Trigger publish workflow"