WIP

Author: glenn20

.github/workflows/ci-workflow.yaml

@@ -60,26 +60,11 @@ jobs:
   build:
     name: Build python package
     uses: glenn20/python-ci/.github/workflows/build.yaml@dev
-    permissions:
-      id-token: none
-      contents: none
 
   test:
-    if: ${{ contains(fromJson(inputs.jobs), 'test') }}
     name: Tests
+    if: ${{ contains(fromJson(inputs.jobs), 'test') }}
     uses: glenn20/python-ci/.github/workflows/test-tox.yaml@dev
     with:
       os: ${{ inputs.os }}
       python-version: ${{ inputs.python-version }}
-    permissions:
-      id-token: none
-      contents: none
-
-  release:  # Create a github release
-    if: ${{ contains(fromJson(inputs.jobs), 'release') }}
-    name: Create GitHub release
-    needs: [build, test]
-    uses: glenn20/python-ci/.github/workflows/github-release.yaml@dev
-    permissions:
-      id-token: write  # Required for signing the release
-      contents: write  # Required for github release

.github/workflows/ci.yaml

@@ -36,11 +36,12 @@ env:
 
 jobs:
   config:  # Select the workflow config based on the event trigger.
-    runs-on: ubuntu-latest
+    name: Configure workflow
     outputs:
       jobs: ${{ steps.config.outputs.jobs }}
       os: ${{ steps.config.outputs.os }}
       python-version: ${{ steps.config.outputs.python-version }}
+    runs-on: ubuntu-latest
     steps:
       - id: config
         uses: glenn20/python-ci/config@dev
@@ -55,17 +56,14 @@ jobs:
       jobs: ${{ needs.config.outputs.jobs }}
       os: ${{ needs.config.outputs.os }}
       python-version: ${{ needs.config.outputs.python-version }}
-    permissions:
-      id-token: write  # IMPORTANT: mandatory for github release
-      contents: write  # IMPORTANT: mandatory for github release
 
   # We can't use trusted publishing from a reusable workflow in another
   # repository, so the publish workflows must be run from here.
   publish:
-    if: ${{ contains(needs.config.outputs.jobs, 'publish') }}
     name: Publish to pypi.org
     needs: [config, ci-workflow]
     runs-on: ubuntu-latest
+    if: ${{ contains(needs.config.outputs.jobs, 'publish') }}
     environment:
       name: publish-pypi
       url: ${{ steps.publish.outputs.url }}
@@ -76,3 +74,15 @@ jobs:
         uses: glenn20/python-ci/publish@dev
         with:
           test-only: ${{ contains(fromJson(needs.config.outputs.jobs), 'publish') && 'false' || 'true' }}
+
+  # We run the github release job here instead of in ci-workflow, as it requires
+  # permissions to sign the release and to simplify the workflow dependency
+  # graph on the github UI.
+  release:
+    name: Create GitHub release
+    needs: [config, ci-workflow]
+    uses: glenn20/python-ci/.github/workflows/github-release.yaml@dev
+    permissions:
+      id-token: write  # Required for signing the release
+      contents: write  # Required for github release
+    if: ${{ contains(fromJson(needs.config.outputs.jobs), 'release') }}