Fix release workflow triggering from cut-release

Tags pushed by GitHub Actions using GITHUB_TOKEN don't trigger other
workflows. Fix this by:

- Adding workflow_call trigger to release.yml with version input
- Having cut-release.yml directly call release.yml after creating the tag
- Updating release.yml checkout steps to use the version input/ref
- Adding id-token permission for PyPI trusted publishing

https://claude.ai/code/session_01EbCZH6NCwRCDVVgu68bc9L

Author: claude

.github/workflows/cut-release.yml

@@ -10,6 +10,7 @@ on:
 
 permissions:
   contents: write
+  id-token: write  # Required for PyPI trusted publishing
 
 jobs:
   cut-release:
@@ -66,6 +67,11 @@ jobs:
         run: |
           echo "## Release $VERSION created!" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
-          echo "The tag \`$VERSION\` has been pushed and will trigger the release workflow." >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "Check the [Release workflow](/${{ github.repository }}/actions/workflows/release.yml) for progress." >> $GITHUB_STEP_SUMMARY
+          echo "Tag \`$VERSION\` has been pushed. Release workflow will now run." >> $GITHUB_STEP_SUMMARY
+
+  release:
+    name: Release
+    needs: cut-release
+    uses: ./.github/workflows/release.yml
+    with:
+      version: ${{ github.event.inputs.version }}

.github/workflows/release.yml

@@ -5,6 +5,16 @@ on:
     tags:
       - 'v[0-9]+.[0-9]+.[0-9]+'
       - 'v[0-9]+.[0-9]+.[0-9]+-*'  # Allow pre-release tags like v0.2.0-beta1
+  workflow_call:
+    inputs:
+      version:
+        description: 'Version tag to release (e.g., v0.2.0)'
+        required: true
+        type: string
+
+env:
+  # Use input version for workflow_call, or ref_name for tag push
+  RELEASE_VERSION: ${{ inputs.version || github.ref_name }}
 
 jobs:
   build:
@@ -13,6 +23,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.version || github.ref_name }}
 
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -38,6 +50,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.version || github.ref_name }}
 
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -88,6 +102,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.version || github.ref_name }}
 
       - name: Download distribution artifacts
         uses: actions/download-artifact@v4
@@ -99,7 +115,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
-          gh release create '${{ github.ref_name }}' \
-            --title '${{ github.ref_name }}' \
+          gh release create '${{ env.RELEASE_VERSION }}' \
+            --title '${{ env.RELEASE_VERSION }}' \
             --generate-notes \
             dist/*