refactor: inline test release (#32903)

Reusable workflows are not currently supported by PyPI's Trusted
Publishing
functionality, and are subject to breakage. Users are strongly
encouraged
to avoid using reusable workflows for Trusted Publishing until support
becomes official. Please, do not report bugs if this breaks.

.github/workflows/_release.yml

@@ -183,13 +183,36 @@ jobs:
     needs:
       - build
       - release-notes
-    uses:
+    runs-on: ubuntu-latest
-      ./.github/workflows/_test_release.yml
+    permissions:
-    permissions: write-all
+      # This permission is used for trusted publishing:
-    with:
+      # https://blog.pypi.org/posts/2023-04-20-introducing-trusted-publishers/
-      working-directory: ${{ inputs.working-directory }}
+      #
-      dangerous-nonmaster-release: ${{ inputs.dangerous-nonmaster-release }}
+      # Trusted publishing has to also be configured on PyPI for each package:
-    secrets: inherit
+      # https://docs.pypi.org/trusted-publishers/adding-a-publisher/
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: actions/download-artifact@v5
+        with:
+          name: dist
+          path: ${{ inputs.working-directory }}/dist/
+
+      - name: Publish to test PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: ${{ inputs.working-directory }}/dist/
+          verbose: true
+          print-hash: true
+          repository-url: https://test.pypi.org/legacy/
+          # We overwrite any existing distributions with the same name and version.
+          # This is *only for CI use* and is *extremely dangerous* otherwise!
+          # https://github.com/pypa/gh-action-pypi-publish#tolerating-release-package-file-duplicates
+          skip-existing: true
+          # Temp workaround since attestations are on by default as of gh-action-pypi-publish v1.11.0
+          attestations: false
 
   pre-release-checks:
     needs:

.github/workflows/_test_release.yml

@@ -1,106 +0,0 @@
-name: '🧪 Test Release Package'
-
-on:
-  workflow_call:
-    inputs:
-      working-directory:
-        required: true
-        type: string
-        description: "From which folder this pipeline executes"
-      dangerous-nonmaster-release:
-        required: false
-        type: boolean
-        default: false
-        description: "Release from a non-master branch (danger!)"
-
-env:
-  PYTHON_VERSION: "3.11"
-  UV_FROZEN: "true"
-
-jobs:
-  build:
-    if: github.ref == 'refs/heads/master' || inputs.dangerous-nonmaster-release
-    runs-on: ubuntu-latest
-
-    outputs:
-      pkg-name: ${{ steps.check-version.outputs.pkg-name }}
-      version: ${{ steps.check-version.outputs.version }}
-
-    steps:
-      - uses: actions/checkout@v5
-
-      - name: '🐍 Set up Python + UV'
-        uses: "./.github/actions/uv_setup"
-        with:
-          python-version: ${{ env.PYTHON_VERSION }}
-
-      # We want to keep this build stage *separate* from the release stage,
-      # so that there's no sharing of permissions between them.
-      # The release stage has trusted publishing and GitHub repo contents write access,
-      # and we want to keep the scope of that access limited just to the release job.
-      # Otherwise, a malicious `build` step (e.g. via a compromised dependency)
-      # could get access to our GitHub or PyPI credentials.
-      #
-      # Per the trusted publishing GitHub Action:
-      # > It is strongly advised to separate jobs for building [...]
-      # > from the publish job.
-      # https://github.com/pypa/gh-action-pypi-publish#non-goals
-      - name: '📦 Build Project for Distribution'
-        run: uv build
-        working-directory: ${{ inputs.working-directory }}
-
-      - name: '⬆️ Upload Build Artifacts'
-        uses: actions/upload-artifact@v4
-        with:
-          name: test-dist
-          path: ${{ inputs.working-directory }}/dist/
-
-      - name: '🔍 Extract Version Information'
-        id: check-version
-        shell: python
-        working-directory: ${{ inputs.working-directory }}
-        run: |
-          import os
-          import tomllib
-          with open("pyproject.toml", "rb") as f:
-              data = tomllib.load(f)
-          pkg_name = data["project"]["name"]
-          version = data["project"]["version"]
-          with open(os.environ["GITHUB_OUTPUT"], "a") as f:
-              f.write(f"pkg-name={pkg_name}\n")
-              f.write(f"version={version}\n")
-
-  publish:
-    needs:
-      - build
-    runs-on: ubuntu-latest
-    permissions:
-      # This permission is used for trusted publishing:
-      # https://blog.pypi.org/posts/2023-04-20-introducing-trusted-publishers/
-      #
-      # Trusted publishing has to also be configured on PyPI for each package:
-      # https://docs.pypi.org/trusted-publishers/adding-a-publisher/
-      id-token: write
-
-    steps:
-      - uses: actions/checkout@v5
-
-      - uses: actions/download-artifact@v5
-        with:
-          name: test-dist
-          path: ${{ inputs.working-directory }}/dist/
-
-      - name: Publish to test PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          packages-dir: ${{ inputs.working-directory }}/dist/
-          verbose: true
-          print-hash: true
-          repository-url: https://test.pypi.org/legacy/
-
-          # We overwrite any existing distributions with the same name and version.
-          # This is *only for CI use* and is *extremely dangerous* otherwise!
-          # https://github.com/pypa/gh-action-pypi-publish#tolerating-release-package-file-duplicates
-          skip-existing: true
-          # Temp workaround since attestations are on by default as of gh-action-pypi-publish v1.11.0
-          attestations: false