DEVOPS-1154: address warnings upon publishing Python packages from GitHub

.github/workflows/issue_to_jira.yml

@@ -9,7 +9,7 @@ permissions: {}
 jobs:
   call-workflow-create-jira-issue:
     if: startsWith(github.repository, 'MiraGeoscience/')  # run on the Mira repo only
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@DEVOPS-1154
     permissions:
       contents: read
       issues: write

.github/workflows/pr_jira_actions.yml

@@ -7,7 +7,7 @@ on:
 jobs:
   call-workflow-pr_jira_actions:
     if: github.event.action != 'edited' || github.event.changes.title != null
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@DEVOPS-1154
     permissions:
       contents: read
       pull-requests: write

.github/workflows/python_deploy_dev.yml

@@ -14,7 +14,7 @@ concurrency:
 jobs:
   call-workflow-conda-publish:
     name: Publish development conda package on JFrog Artifactory
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@DEVOPS-1154
     permissions:
       contents: write
     with:
@@ -29,7 +29,7 @@ jobs:
       JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
   call-workflow-pypi-publish:
     name: Publish development pypi package (JFrog Artifactory, TestPyPI)
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@DEVOPS-1154
     permissions:
       contents: write
     with:
@@ -41,4 +41,23 @@ jobs:
     secrets:
       JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }}
       JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
-      PYPI_TOKEN: ${{ secrets.TEST_PYPI_TOKEN }}
+  publish-pypi-package:
+    name: Publish development Python package to TestPyPI
+    needs: call-workflow-pypi-publish
+    if: ${{ needs.call-workflow-pypi-publish.result == 'success' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      # Intentionally a composite action, not a reusable workflow: PyPI trusted
+      # publishing checks the OIDC token's workflow_ref, which only matches this
+      # repo's own workflow file when the publish step runs as a step here rather
+      # than as a job in a called `uses:` workflow (job_workflow_ref is unsupported
+      # by PyPI - see MiraGeoscience/CI-tools DEVOPS-1154 and pypi/warehouse#11096).
+      - name: Publish package to TestPyPI
+        uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-publish_to_pypi@DEVOPS-1154
+        with:
+          source: artifact
+          artifact-name: mira-simpeg-pip-package-build
+          repository-url: https://test.pypi.org/legacy/

.github/workflows/python_deploy_prod.yml

@@ -29,7 +29,7 @@ jobs:
   call-workflow-conda-release:
     name: Publish production Conda package on JFrog Artifactory
     if: ${{ github.event_name == 'release' || github.event.inputs.publish-conda == 'true' }}
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@DEVOPS-1154
     permissions:
       contents: write
     with:
@@ -39,9 +39,9 @@ jobs:
       JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }}
       JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
   call-workflow-pypi-release:
-    name: Publish production PyPI package (JFrog Artifactory, PyPI)
+    name: Publish production PyPI package (JFrog Artifactory)
     if: ${{ github.event_name == 'release' || github.event.inputs.publish-pypi == 'true' }}
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@DEVOPS-1154
     permissions:
       contents: write
     with:
@@ -51,4 +51,24 @@ jobs:
     secrets:
       JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }}
       JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
-      PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
+  publish-pypi-release:
+    name: Publish production Python package to PyPI
+    needs: call-workflow-pypi-release
+    if: ${{ (github.event_name == 'release' || github.event.inputs.publish-pypi == 'true') && needs.call-workflow-pypi-release.result == 'success' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      # Intentionally a composite action, not a reusable workflow: PyPI trusted
+      # publishing checks the OIDC token's workflow_ref, which only matches this
+      # repo's own workflow file when the publish step runs as a step here rather
+      # than as a job in a called `uses:` workflow (job_workflow_ref is unsupported
+      # by PyPI - see MiraGeoscience/CI-tools DEVOPS-1154 and pypi/warehouse#11096).
+      - name: Publish package to PyPI
+        uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-publish_to_pypi@DEVOPS-1154
+        with:
+          source: release
+          release-tag: ${{ github.event.release.tag_name || github.event.inputs.release-tag }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          repository-url: https://upload.pypi.org/legacy/

.github/workflows/security_scan.yml

@@ -32,7 +32,7 @@ jobs:
       security-events: write
       contents: read
       actions: read
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@DEVOPS-1154
 
   call-workflow-zizmor-advanced-security:
     name: Zizmor analysis (annotate)
@@ -42,4 +42,4 @@ jobs:
       checks: write
       contents: read
       actions: read
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@DEVOPS-1154