DEVOPS-1154: address warnings upon publishing Python packages from GitHub

.github/workflows/issue_to_jira.yml

@@ -9,7 +9,7 @@ permissions: {}
 jobs:
   call-workflow-create-jira-issue:
     if: startsWith(github.repository, 'MiraGeoscience/')  # run on the Mira repo only
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@DEVOPS-1154
     permissions:
       contents: read
       issues: write

.github/workflows/pr_jira_actions.yml

@@ -7,7 +7,7 @@ on:
 jobs:
   call-workflow-pr_jira_actions:
     if: github.event.action != 'edited' || github.event.changes.title != null
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@DEVOPS-1154
     permissions:
       contents: read
       pull-requests: write

.github/workflows/python_deploy_dev.yml

@@ -14,7 +14,7 @@
 jobs:
   call-workflow-conda-publish:
     name: Publish development conda package on JFrog Artifactory
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@DEVOPS-1154
     permissions:
       contents: write
     with:
@@ -29,7 +29,7 @@
       JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
   call-workflow-pypi-publish:
     name: Publish development pypi package (JFrog Artifactory, TestPyPI)
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@DEVOPS-1154
     permissions:
       contents: write
     with:
@@ -41,4 +41,25 @@
     secrets:
       JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }}
       JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
-      PYPI_TOKEN: ${{ secrets.TEST_PYPI_TOKEN }}
+  publish-pypi-package:
+    name: Publish development Python package to TestPyPI
+    needs: call-workflow-pypi-publish
+    if: ${{ needs.call-workflow-pypi-publish.result == 'success' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Download build artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: mira-simpeg-pip-package-build
+          path: dist-download
+      # Must run as a direct step here, not nested in a reusable workflow or composite
+      # action: PyPI trusted publishing does not support job_workflow_ref (see
+      # pypi/warehouse#11096). Full rationale in DEVOPS-1154.
+      - name: Publish package to TestPyPI
+        uses: pypa/gh-action-pypi-publish@v1.14.1
+        with:
+          packages-dir: dist-download/
+          repository-url: https://test.pypi.org/legacy/

.github/workflows/python_deploy_prod.yml

@@ -29,7 +29,7 @@
   call-workflow-conda-release:
     name: Publish production Conda package on JFrog Artifactory
     if: ${{ github.event_name == 'release' || github.event.inputs.publish-conda == 'true' }}
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@DEVOPS-1154
     permissions:
       contents: write
     with:
@@ -39,9 +39,9 @@
       JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }}
       JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
   call-workflow-pypi-release:
-    name: Publish production PyPI package (JFrog Artifactory, PyPI)
+    name: Publish production PyPI package (JFrog Artifactory)
     if: ${{ github.event_name == 'release' || github.event.inputs.publish-pypi == 'true' }}
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@DEVOPS-1154
     permissions:
       contents: write
     with:
@@ -51,4 +51,25 @@
     secrets:
       JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }}
       JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
-      PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
+  publish-pypi-release:
+    name: Publish production Python package to PyPI
+    needs: call-workflow-pypi-release
+    if: ${{ (github.event_name == 'release' || github.event.inputs.publish-pypi == 'true') && needs.call-workflow-pypi-release.result == 'success' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Download release assets
+        uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-download_dist_release@DEVOPS-1154
+        with:
+          release-tag: ${{ github.event.release.tag_name || github.event.inputs.release-tag }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+      # Must run as a direct step here, not nested in a reusable workflow or composite
+      # action: PyPI trusted publishing does not support job_workflow_ref (see
+      # pypi/warehouse#11096). Full rationale in DEVOPS-1154.
+      - name: Publish package to PyPI
+        uses: pypa/gh-action-pypi-publish@v1.14.1
+        with:
+          packages-dir: dist-download/
+          repository-url: https://upload.pypi.org/legacy/

.github/workflows/security_scan.yml

@@ -32,7 +32,7 @@ jobs:
       security-events: write
       contents: read
       actions: read
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@DEVOPS-1154
 
   call-workflow-zizmor-advanced-security:
     name: Zizmor analysis (annotate)
@@ -42,4 +42,4 @@ jobs:
       checks: write
       contents: read
       actions: read
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@DEVOPS-1154