split publish.yaml in tag-release.yaml

.github/workflows/prepare-release-pr.yaml

@@ -1,4 +1,4 @@
-name: prepare release pr
+name: Prepare release PR
 
 on:
   workflow_dispatch:

.github/workflows/publish.yaml

@@ -2,17 +2,15 @@ name: Publish
 
 on:
   push:
-    branches:
-      - main
     tags:
       - '*'
-  pull_request:
+  workflow_run:
+    workflows: ["Tag release"]
     types:
-      - closed
+      - completed
   release:
     types:
       - published
-  workflow_dispatch:
 
 permissions:
   contents: read
@@ -34,51 +32,27 @@ jobs:
 
       - uses: hynek/build-and-inspect-python-package@v2
 
-  tag:
-    name: Tag a new release
-    # tag a release when a release PR was accepted
-    if: |
-      github.repository == 'Diaoul/subliminal'
-      && github.event_name == 'pull_request'
-      && github.event.action == 'closed'
-      && github.event.pull_request.merged == true
-      && startsWith(github.head_ref, 'release-')
-    needs: [build-package]
-    env:
-      GITHUB_HEAD_REF: ${{ github.head_ref }}
-    runs-on: ubuntu-latest
-    permissions:
-      id-token: write
-      contents: write
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Tag the commit
-        run: |
-          RELEASE_VERSION=${GITHUB_HEAD_REF#release-}
-          echo Release version: $RELEASE_VERSION
-          git config user.name 'subliminal bot'
-          git config user.email diaoulael@gmail.com
-          git tag --annotate --message="Release version $RELEASE_VERSION" $RELEASE_VERSION ${{ github.sha }}
-          git push origin $RELEASE_VERSION
-
   github-release:
     name: Make a GitHub Release
     needs: [build-package]
-    # publish a Github release on push tag
+    # only publish a Github release on push tag
     if: |
       github.repository == 'Diaoul/subliminal'
-      && startsWith(github.ref, 'refs/tags/')
+      && (
+        (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
+        || github.event_name == 'workflow_run'
+      )
     runs-on: ubuntu-latest
 
     permissions:
-      contents: write  # IMPORTANT: mandatory for making GitHub Releases
+      # IMPORTANT: mandatory for making GitHub Releases
+      contents: write
 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Download packages built by build-and-inspect-python-package
         uses: actions/download-artifact@v4
@@ -90,7 +64,6 @@ jobs:
         uses: softprops/action-gh-release@v2
         with:
           files: dist/*
-          tag_name: ${{ github.event.inputs.version }}
           generate_release_notes: true
           draft: true
 
@@ -103,7 +76,11 @@ jobs:
     permissions:
       id-token: write
     runs-on: ubuntu-latest
-    if: github.repository == 'Diaoul/subliminal' && github.event.action == 'published'  # only publish to PyPI on Github release published
+    # only publish to PyPI on Github release published
+    if: |
+      github.repository == 'Diaoul/subliminal'
+      && github.event_name == 'release'
+      && github.event.action == 'published'
     steps:
       - name: Download packages built by build-and-inspect-python-package
         uses: actions/download-artifact@v4

.github/workflows/tag-release.yaml

@@ -0,0 +1,62 @@
+name: Tag release
+
+on:
+  pull_request:
+    types:
+      - closed
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Release tag version.'
+        type: string
+        default: NONE
+        required: true
+
+permissions:
+  contents: read
+  id-token: write
+
+env:
+  FORCE_COLOR: "1"
+
+# https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/
+jobs:
+  # Always build & lint package.
+  build-package:
+    name: Build & verify package
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: hynek/build-and-inspect-python-package@v2
+
+  tag:
+    name: Tag a new release
+    # tag a release after a release PR was accepted
+    if: |
+      github.event_name == 'pull_request'
+      && github.event.action == 'closed'
+      && github.event.pull_request.merged == true
+      && startsWith(github.head_ref, 'release-')
+    needs: [build-package]
+    env:
+      GITHUB_HEAD_REF: ${{ github.head_ref }}
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Tag the commit
+        run: |
+          RELEASE_VERSION=${GITHUB_HEAD_REF#release-}
+          echo Release version: $RELEASE_VERSION
+          git config user.name 'subliminal bot'
+          git config user.email diaoulael@gmail.com
+          git tag --annotate --message="Release version $RELEASE_VERSION" $RELEASE_VERSION ${{ github.sha }}
+          git push origin $RELEASE_VERSION

RELEASING.md

@@ -83,8 +83,11 @@ Both automatic and manual processes described above follow the same steps from t
 
 * After all tests pass and the PR has been approved, merge the PR.
   Merging the PR will trigger the
-  [publish workflow](https://github.com/pytest-dev/pytest/actions/workflows/publish.yaml),
+  [tag-release workflow](https://github.com/Diaoul/subliminal/actions/workflows/tag-release.yaml), that will add a release tag.
+
+  This new tag will then trigger the
+  [publish workflow](https://github.com/Diaoul/subliminal/actions/workflows/publish.yaml),
   using the ``release-MAJOR.MINOR.PATCH`` branch as source.
 
-  This job will tag the new version and publish a draft for a Github release.
+  This job will publish a draft for a Github release.
   When the Github release draft is published, the same workflow will publish to PyPI.