CI: remove dead upload_pypi job from reusable workflow, rename to lib-build.yml

[nikagra]

Summary

Closes #824. Follow-up to #820, addressing @Lorak-mmk's review concern.

The upload_pypi job in lib-build-and-push.yml was never reachable: none of the four caller workflows pass upload: true. build-push.yml and publish-manually.yml already publish from their own separate jobs — this is required by how PyPI Trusted Publishing works: the OIDC token embeds the caller workflow path, so the pypa/gh-action-pypi-publish action must run in the caller, not inside a reusable workflow (see pypa/gh-action-pypi-publish#166).

Because the reusable workflow declared permissions: id-token: write for upload_pypi, GitHub's static permission validation (which runs before evaluating any if: conditions) forced build-test.yml — a pull_request workflow, where id-token defaults to none — to also declare id-token: write. This granted unnecessary privileges to a job that only builds wheels.

Changes

Commit 1: remove dead upload_pypi job, rename to lib-build.yml

• Rename lib-build-and-push.yml → lib-build.yml (it only builds now)
• Remove upload input and upload_pypi job from the reusable workflow
• Remove permissions: id-token: write and with: upload: false from build-test.yml — no longer needed, principle of least privilege restored
• Update all callers (build-push.yml, publish-manually.yml, build-pre-release.yml) to reference the new workflow path and drop the now-nonexistent upload: false from with: blocks
• Replace TODO comments in build-push.yml and publish-manually.yml: the separate publish job is now intentional design, not a temporary workaround pending an upstream fix

Commit 2: remove ineffective GITHUB_WORKFLOW_REF override

GITHUB_WORKFLOW_REF was set as a shell env var prefix on the cibuildwheel invocations, introduced in #439 as a workaround for the same issue #166. It does not work for two reasons:

1. GITHUB_WORKFLOW_REF is set by GitHub's runner infrastructure to populate the OIDC token — overriding it in a child process's environment has no effect on the token GitHub's servers mint.
2. The OIDC token is minted when pypa/gh-action-pypi-publish runs (in the publish job), not when cibuildwheel runs (in build-wheels). The variable was being set in the wrong job entirely.

The actual working workaround is already in place: pypa/gh-action-pypi-publish runs directly in the caller workflows (build-push.yml, publish-manually.yml). This variable override was dead code with no effect.

Result

	Before	After
build-test.yml permissions	id-token: write (unnecessary)	none (default, minimal)
lib-build-and-push.yml upload_pypi job	Present but never runs	Removed
Publish responsibility	Dead code in reusable + real publish in callers	Real publish in callers only
GITHUB_WORKFLOW_REF env var	Set in cibuildwheel steps (no effect)	Removed

[Copilot]

Pull request overview

This PR simplifies the CI packaging setup by removing an unreachable PyPI upload job from the reusable workflow, renaming it to reflect its build-only role, and restoring least-privilege permissions for PR builds.

Changes:

• Renamed the reusable workflow to .github/workflows/lib-build.yml and removed the dead upload_pypi job + upload input.
• Updated all caller workflows to reference the new reusable workflow path and removed now-invalid with: upload: false.
• Removed an ineffective GITHUB_WORKFLOW_REF override from wheel build steps and dropped unnecessary id-token: write permissions from the PR build workflow.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/lib-build.yml	Removes upload logic/permissions from the reusable workflow and keeps only build artifacts (wheels + sdist).
.github/workflows/build-test.yml	Stops requesting id-token: write and switches to the renamed reusable build workflow.
.github/workflows/build-push.yml	Updates caller to use lib-build.yml and documents why publishing remains caller-side.
.github/workflows/publish-manually.yml	Updates caller to use lib-build.yml and documents caller-side publishing requirement for OIDC.
.github/workflows/build-pre-release.yml	Updates caller to reference the renamed reusable build workflow.

Comments suppressed due to low confidence (1)

.github/workflows/lib-build.yml:1

• The reusable workflow name says "Build wheels", but this workflow also builds and uploads the source distribution artifact (job build-sdist). Consider renaming the workflow to reflect both outputs (e.g., wheels + sdist) to avoid confusion when reading GitHub Actions runs or searching logs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.