Apply suggestions from code reviews

Author: lucianopaz

.github/workflows/pypi.yml

@@ -3,7 +3,6 @@ on:
   push:
     branches:
       - main
-      - auto-release
   pull_request:
     branches: [main]
   release:
@@ -16,14 +15,28 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.sha }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   check_changes:
     runs-on: ubuntu-latest
     outputs:
-      should_run: ${{ steps.filter.outputs.any_changed }}
+      should_run: |
+        if [[ "${{ github.event_name == 'release' || 
+              (
+                github.ref == 'refs/heads/main' || 
+                github.event_name == 'pull_request' 
+              ) && steps.filter.outputs.any_changed == 'true' 
+            }}" == "true" ]]; then
+          echo "true"
+        else
+          echo "false"
+        fi
     steps:
       - uses: actions/checkout@v4
-      - uses: dorny/paths-filter@v2
+        with:
+          persist-credentials: false
+      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36  # v3.0.2
         id: filter
         with:
           filters: |
@@ -39,12 +52,9 @@ jobs:
   make_sdist:
     name: Make SDist
     needs: check_changes
-    # Run if it's a release, auto-release branch, or if relevant files changed on main
+    # Run if it's a release or if relevant files changed on main
     if: |
-      github.event_name == 'release' || 
-      github.ref == 'refs/heads/auto-release' || 
-      (github.ref == 'refs/heads/main' && needs.check_changes.outputs.should_run == 'true') ||
-      (github.event_name == 'pull_request' && needs.check_changes.outputs.should_run == 'true')
+      needs.check_changes.outputs.should_run == 'true'
     runs-on: ubuntu-latest
     permissions:
       # write id-token and attestations are required to attest build provenance
@@ -75,12 +85,9 @@ jobs:
   run_checks:
     name: Build & inspect our package.
     needs: check_changes
-    # Run if it's a release, auto-release branch, or if relevant files changed on main
+    # Run if it's a release or if relevant files changed on main
     if: |
-      github.event_name == 'release' || 
-      github.ref == 'refs/heads/auto-release' || 
-      (github.ref == 'refs/heads/main' && needs.check_changes.outputs.should_run == 'true') ||
-      (github.event_name == 'pull_request' && needs.check_changes.outputs.should_run == 'true')
+      needs.check_changes.outputs.should_run == 'true'
     # Note: the resulting builds are not actually published.
     # This is purely for additional testing and diagnostic purposes.
     runs-on: ubuntu-latest
@@ -95,12 +102,9 @@ jobs:
   build_wheels:
     name: Build wheels for ${{ matrix.platform }}
     needs: check_changes
-    # Run if it's a release, auto-release branch, or if relevant files changed on main
+    # Run if it's a release or if relevant files changed on main
     if: |
-      github.event_name == 'release' || 
-      github.ref == 'refs/heads/auto-release' || 
-      (github.ref == 'refs/heads/main' && needs.check_changes.outputs.should_run == 'true') ||
-      (github.event_name == 'pull_request' && needs.check_changes.outputs.should_run == 'true')
+      needs.check_changes.outputs.should_run == 'true'
     runs-on: ${{ matrix.platform }}
     permissions:
       # write id-token and attestations are required to attest build provenance
@@ -136,12 +140,9 @@ jobs:
   build_universal_wheel:
     name: Build universal wheel for Pyodide
     needs: check_changes
-    # Run if it's a release, auto-release branch, or if relevant files changed on main
+    # Run if it's a release or if relevant files changed on main
     if: |
-      github.event_name == 'release' || 
-      github.ref == 'refs/heads/auto-release' || 
-      (github.ref == 'refs/heads/main' && needs.check_changes.outputs.should_run == 'true') ||
-      (github.event_name == 'pull_request' && needs.check_changes.outputs.should_run == 'true')
+      needs.check_changes.outputs.should_run == 'true'
     runs-on: ubuntu-latest
     permissions:
       # write id-token and attestations are required to attest build provenance
@@ -180,11 +181,6 @@ jobs:
   check_dist:
     name: Check dist
     needs: [check_changes, make_sdist, build_wheels]
-    if: |
-      github.event_name == 'release' || 
-      github.ref == 'refs/heads/auto-release' || 
-      (github.ref == 'refs/heads/main' && needs.check_changes.outputs.should_run == 'true') ||
-      (github.event_name == 'pull_request' && needs.check_changes.outputs.should_run == 'true')
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/download-artifact@v4