feat: make release flow reusable

Fixes #984

Author: nijel

.github/workflows/release-shared.yml

@@ -0,0 +1,40 @@
+name: Release
+
+on:
+  workflow_call:
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+    - uses: actions/checkout@v4
+    - uses: astral-sh/setup-uv@v5
+
+    - name: Verify tag is documented
+      if: github_event_name == 'release'
+      run: |
+        CURRENT_TAG=${GITHUB_REF#refs/tags/}
+        CURRENT_VERSION=$(sed -n 's/version = "\(.*\)"/\1/p'  pyproject.toml)
+        if [ "${CURRENT_VERSION}" != "${CURRENT_TAG}" ]; then
+            echo "========================================================================"
+            echo "Error: tag '${CURRENT_TAG}' and version '${CURRENT_VERSION}' don't match"
+            echo "========================================================================"
+            exit 1;
+        fi
+
+    - run: uv build
+
+    - uses: actions/upload-artifact@v4
+      if: github_event_name == 'release'
+      with:
+        name: dist
+        path: |
+          dist/*.tar.gz
+          dist/*.whl
+
+    - run: uvx twine check dist/*
+
+    - if: github_event_name == 'release'
+      run: uv publish --trusted-publishing always

.github/workflows/release.yml

@@ -7,44 +7,9 @@ on:
   pull_request:
 
 jobs:
-  release:
-    runs-on: ubuntu-latest
+  pre-commit:
+    uses: ./.github/workflows/pre-commit-shared.yml
+    with:
+      github_event_name: ${{ github.event_name }
     permissions:
       id-token: write
-    steps:
-    - uses: actions/checkout@v4
-    - uses: astral-sh/setup-uv@v5
-
-    - name: Verify tag is documented
-      if: github.event_name == 'release'
-      run: |
-        CURRENT_TAG=${GITHUB_REF#refs/tags/}
-        CURRENT_VERSION=$(sed -n 's/version = "\(.*\)"/\1/p'  pyproject.toml)
-        if [ "${CURRENT_VERSION}" != "${CURRENT_TAG}" ]; then
-            echo "========================================================================"
-            echo "Error: tag '${CURRENT_TAG}' and version '${CURRENT_VERSION}' don't match"
-            echo "========================================================================"
-            exit 1;
-        fi
-
-    - name: Build dist
-      run: uv build
-
-    - name: Archive dist
-      if: github.event_name == 'release'
-      uses: actions/upload-artifact@v4
-      with:
-        name: dist
-        path: |
-          dist/*.tar.gz
-          dist/*.whl
-
-    - name: Verify long description rendering
-      run: uvx twine check dist/*
-
-    - name: Publish
-      env:
-        # TODO: remove once trusted publishing is configured
-        UV_PUBLISH_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
-      if: github.event_name == 'release' && github.repository == 'python-social-auth/social-core'
-      run: uv publish