ci: publish to PyPI from a single workflow (#1201)

Beta and stable releases are published to PyPI from different workflows
(`manual_release_beta.yaml` and `manual_release_stable.yaml`), so PyPI
shows a "Change of provenance" warning on every stable release that
follows a beta. All publishing now happens in a new
`publish_to_pypi.yaml`, which both release workflows dispatch with
`apify/actions/execute-workflow`. Crawlee JS runs `publish-to-npm.yml`
the same way.

Before merging, add a PyPI trusted publisher for `apify-client` with
workflow `publish_to_pypi.yaml` and environment `pypi`. Remove the old
ones once the first release goes through.

Relates to: apify/crawlee-python#2382

*✍️ Drafted by Claude Code*

Author: vdusek

.github/workflows/manual_release_beta.yaml

@@ -3,9 +3,6 @@ name: Beta release
 on:
   # Runs when manually triggered from the GitHub UI, or dispatched from `on_master.yaml`
   # via the `apify/actions/execute-workflow` action for the automatic beta release on push to master.
-  # Note: This workflow is intentionally NOT a reusable workflow (no `workflow_call`) because PyPI's
-  # Trusted Publishing does not currently support reusable workflows.
-  # See: https://docs.pypi.org/trusted-publishers/troubleshooting/#reusable-workflows-on-github
   workflow_dispatch:
 
 concurrency:
@@ -55,39 +52,24 @@ jobs:
       changelog: ${{ needs.release_prepare.outputs.changelog }}
     secrets: inherit
 
+  # Publishing runs as a separate workflow run of `publish_to_pypi.yaml` (see the comment there).
   pypi_publish:
     name: PyPI publish
     needs: [release_prepare, changelog_update]
     runs-on: ubuntu-latest
     permissions:
-      contents: write
-      id-token: write # Required for OIDC authentication.
-    environment:
-      name: pypi
-      url: https://pypi.org/project/apify-client
+      actions: write # Required by execute-workflow.
     steps:
-      - name: Prepare distribution
-        uses: apify/actions/prepare-pypi-distribution@v1.6.2
-        with:
-          package_name: apify-client
-          is_prerelease: "yes"
-          version_number: ${{ needs.release_prepare.outputs.version_number }}
-          ref: ${{ needs.changelog_update.outputs.changelog_commitish }}
-
-      - name: Verify built package
-        uses: apify/actions/python-package-check@v1.6.2
+      - name: Dispatch PyPI publish workflow
+        uses: apify/actions/execute-workflow@v1.6.2
         with:
-          package_name: apify_client
-          dist_dir: dist
-          python_version: "3.14"
-          smoke_code: |
-            from apify_client import ApifyClient, ApifyClientAsync
-            ApifyClient(token='x')
-            ApifyClientAsync(token='x')
-
-      # Publish the package to PyPI using PyPA official GitHub action with OIDC authentication.
-      - name: Publish package to PyPI
-        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # release/v1
+          workflow: publish_to_pypi.yaml
+          inputs: >
+            {
+              "version_number": "${{ needs.release_prepare.outputs.version_number }}",
+              "ref": "${{ needs.changelog_update.outputs.changelog_commitish }}",
+              "is_prerelease": "true"
+            }
 
   doc_release_post_publish:
     name: Doc release post publish

.github/workflows/manual_release_stable.yaml

@@ -88,39 +88,24 @@ jobs:
           target_commitish: ${{ needs.changelog_update.outputs.changelog_commitish }}
           body: ${{ needs.release_prepare.outputs.release_notes }}
 
+  # Publishing runs as a separate workflow run of `publish_to_pypi.yaml` (see the comment there).
   pypi_publish:
     name: PyPI publish
     needs: [release_prepare, changelog_update]
     runs-on: ubuntu-latest
     permissions:
-      contents: write
-      id-token: write # Required for OIDC authentication.
-    environment:
-      name: pypi
-      url: https://pypi.org/project/apify-client
+      actions: write # Required by execute-workflow.
     steps:
-      - name: Prepare distribution
-        uses: apify/actions/prepare-pypi-distribution@v1.6.2
-        with:
-          package_name: apify-client
-          is_prerelease: ""
-          version_number: ${{ needs.release_prepare.outputs.version_number }}
-          ref: ${{ needs.changelog_update.outputs.changelog_commitish }}
-
-      - name: Verify built package
-        uses: apify/actions/python-package-check@v1.6.2
+      - name: Dispatch PyPI publish workflow
+        uses: apify/actions/execute-workflow@v1.6.2
         with:
-          package_name: apify_client
-          dist_dir: dist
-          python_version: "3.14"
-          smoke_code: |
-            from apify_client import ApifyClient, ApifyClientAsync
-            ApifyClient(token='x')
-            ApifyClientAsync(token='x')
-
-      # Publish the package to PyPI using PyPA official GitHub action with OIDC authentication.
-      - name: Publish package to PyPI
-        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # release/v1
+          workflow: publish_to_pypi.yaml
+          inputs: >
+            {
+              "version_number": "${{ needs.release_prepare.outputs.version_number }}",
+              "ref": "${{ needs.changelog_update.outputs.changelog_commitish }}",
+              "is_prerelease": "false"
+            }
 
   version_docs:
     name: Version docs

.github/workflows/on_master.yaml

@@ -43,9 +43,6 @@ jobs:
     uses: ./.github/workflows/manual_release_docs.yaml
     secrets: inherit
 
-  # The beta release is dispatched as a separate workflow run (instead of calling `manual_release_beta.yaml` via `uses:`)
-  # because PyPI's Trusted Publishing does not currently support reusable workflows.
-  # See: https://docs.pypi.org/trusted-publishers/troubleshooting/#reusable-workflows-on-github
   beta_release:
     # Only on push, and only for "feat", "fix", "perf", "refactor" and "style" commits.
     if: >-

.github/workflows/publish_to_pypi.yaml

@@ -0,0 +1,64 @@
+name: Publish to PyPI
+
+on:
+  # Dispatched from `manual_release_beta.yaml` and `manual_release_stable.yaml` via the `apify/actions/execute-workflow`
+  # action. All releases are published from this single workflow, which is the one registered as the PyPI Trusted
+  # Publisher, so PyPI attests the same provenance for beta and stable releases. It is a standalone workflow, not
+  # a reusable one, because PyPI's Trusted Publishing does not currently support reusable workflows.
+  # See: https://docs.pypi.org/trusted-publishers/troubleshooting/#reusable-workflows-on-github
+  workflow_dispatch:
+    inputs:
+      version_number:
+        description: Version to publish (for a prerelease, the base version the beta number is appended to)
+        required: true
+        type: string
+      ref:
+        description: Git ref to build the package from (branch, tag, or commit SHA)
+        required: true
+        type: string
+      is_prerelease:
+        description: Whether to publish a beta prerelease
+        required: false
+        type: boolean
+        default: false
+
+concurrency:
+  group: publish-to-pypi
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  pypi_publish:
+    name: PyPI publish
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # Required for OIDC authentication.
+    environment:
+      name: pypi
+      url: https://pypi.org/project/apify-client
+    steps:
+      - name: Prepare distribution
+        uses: apify/actions/prepare-pypi-distribution@v1.6.2
+        with:
+          package_name: apify-client
+          is_prerelease: ${{ inputs.is_prerelease && 'yes' || '' }}
+          version_number: ${{ inputs.version_number }}
+          ref: ${{ inputs.ref }}
+
+      - name: Verify built package
+        uses: apify/actions/python-package-check@v1.6.2
+        with:
+          package_name: apify_client
+          dist_dir: dist
+          python_version: "3.14"
+          smoke_code: |
+            from apify_client import ApifyClient, ApifyClientAsync
+            ApifyClient(token='x')
+            ApifyClientAsync(token='x')
+
+      # Publish the package to PyPI using PyPA official GitHub action with OIDC authentication.
+      - name: Publish package to PyPI
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # release/v1