fix: add latest release CI script

.github/workflows/release.yml

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: © 2025 open-nudge <https://github.com/open-nudge>
+# SPDX-FileCopyrightText: © 2025, 2026 open-nudge <https://github.com/open-nudge>
 # SPDX-FileContributor: szymonmaszke <github@maszke.co>
 #
 # SPDX-License-Identifier: Apache-2.0
@@ -11,6 +11,7 @@ on:
     types:
       - "published"
 
+# enq: the only way to set permissions to none in GH Actions
 permissions: {} # yamllint disable-line rule:braces
 
 # post runs on release changelog action
@@ -27,44 +28,55 @@ jobs:
   sboms:
     name: "SBOMs"
     permissions:
-      id-token: "write"
-      attestations: "write"
+      actions: "read" # https://github.com/github/codeql-action/issues/2117
+      security-events: "write" # Needed to upload SARIF file to security tab
+      id-token: "write" # Needed to get GH Token to attest
+      attestations: "write" # Needed to upload attestation
       contents: "read"
+    # enq: hash with name and version always longer than 80 chars
     # yamllint disable rule:line-length
+    # enq: unpinned as it allows projects to use the latest
     uses: "open-nudge/opentemplate/.github/workflows/release-sboms-reusable.yml@main" # zizmor: ignore[unpinned-uses]
     # yamllint enable rule:line-length
+    with:
+      upload-grype-artifact: true
+      upload-grype-sarif: true
 
   sarifs:
     name: "SARIFs"
     permissions:
-      # Required to upload SARIF file to CodeQL.
-      # See: https://github.com/github/codeql-action/issues/2117
-      actions: "read"
-      # Writing security events to upload SARIF file to security tab
-      security-events: "write"
-      # Only need to read contents
+      actions: "read" # https://github.com/github/codeql-action/issues/2117
+      security-events: "write" # Needed to upload SARIF file to security tab
       contents: "read"
+    # enq: hash with name and version always longer than 80 chars
     # yamllint disable rule:line-length
+    # enq: unpinned as it allows projects to use the latest
     uses: "open-nudge/opentemplate/.github/workflows/release-sarifs-reusable.yml@main" # zizmor: ignore[unpinned-uses]
     # yamllint enable rule:line-length
 
   tests:
     name: "Tests"
     permissions:
       contents: "read"
+    # enq: hash with name and version always longer than 80 chars
     # yamllint disable rule:line-length
+    # enq: unpinned as it allows projects to use the latest
     uses: "open-nudge/opentemplate/.github/workflows/tests-reusable.yml@main" # zizmor: ignore[unpinned-uses]
+    # yamllint enable rule:line-length
 
   docs:
     name: "Docs"
     permissions:
-      contents: "write"
+      contents: "write" # Needed to write documentation to gh-pages directly
+    # enq: hash with name and version always longer than 80 chars
     # yamllint disable rule:line-length
+    # enq: unpinned as it allows projects to use the latest
     uses: "open-nudge/opentemplate/.github/workflows/run-reusable.yml@main" # zizmor: ignore[unpinned-uses]
     # yamllint enable rule:line-length
     with:
       # Double checkout used to refresh the content of generated docs, which
       # happens on some linux distributions at least.
+      # enq: long command, splitting is unreadable
       # yamllint disable rule:line-length
       command: |
         export TAG="$(echo ${{ github.event.release.tag_name }} | cut -d. -f1,2)"
@@ -89,7 +101,9 @@ jobs:
     name: "Package Create"
     permissions:
       contents: "read"
+    # enq: hash with name and version always longer than 80 chars
     # yamllint disable rule:line-length
+    # enq: unpinned as it allows projects to use the latest
     uses: "open-nudge/opentemplate/.github/workflows/run-reusable.yml@main" # zizmor: ignore[unpinned-uses]
     # yamllint enable rule:line-length
     with:
@@ -109,17 +123,20 @@ jobs:
       - "package-create"
     permissions:
       contents: "read"
-      pull-requests: "read"
+      pull-requests: "read" # Needed to read PR metadata during changelog gen
+    # enq: hash with name and version always longer than 80 chars
     # yamllint disable rule:line-length
+    # enq: unpinned as it allows projects to use the latest
     uses: "open-nudge/opentemplate/.github/workflows/run-reusable.yml@main" # zizmor: ignore[unpinned-uses]
     # yamllint enable rule:line-length
     with:
       download: true
       download-name: "dist-${{ github.sha }}"
+      # enq: long command, splitting is unreadable
       # yamllint disable rule:line-length
       command: |
         mkdir -p CHANGELOGS-${{ github.sha }}
-        export PYTHON_PACKAGE_VERSION="$(echo dist-${{ github.sha }}/dist/*.tar.gz | cut -d '-' -f 2 | cut -d '.' -f 1-3)"
+        export PYTHON_PACKAGE_VERSION=$(basename dist-${{ github.sha }}/dist/*.tar.gz | cut -d '-' -f 2)
         pdm run changelog > CHANGELOGS-${{ github.sha }}/CHANGELOG-${{ github.sha }}.md
         pdm run changelog-latest > CHANGELOGS-${{ github.sha }}/LATEST.md
       # yamllint enable rule:line-length
@@ -139,7 +156,7 @@ jobs:
       - "package-create"
       - "changelog"
     permissions:
-      id-token: "write" # To sign the provenance.
+      id-token: "write" # Needed to sign the provenance
     runs-on: "ubuntu-latest"
     timeout-minutes: 30
     strategy:
@@ -174,24 +191,28 @@ jobs:
     # https://github.com/pypi/warehouse/issues/11096
     steps:
       - name: "Harden Runner"
+        # enq: hash with name and version always longer than 80 chars
         # yamllint disable rule:line-length
-        uses: "step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0" # v2.12.0
+        uses: "step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594" # v2.16.0
         # yamllint enable rule:line-length
         with:
           disable-sudo: true
           egress-policy: "block"
           allowed-endpoints: "${{ matrix.repository.endpoints }}"
       - name: "Download artifacts"
+        # enq: hash with name and version always longer than 80 chars
         # yamllint disable rule:line-length
         uses: "actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093" # v4.3.0
+        # yamllint enable rule:line-length
         with:
           name: "dist-${{ github.sha }}"
           path: "dist"
       - name: "Upload python package"
         if: >
           ! matrix.repository.skip
+        # enq: hash with name and version always longer than 80 chars
         # yamllint disable rule:line-length
-        uses: "pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc" # v1.12.4
+        uses: "pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e" # v1.13.0
         # yamllint enable rule:line-length
         with:
           repository-url: "${{ matrix.repository.url }}"
@@ -200,6 +221,7 @@ jobs:
           print-hash: true
           skip-existing: true
       - name: "Rename artifacts"
+        # enq: complex script, indentation rules would make it unreadable
         # yamllint disable rule:indentation
         run: |
           # Add GITHUB_SHA to artifacts before the first dot
@@ -214,6 +236,7 @@ jobs:
           done
         # yamllint enable rule:indentation
       - name: "Upload artifacts"
+        # enq: hash with name and version always longer than 80 chars
         # yamllint disable rule:line-length
         uses: "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02" # v4.6.2
         # yamllint enable rule:line-length
@@ -231,12 +254,12 @@ jobs:
     if: >
       github.event.repository.visibility == 'public'
     permissions:
-      # Required to upload SARIF file to CodeQL.
-      # See: https://github.com/github/codeql-action/issues/2117
-      actions: "read"
-      contents: "write"
-      id-token: "write" # To sign the provenance.
+      actions: "read" # https://github.com/github/codeql-action/issues/2117
+      contents: "write" # Needed to upload SARIF file to CodeQL
+      id-token: "write" # Needed to sign the provenance
+    # enq: hash with name and version always longer than 80 chars
     # yamllint disable rule:line-length
+    # enq: unpinned as it allows projects to use the latest
     uses: "open-nudge/opentemplate/.github/workflows/release-slsa-provenance-reusable.yml@main" # zizmor: ignore[unpinned-uses]
     # yamllint enable rule:line-length
     with:
@@ -247,8 +270,10 @@ jobs:
     needs:
       - "slsa-provenance"
     permissions:
-      contents: "write"
+      contents: "write" # Needed to push to the release
+    # enq: hash with name and version always longer than 80 chars
     # yamllint disable rule:line-length
+    # enq: unpinned as it allows projects to use the latest
     uses: "open-nudge/opentemplate/.github/workflows/release-upload.yml@main" # zizmor: ignore[unpinned-uses]
     # yamllint enable rule:line-length
     with: