ci: Hardening

.github/workflows/build.yaml

@@ -4,9 +4,6 @@ on:
   push:
     branches:
       - main
-      - v*
-    tags:
-      - v*
 
   pull_request:
 
@@ -15,16 +12,19 @@ on:
       - trigger_build
 
   workflow_dispatch:
+  workflow_call:
 
   schedule:
     - cron: '0 0 * * 1'
 
+permissions:
+  contents: read
+
 concurrency:
-  group: build-${{ github.event.pull_request.number || github.ref }}
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 jobs:
-
   # build natively on desktop
   desktop:
     strategy:
@@ -212,32 +212,3 @@ jobs:
           ndk: ${{ matrix.ndk }}
           cmake: ${{ matrix.cmake }}
           script: ./scripts/android/run_instrumented_tests.sh
-
-  release:
-    needs: [desktop, android-linux, android-osx]
-    if: |
-      github.repository_owner == 'roc-streaming' &&
-      github.event_name == 'push' &&
-      startsWith(github.ref, 'refs/tags/v')
-
-    name: publish
-    runs-on: ubuntu-24.04
-
-    env:
-      OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
-      OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
-      SIGNING_KEY_ID: ${{ secrets.SIGNING_KEY_ID }}
-      SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
-      SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Choose roc-toolkit revision
-        run: echo ROC_REVISION=$(scripts/roc_revision.py) >> $GITHUB_ENV
-
-      - name: Publish
-        run: scripts/android_docker.sh publish

.github/workflows/release.yml

@@ -0,0 +1,41 @@
+name: "release"
+
+on:
+  push:
+    tags:
+      - v*
+
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: ${{ github.workflow }}{{ github.event.pull_request.number || github.ref }}
+
+jobs:
+  build:
+    uses: ./.github/workflows/build.yml
+
+  release:
+    needs: [build]
+
+    runs-on: ubuntu-24.04
+    env:
+      OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+      OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+      SIGNING_KEY_ID: ${{ secrets.SIGNING_KEY_ID }}
+      SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
+      SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Choose roc-toolkit revision
+        run: echo ROC_REVISION=$(scripts/roc_revision.py) >> $GITHUB_ENV
+
+      - name: Publish
+        run: scripts/android_docker.sh publish