* resolve workflow vulnerabilities
* Set persist-credentials: false on checkouts before untrusted steps.
Prevents GITHUB_TOKEN from being written to git config before pip/pytest
in CI and before build steps in release. add-tag checkout keeps default
credentials for GitHub release creation.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* refacotr to the manual release workflow
* add tag after all of the python package published
* simplify input var reference
* add type to input var
* add type to input var
* add type to input var
We need to give Natali a name for the action so I went ahead and already created the file with the name that she will use when creating the TRusted Provider.
