[CI] Fix: split release workflow

.github/workflows/CI.yml

@@ -2,50 +2,41 @@ name: CI
 
 on: [push]
 
-env:
-  PYTHON_SRC: "src"
-
 permissions:
   contents: read
   id-token: write
 
 jobs:
   python:
-    name: Python CI (${{ matrix.os }})
     uses: ./.github/workflows/python.yml
+    with:
+      os: ${{ matrix.os }}
+      target: ${{ matrix.target }}
+      python-version: ${{ matrix.python-version }}
+    name: Python CI (${{ matrix.os }})
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-20.04, macos-13]
         target: [x86_64]
-        python-version: ['3.8', '3.9', '3.10', '3.11']
+        python-version: ['3.8', '3.9', '3.10', '3.11']      
+
+  release:
+    needs: python
+    uses: ./.github/workflows/pypi_release.yml
     with:
       os: ${{ matrix.os }}
       target: ${{ matrix.target }}
       python-version: ${{ matrix.python-version }}
-
-  release:
-    name: Release for Python ${{ matrix.python-version }} (${{ matrix.target }}-${{ matrix.os }})
-    runs-on: ubuntu-latest
-    if: "startsWith(github.ref, 'refs/tags/')"
-    needs: python
+      package-version: ${{ needs.python.outputs.package-version }}
+    name: Release (${{ matrix.os }})
+    if: ${{ startsWith(github.ref, 'refs/tags/') && endsWith(github.ref, needs.python.outputs.package-version) }}
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-20.04, macos-13]
         target: [x86_64]
         python-version: ['3.8', '3.9', '3.10', '3.11']
-    environment:
-      name: release
-      url: https://pypi.org/p/intel-sgx-ra
-
-    steps:
-      - name: Download artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: ${{ matrix.os }}-${{ matrix.python-version }}-${{ matrix.target }}-wheels
-          path: dist
-
-      - name: Publish packages to PyPi
-        if: ${{ startsWith(github.ref, 'refs/tags') && endsWith(github.ref, steps.metadata.outputs.PACKAGE_VERSION) }}
-        uses: pypa/gh-action-pypi-publish@release/v1
+    permissions:
+      contents: read
+      id-token: write

.github/workflows/pypi_release.yml

@@ -0,0 +1,32 @@
+name: Release CI
+
+on:
+  workflow_call:
+    inputs:
+      os:
+        required: true
+        type: string
+      target:
+        required: true
+        type: string
+      python-version:
+        required: true
+        type: string
+
+jobs:
+  release:
+    name: Python ${{ inputs.python-version }} (${{ inputs.target }})
+    runs-on: ubuntu-latest
+    environment:
+      name: release
+      url: https://pypi.org/p/intel-sgx-ra
+
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: ${{ inputs.os }}-${{ inputs.python-version }}-${{ inputs.target }}-wheels
+          path: dist
+
+      - name: Publish packages to PyPi
+        uses: pypa/gh-action-pypi-publish@release/v1

.github/workflows/python.yml

@@ -12,6 +12,10 @@ on:
       python-version:
         required: true
         type: string
+    outputs:
+      package-version:
+        description: "Version of the Python package"
+        value: ${{ jobs.build.outputs.package-version }}
 
 env:
   PYTHON_SRC: "src"
@@ -20,9 +24,11 @@ permissions:
   contents: read
 
 jobs:
-  python:
+  build:
     name: Python ${{ inputs.python-version }} (${{ inputs.target }})
     runs-on: ${{ inputs.os }}
+    outputs:
+      package-version: ${{ steps.metadata.outputs.PACKAGE_VERSION }}
 
     steps:
       - name: Checkout