fix: removed workflows andset build-and-sign-container.yml to run after build-and-publish.yml completes

[ktstrader]

Summary

Restructures the release pipeline so that publishing is driven by GitHub (pre-)release events, chains the container build/sign step off the successful PyPI publish, and removes obsolete branch/merge automation.

Changes

Release pipeline (.github/workflows)

• build-and-publish.yml
  • Trigger changed from push: tags: v* / workflow_call to release: [published], so the pipeline runs when a GitHub (pre-)release is created.
  • Checkout and version-verification steps now read the tag from github.event.release.tag_name instead of inputs.tag/github.ref_name.
  • Added a containers job (needs: build) that invokes the container workflow via uses: ./.github/workflows/build-and-sign-container.yml, passing tag and prerelease, with secrets: inherit. This ensures the container build/sign only runs after the PyPI publish succeeds.
• build-and-sign-container.yml
  • Converted from a release-triggered workflow into a reusable workflow (on: workflow_call) that accepts tag (required) and prerelease (optional, default false) inputs.
  • All references to github.event.release.* replaced with inputs.*.
  • Removed the pypi environment from the image-push job (no longer needed here).
• Removed release-on-merge.yml and validate-branch.yml (obsolete automation).

Summary by CodeRabbit

• Release Process
  • Builds and publishes now start when a GitHub Release is published.
  • Release tags and prerelease status are passed automatically to container builds.
  • Container workflows support reusable tag and prerelease inputs.
• Removed Workflows
  • Removed automatic release creation after merges.
  • Removed pull request branch-name validation.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 5f018901-4571-4e14-8d44-ef3f4692c29d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/BED-8672-pipeline-update

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/build-and-publish.yml:
- Around line 39-41: Replace direct GitHub expression expansion inside run
scripts with step-level environment variables at all affected sites: in
.github/workflows/build-and-publish.yml lines 39-41 and 54, pass
github.event.release.tag_name through env and assign REF from RELEASE_TAG; in
.github/workflows/build-and-sign-container.yml line 50, pass inputs.tag through
env and assign CLEAN_VERSION from RELEASE_TAG.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 99cb6e45-1c0f-43ec-bbb0-866f823046ef

📥 Commits

Reviewing files that changed from the base of the PR and between 23da1fb and 93449f0.

📒 Files selected for processing (4)

• .github/workflows/build-and-publish.yml
• .github/workflows/build-and-sign-container.yml
• .github/workflows/release-on-merge.yml
• .github/workflows/validate-branch.yml

💤 Files with no reviewable changes (2)

• .github/workflows/release-on-merge.yml
• .github/workflows/validate-branch.yml