From 5bbcfe89441e8326ad1382e15afea0e6881f4b96 Mon Sep 17 00:00:00 2001
From: Copilot <copilot@example.com>
Date: Mon, 27 Jul 2026 14:22:39 -0400
Subject: [PATCH 01/10] DEVOPS-1154 update workflow refs and PyPI publish flow

---
 .../workflows/reusable-python-publish_pypi_package.yml    | 8 --------
 .github/workflows/reusable-python-release_pypi_assets.yml | 8 --------
 2 files changed, 16 deletions(-)

diff --git a/.github/workflows/reusable-python-publish_pypi_package.yml b/.github/workflows/reusable-python-publish_pypi_package.yml
index 82bb7c01..13b4563b 100644
--- a/.github/workflows/reusable-python-publish_pypi_package.yml
+++ b/.github/workflows/reusable-python-publish_pypi_package.yml
@@ -139,14 +139,6 @@ jobs:
                     artifactory-dir-path: ${{ matrix.virtual-repo-name }}/${{ inputs.package-name }}/${{ env.version }}
                     JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }}
                     JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
-            -   name: Publish package to PyPI
-                if: ${{ matrix.virtual-repo-name == 'pypi'  || matrix.virtual-repo-name == 'test-pypi'}}
-                uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
-                with:
-                    verbose: true
-                    packages-dir: ${{ env.build-dir-path }}/
-                    repository-url: https://${{ matrix.virtual-repo-name == 'test-pypi' && 'test.pypi' || 'upload.pypi'}}.org/legacy/
-                    password: ${{ secrets.PYPI_TOKEN }}
 
     add_release_asset:
         name: Add release asset
diff --git a/.github/workflows/reusable-python-release_pypi_assets.yml b/.github/workflows/reusable-python-release_pypi_assets.yml
index ef9d77d2..5e3da7a9 100644
--- a/.github/workflows/reusable-python-release_pypi_assets.yml
+++ b/.github/workflows/reusable-python-release_pypi_assets.yml
@@ -69,11 +69,3 @@ jobs:
                     artifactory-dir-path: ${{ matrix.virtual-repo-name }}/${{ inputs.package-name }}/${{ inputs.release-tag }}
                     JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }}
                     JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
-            -   name: Publish package to PyPI
-                if: ${{ matrix.virtual-repo-name == 'pypi'  || matrix.virtual-repo-name == 'test-pypi'}}
-                uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
-                with:
-                    verbose: true
-                    packages-dir: download-assets/
-                    repository-url: https://${{ matrix.virtual-repo-name == 'test-pypi' && 'test.pypi' || 'upload.pypi'}}.org/legacy/
-                    password: ${{ secrets.PYPI_TOKEN }}

From f89d487fb95004f1ddb48e92268194121a3b5cd1 Mon Sep 17 00:00:00 2001
From: Copilot <copilot@example.com>
Date: Wed, 29 Jul 2026 09:52:59 -0400
Subject: [PATCH 02/10] Updating code by using an action, for more reusability.

---
 .../action.yml                                | 70 +++++++++++++++++++
 1 file changed, 70 insertions(+)
 create mode 100644 .github/actions/reusable-python-publish_to_pypi/action.yml

diff --git a/.github/actions/reusable-python-publish_to_pypi/action.yml b/.github/actions/reusable-python-publish_to_pypi/action.yml
new file mode 100644
index 00000000..257cdf22
--- /dev/null
+++ b/.github/actions/reusable-python-publish_to_pypi/action.yml
@@ -0,0 +1,70 @@
+name: Publish to PyPI (trusted publishing)
+description: >
+    Download built distribution files (from a workflow artifact or a GitHub
+    release) and publish them to PyPI/TestPyPI using OIDC trusted publishing.
+    Must be invoked as a step in a job defined directly in the caller's own
+    top-level workflow file (not from within a reusable *workflow*), so the
+    OIDC token's workflow_ref matches the repository's configured PyPI
+    trusted publisher.
+inputs:
+    source:
+        description: 'Where to fetch the built packages from: "artifact" or "release"'
+        required: true
+        type: string
+    artifact-name:
+        description: 'Name of the workflow artifact to download. Required when source is "artifact"'
+        required: false
+        type: string
+        default: ''
+    release-tag:
+        description: 'Tag of the GitHub release to download assets from. Required when source is "release"'
+        required: false
+        type: string
+        default: ''
+    github-token:
+        description: 'Token used to download release assets via "gh release download". Required when source is "release"'
+        required: false
+        type: string
+        default: ''
+    repository-url:
+        description: PyPI-compatible upload endpoint
+        required: true
+        type: string
+    verbose:
+        description: Enable verbose output on the publish step
+        required: false
+        type: string
+        default: 'true'
+    attestations:
+        description: Generate and upload PEP 740 attestations
+        required: false
+        type: string
+        default: 'true'
+
+runs:
+    using: composite
+    steps:
+        -   name: Download build artifact
+            if: ${{ inputs.source == 'artifact' }}
+            uses: actions/download-artifact@v8
+            with:
+                name: ${{ inputs.artifact-name }}
+                path: dist-download
+        -   name: Download release assets
+            if: ${{ inputs.source == 'release' }}
+            shell: bash
+            env:
+                GITHUB_TOKEN: ${{ inputs.github-token }}
+                GH_REPO: ${{ github.repository }}
+                INPUTS_RELEASE_TAG: ${{ inputs.release-tag }}
+            run: |
+                mkdir -p dist-download
+                cd dist-download
+                gh release download "${INPUTS_RELEASE_TAG}" -p '*.tar.gz' -p '*.whl'
+        -   name: Publish package
+            uses: pypa/gh-action-pypi-publish@v1.14.1
+            with:
+                verbose: ${{ inputs.verbose }}
+                packages-dir: dist-download/
+                repository-url: ${{ inputs.repository-url }}
+                attestations: ${{ inputs.attestations }}

From 3588c90f9a21b84528fefb40dc09371c686d6954 Mon Sep 17 00:00:00 2001
From: Copilot <copilot@example.com>
Date: Wed, 29 Jul 2026 10:01:47 -0400
Subject: [PATCH 03/10] test commit

---
 .github/actions/reusable-python-publish_to_pypi/action.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/actions/reusable-python-publish_to_pypi/action.yml b/.github/actions/reusable-python-publish_to_pypi/action.yml
index 257cdf22..73391832 100644
--- a/.github/actions/reusable-python-publish_to_pypi/action.yml
+++ b/.github/actions/reusable-python-publish_to_pypi/action.yml
@@ -5,7 +5,7 @@ description: >
     Must be invoked as a step in a job defined directly in the caller's own
     top-level workflow file (not from within a reusable *workflow*), so the
     OIDC token's workflow_ref matches the repository's configured PyPI
-    trusted publisher.
+    trusted publisher. 
 inputs:
     source:
         description: 'Where to fetch the built packages from: "artifact" or "release"'

From 20bfc4e54f8ebbd001616c3383a4c00f57f7f799 Mon Sep 17 00:00:00 2001
From: Romain Floreani <romainf@mirageoscience.com>
Date: Wed, 29 Jul 2026 10:10:05 -0400
Subject: [PATCH 04/10] testing the new commit

---
 .github/actions/reusable-python-publish_to_pypi/action.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/actions/reusable-python-publish_to_pypi/action.yml b/.github/actions/reusable-python-publish_to_pypi/action.yml
index 73391832..257cdf22 100644
--- a/.github/actions/reusable-python-publish_to_pypi/action.yml
+++ b/.github/actions/reusable-python-publish_to_pypi/action.yml
@@ -5,7 +5,7 @@ description: >
     Must be invoked as a step in a job defined directly in the caller's own
     top-level workflow file (not from within a reusable *workflow*), so the
     OIDC token's workflow_ref matches the repository's configured PyPI
-    trusted publisher. 
+    trusted publisher.
 inputs:
     source:
         description: 'Where to fetch the built packages from: "artifact" or "release"'

From 70b24856525f5a44be54e55f47ebac7e8f33f177 Mon Sep 17 00:00:00 2001
From: Romain Floreani <romainf@mirageoscience.com>
Date: Mon, 17 Aug 2026 09:52:53 -0400
Subject: [PATCH 05/10] New test to fix error

---
 .../action.yml                                | 32 +++----------------
 1 file changed, 5 insertions(+), 27 deletions(-)
 rename .github/actions/{reusable-python-publish_to_pypi => reusable-python-download_dist}/action.yml (59%)

diff --git a/.github/actions/reusable-python-publish_to_pypi/action.yml b/.github/actions/reusable-python-download_dist/action.yml
similarity index 59%
rename from .github/actions/reusable-python-publish_to_pypi/action.yml
rename to .github/actions/reusable-python-download_dist/action.yml
index 257cdf22..0adadedc 100644
--- a/.github/actions/reusable-python-publish_to_pypi/action.yml
+++ b/.github/actions/reusable-python-download_dist/action.yml
@@ -1,11 +1,10 @@
-name: Publish to PyPI (trusted publishing)
+name: Download Python distribution files
 description: >
     Download built distribution files (from a workflow artifact or a GitHub
-    release) and publish them to PyPI/TestPyPI using OIDC trusted publishing.
-    Must be invoked as a step in a job defined directly in the caller's own
-    top-level workflow file (not from within a reusable *workflow*), so the
-    OIDC token's workflow_ref matches the repository's configured PyPI
-    trusted publisher.
+    release) to a local "dist-download" directory, ready to be published
+    (e.g. with pypa/gh-action-pypi-publish). This is a plain composite
+    action (no self-resolving docker step), so it is safe to call from
+    another composite action or from a caller's top-level workflow.
 inputs:
     source:
         description: 'Where to fetch the built packages from: "artifact" or "release"'
@@ -26,20 +25,6 @@ inputs:
         required: false
         type: string
         default: ''
-    repository-url:
-        description: PyPI-compatible upload endpoint
-        required: true
-        type: string
-    verbose:
-        description: Enable verbose output on the publish step
-        required: false
-        type: string
-        default: 'true'
-    attestations:
-        description: Generate and upload PEP 740 attestations
-        required: false
-        type: string
-        default: 'true'
 
 runs:
     using: composite
@@ -61,10 +46,3 @@ runs:
                 mkdir -p dist-download
                 cd dist-download
                 gh release download "${INPUTS_RELEASE_TAG}" -p '*.tar.gz' -p '*.whl'
-        -   name: Publish package
-            uses: pypa/gh-action-pypi-publish@v1.14.1
-            with:
-                verbose: ${{ inputs.verbose }}
-                packages-dir: dist-download/
-                repository-url: ${{ inputs.repository-url }}
-                attestations: ${{ inputs.attestations }}

From 480d2ac513f47468d1812d728022ab0a20d2c86b Mon Sep 17 00:00:00 2001
From: Romain Floreani <romainf@mirageoscience.com>
Date: Wed, 26 Aug 2026 07:03:59 -0400
Subject: [PATCH 06/10] Refactor for PR comments

---
 .../reusable-python-download_dist/action.yml  | 48 -------------------
 .../action.yml                                | 18 +++++++
 .../action.yml                                | 27 +++++++++++
 .../reusable-python-publish_pypi_package.yml  |  8 +++-
 .../reusable-python-release_pypi_assets.yml   |  8 +++-
 5 files changed, 58 insertions(+), 51 deletions(-)
 delete mode 100644 .github/actions/reusable-python-download_dist/action.yml
 create mode 100644 .github/actions/reusable-python-download_dist_artifact/action.yml
 create mode 100644 .github/actions/reusable-python-download_dist_release/action.yml

diff --git a/.github/actions/reusable-python-download_dist/action.yml b/.github/actions/reusable-python-download_dist/action.yml
deleted file mode 100644
index 0adadedc..00000000
--- a/.github/actions/reusable-python-download_dist/action.yml
+++ /dev/null
@@ -1,48 +0,0 @@
-name: Download Python distribution files
-description: >
-    Download built distribution files (from a workflow artifact or a GitHub
-    release) to a local "dist-download" directory, ready to be published
-    (e.g. with pypa/gh-action-pypi-publish). This is a plain composite
-    action (no self-resolving docker step), so it is safe to call from
-    another composite action or from a caller's top-level workflow.
-inputs:
-    source:
-        description: 'Where to fetch the built packages from: "artifact" or "release"'
-        required: true
-        type: string
-    artifact-name:
-        description: 'Name of the workflow artifact to download. Required when source is "artifact"'
-        required: false
-        type: string
-        default: ''
-    release-tag:
-        description: 'Tag of the GitHub release to download assets from. Required when source is "release"'
-        required: false
-        type: string
-        default: ''
-    github-token:
-        description: 'Token used to download release assets via "gh release download". Required when source is "release"'
-        required: false
-        type: string
-        default: ''
-
-runs:
-    using: composite
-    steps:
-        -   name: Download build artifact
-            if: ${{ inputs.source == 'artifact' }}
-            uses: actions/download-artifact@v8
-            with:
-                name: ${{ inputs.artifact-name }}
-                path: dist-download
-        -   name: Download release assets
-            if: ${{ inputs.source == 'release' }}
-            shell: bash
-            env:
-                GITHUB_TOKEN: ${{ inputs.github-token }}
-                GH_REPO: ${{ github.repository }}
-                INPUTS_RELEASE_TAG: ${{ inputs.release-tag }}
-            run: |
-                mkdir -p dist-download
-                cd dist-download
-                gh release download "${INPUTS_RELEASE_TAG}" -p '*.tar.gz' -p '*.whl'
diff --git a/.github/actions/reusable-python-download_dist_artifact/action.yml b/.github/actions/reusable-python-download_dist_artifact/action.yml
new file mode 100644
index 00000000..804bcaf2
--- /dev/null
+++ b/.github/actions/reusable-python-download_dist_artifact/action.yml
@@ -0,0 +1,18 @@
+name: Download Python distribution files (workflow artifact)
+description: >
+    Download built distribution files from a workflow artifact into a local
+    "dist-download" directory, ready to be published.
+inputs:
+    artifact-name:
+        description: Name of the workflow artifact to download
+        required: true
+        type: string
+
+runs:
+    using: composite
+    steps:
+        -   name: Download build artifact
+            uses: actions/download-artifact@v8
+            with:
+                name: ${{ inputs.artifact-name }}
+                path: dist-download
diff --git a/.github/actions/reusable-python-download_dist_release/action.yml b/.github/actions/reusable-python-download_dist_release/action.yml
new file mode 100644
index 00000000..06de4005
--- /dev/null
+++ b/.github/actions/reusable-python-download_dist_release/action.yml
@@ -0,0 +1,27 @@
+name: Download Python distribution files (GitHub release)
+description: >
+    Download built distribution files from a GitHub release into a local
+    "dist-download" directory, ready to be published.
+inputs:
+    release-tag:
+        description: Tag of the GitHub release to download assets from
+        required: true
+        type: string
+    github-token:
+        description: Token used to download release assets via "gh release download"
+        required: true
+        type: string
+
+runs:
+    using: composite
+    steps:
+        -   name: Download release assets
+            shell: bash
+            env:
+                GITHUB_TOKEN: ${{ inputs.github-token }}
+                GH_REPO: ${{ github.repository }}
+                INPUTS_RELEASE_TAG: ${{ inputs.release-tag }}
+            run: |
+                mkdir -p dist-download
+                cd dist-download
+                gh release download "${INPUTS_RELEASE_TAG}" -p '*.tar.gz' -p '*.whl'
diff --git a/.github/workflows/reusable-python-publish_pypi_package.yml b/.github/workflows/reusable-python-publish_pypi_package.yml
index 13b4563b..06c3b96b 100644
--- a/.github/workflows/reusable-python-publish_pypi_package.yml
+++ b/.github/workflows/reusable-python-publish_pypi_package.yml
@@ -22,7 +22,9 @@ on:
             type: boolean
             default: true
         virtual-repo-names:
-            description: 'List of virtual repository names to publish to (e.g. ["public-pypi-dev", "geophysics-pypi-dev"])'
+            description: >
+                List of virtual repository names to publish to (e.g. ["public-pypi-dev", "geophysics-pypi-dev"]).
+                "pypi"/"test-pypi" are a deliberate no-op here; PyPI publishing runs in the caller (DEVOPS-1154).
             required: true
             type: string
         os:
@@ -139,6 +141,10 @@ jobs:
                     artifactory-dir-path: ${{ matrix.virtual-repo-name }}/${{ inputs.package-name }}/${{ env.version }}
                     JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }}
                     JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
+            -   name: Report PyPI publish is handled by the caller
+                if: ${{ matrix.virtual-repo-name == 'pypi' || matrix.virtual-repo-name == 'test-pypi' }}
+                run: |
+                    echo "::notice::Not publishing '${{ matrix.virtual-repo-name }}' here: PyPI trusted publishing must run as a direct step in the caller's top-level workflow, not through this reusable workflow. See the 'virtual-repo-names' input description."
 
     add_release_asset:
         name: Add release asset
diff --git a/.github/workflows/reusable-python-release_pypi_assets.yml b/.github/workflows/reusable-python-release_pypi_assets.yml
index 5e3da7a9..2788b7e8 100644
--- a/.github/workflows/reusable-python-release_pypi_assets.yml
+++ b/.github/workflows/reusable-python-release_pypi_assets.yml
@@ -9,8 +9,8 @@ on:
             type: string
         virtual-repo-names:
             description: >
-                List of repository names to publish to
-                (e.g. ["public-pypi-prod", "geophysics-pypi-prod"])
+                List of repository names to publish to (e.g. ["public-pypi-prod", "geophysics-pypi-prod"]).
+                "pypi"/"test-pypi" are a deliberate no-op here; PyPI publishing runs in the caller (DEVOPS-1154).
             required: true
             type: string
         release-tag:
@@ -69,3 +69,7 @@ jobs:
                     artifactory-dir-path: ${{ matrix.virtual-repo-name }}/${{ inputs.package-name }}/${{ inputs.release-tag }}
                     JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }}
                     JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
+            -   name: Report PyPI publish is handled by the caller
+                if: ${{ matrix.virtual-repo-name == 'pypi' || matrix.virtual-repo-name == 'test-pypi' }}
+                run: |
+                    echo "::notice::Not publishing '${{ matrix.virtual-repo-name }}' here: PyPI trusted publishing must run as a direct step in the caller's top-level workflow, not through this reusable workflow. See the 'virtual-repo-names' input description."

From d22c49f01c40b4e69af2eba13e0e2da19bd71a42 Mon Sep 17 00:00:00 2001
From: Romain Floreani <romainf@mirageoscience.com>
Date: Wed, 26 Aug 2026 15:53:52 -0400
Subject: [PATCH 07/10] Making some fixes.

---
 .../action.yml                                 | 18 ------------------
 1 file changed, 18 deletions(-)
 delete mode 100644 .github/actions/reusable-python-download_dist_artifact/action.yml

diff --git a/.github/actions/reusable-python-download_dist_artifact/action.yml b/.github/actions/reusable-python-download_dist_artifact/action.yml
deleted file mode 100644
index 804bcaf2..00000000
--- a/.github/actions/reusable-python-download_dist_artifact/action.yml
+++ /dev/null
@@ -1,18 +0,0 @@
-name: Download Python distribution files (workflow artifact)
-description: >
-    Download built distribution files from a workflow artifact into a local
-    "dist-download" directory, ready to be published.
-inputs:
-    artifact-name:
-        description: Name of the workflow artifact to download
-        required: true
-        type: string
-
-runs:
-    using: composite
-    steps:
-        -   name: Download build artifact
-            uses: actions/download-artifact@v8
-            with:
-                name: ${{ inputs.artifact-name }}
-                path: dist-download

From 579186f63a851c7cf4ea4147164bc4e244591e33 Mon Sep 17 00:00:00 2001
From: Romain Floreani <romainf@mirageoscience.com>
Date: Wed, 26 Aug 2026 15:54:35 -0400
Subject: [PATCH 08/10] Updating some fixes

---
 .../workflows/reusable-python-publish_pypi_package.yml   | 9 ++++++---
 .../workflows/reusable-python-release_pypi_assets.yml    | 7 +++++--
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/reusable-python-publish_pypi_package.yml b/.github/workflows/reusable-python-publish_pypi_package.yml
index 06c3b96b..ecde433e 100644
--- a/.github/workflows/reusable-python-publish_pypi_package.yml
+++ b/.github/workflows/reusable-python-publish_pypi_package.yml
@@ -24,7 +24,7 @@ on:
         virtual-repo-names:
             description: >
                 List of virtual repository names to publish to (e.g. ["public-pypi-dev", "geophysics-pypi-dev"]).
-                "pypi"/"test-pypi" are a deliberate no-op here; PyPI publishing runs in the caller (DEVOPS-1154).
+                "pypi"/"test-pypi" are a deliberate no-op here; PyPI publishing runs in the caller.
             required: true
             type: string
         os:
@@ -141,10 +141,13 @@ jobs:
                     artifactory-dir-path: ${{ matrix.virtual-repo-name }}/${{ inputs.package-name }}/${{ env.version }}
                     JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }}
                     JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
-            -   name: Report PyPI publish is handled by the caller
+            -   name: Fail on PyPI/TestPyPI virtual-repo-name
                 if: ${{ matrix.virtual-repo-name == 'pypi' || matrix.virtual-repo-name == 'test-pypi' }}
+                env:
+                    VIRTUAL_REPO_NAME: ${{ matrix.virtual-repo-name }}
                 run: |
-                    echo "::notice::Not publishing '${{ matrix.virtual-repo-name }}' here: PyPI trusted publishing must run as a direct step in the caller's top-level workflow, not through this reusable workflow. See the 'virtual-repo-names' input description."
+                    echo "::error::Not publishing '${VIRTUAL_REPO_NAME}' here: PyPI trusted publishing must run as a direct step in the caller's top-level workflow, not through this reusable workflow. See the 'virtual-repo-names' input description."
+                    exit 1
 
     add_release_asset:
         name: Add release asset
diff --git a/.github/workflows/reusable-python-release_pypi_assets.yml b/.github/workflows/reusable-python-release_pypi_assets.yml
index 2788b7e8..4cd4e565 100644
--- a/.github/workflows/reusable-python-release_pypi_assets.yml
+++ b/.github/workflows/reusable-python-release_pypi_assets.yml
@@ -69,7 +69,10 @@ jobs:
                     artifactory-dir-path: ${{ matrix.virtual-repo-name }}/${{ inputs.package-name }}/${{ inputs.release-tag }}
                     JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }}
                     JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
-            -   name: Report PyPI publish is handled by the caller
+            -   name: Fail on PyPI/TestPyPI virtual-repo-name
                 if: ${{ matrix.virtual-repo-name == 'pypi' || matrix.virtual-repo-name == 'test-pypi' }}
+                env:
+                    VIRTUAL_REPO_NAME: ${{ matrix.virtual-repo-name }}
                 run: |
-                    echo "::notice::Not publishing '${{ matrix.virtual-repo-name }}' here: PyPI trusted publishing must run as a direct step in the caller's top-level workflow, not through this reusable workflow. See the 'virtual-repo-names' input description."
+                    echo "::error::Not publishing '${VIRTUAL_REPO_NAME}' here: PyPI trusted publishing must run as a direct step in the caller's top-level workflow, not through this reusable workflow. See the 'virtual-repo-names' input description."
+                    exit 1

From b71cdedc541d5d3684cb1f345a7105ccdd704145 Mon Sep 17 00:00:00 2001
From: Romain Floreani <romainf@mirageoscience.com>
Date: Mon, 21 Sep 2026 10:13:46 -0400
Subject: [PATCH 09/10] Rebase + repo cleanup & simplification

---
 .../action.yml                                   |  2 +-
 .../reusable-python-build_poetry_package.yml     |  2 +-
 .../reusable-python-build_setuptools_package.yml |  2 +-
 .../reusable-python-publish_pypi_package.yml     | 16 ++++++++++------
 .../reusable-python-publish_rattler_package.yml  |  6 +++---
 .github/workflows/reusable-python-pytest.yml     |  8 ++++----
 .../reusable-python-release_conda_assets.yml     |  4 ++--
 .../reusable-python-release_pypi_assets.yml      |  6 +++---
 .../reusable-python-static_analysis.yml          |  8 ++++----
 .../reusable-zizmor-advanced-security.yml        |  2 +-
 .github/workflows/reusable-zizmor-annotate.yml   |  2 +-
 .github/workflows/reusable-zizmor-security.yml   |  2 +-
 12 files changed, 32 insertions(+), 28 deletions(-)

diff --git a/.github/actions/reusable-python-publish_to_artifactory/action.yml b/.github/actions/reusable-python-publish_to_artifactory/action.yml
index 8cab4a62..77c3d24f 100644
--- a/.github/actions/reusable-python-publish_to_artifactory/action.yml
+++ b/.github/actions/reusable-python-publish_to_artifactory/action.yml
@@ -22,7 +22,7 @@ runs:
   using: composite
   steps:
     - name: Setup JFrog CLI
-      uses: jfrog/setup-jfrog-cli@v4.4.1
+      uses: jfrog/setup-jfrog-cli@68c0efdc951dd2359bbbfa15c48bc67b3ae8e4d6 # v5.2.0
       env:
         JF_URL: https://${{ inputs.JFROG_ARTIFACTORY_URL }}
         JF_ACCESS_TOKEN: ${{ inputs.JFROG_ARTIFACTORY_TOKEN }}
diff --git a/.github/workflows/reusable-python-build_poetry_package.yml b/.github/workflows/reusable-python-build_poetry_package.yml
index 85b439d0..5051520d 100644
--- a/.github/workflows/reusable-python-build_poetry_package.yml
+++ b/.github/workflows/reusable-python-build_poetry_package.yml
@@ -87,7 +87,7 @@ jobs:
                         exit 1
                     fi
                     echo "version=${VERSION}" >> $GITHUB_OUTPUT
-            -   uses: jfrog/setup-jfrog-cli@279b1f629f43dd5bc658d8361ac4802a7ef8d2d5 # v4.9.1
+            -   uses: jfrog/setup-jfrog-cli@68c0efdc951dd2359bbbfa15c48bc67b3ae8e4d6 # v5.2.0
                 name: Setup JFrog CLI
                 env:
                     JF_URL: https://${{ secrets.JFROG_ARTIFACTORY_URL }}
diff --git a/.github/workflows/reusable-python-build_setuptools_package.yml b/.github/workflows/reusable-python-build_setuptools_package.yml
index b140c299..bf30826d 100644
--- a/.github/workflows/reusable-python-build_setuptools_package.yml
+++ b/.github/workflows/reusable-python-build_setuptools_package.yml
@@ -82,7 +82,7 @@ jobs:
                         exit 1
                     fi
                     echo "version=${VERSION}" >> $GITHUB_OUTPUT
-            -   uses: jfrog/setup-jfrog-cli@279b1f629f43dd5bc658d8361ac4802a7ef8d2d5 # v4.9.1
+            -   uses: jfrog/setup-jfrog-cli@68c0efdc951dd2359bbbfa15c48bc67b3ae8e4d6 # v5.2.0
                 name: Setup JFrog CLI
                 env:
                     JF_URL: https://${{ secrets.JFROG_ARTIFACTORY_URL }}
diff --git a/.github/workflows/reusable-python-publish_pypi_package.yml b/.github/workflows/reusable-python-publish_pypi_package.yml
index ecde433e..1fc47905 100644
--- a/.github/workflows/reusable-python-publish_pypi_package.yml
+++ b/.github/workflows/reusable-python-publish_pypi_package.yml
@@ -24,7 +24,7 @@ on:
         virtual-repo-names:
             description: >
                 List of virtual repository names to publish to (e.g. ["public-pypi-dev", "geophysics-pypi-dev"]).
-                "pypi"/"test-pypi" are a deliberate no-op here; PyPI publishing runs in the caller.
+                "pypi" and "test-pypi" are not supported: publish to PyPI from the calling workflow.
             required: true
             type: string
         os:
@@ -56,6 +56,10 @@ on:
         PYPI_TOKEN:
             description: PyPI Token
             required: false
+    outputs:
+        is-publishable:
+            description: Whether the version is publishable (same check that gates the publish job)
+            value: ${{ jobs.is_publishable.outputs.is-publishable }}
 
 permissions:
     contents: read
@@ -68,7 +72,7 @@ jobs:
     build_poetry_package:
         name: Build poetry package
         if: ${{ inputs.package-manager == 'poetry' && github.repository_owner == 'MiraGeoscience' }}
-        uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-build_poetry_package.yml@3ff92aeffa5b92d646abea073ed5ad06117e57f6 # v3.11.0
+        uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-build_poetry_package.yml@DEVOPS-1154 # TEMPORARY for testing
         with:
             package-name: ${{ inputs.package-name }}
             source-path: ${{ inputs.source-path || '.' }}
@@ -85,7 +89,7 @@ jobs:
     build_setuptools_package:
         name: Build setuptools package
         if: ${{ inputs.package-manager == 'setuptools' && github.repository_owner == 'MiraGeoscience' }}
-        uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-build_setuptools_package.yml@3ff92aeffa5b92d646abea073ed5ad06117e57f6 # v3.11.0
+        uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-build_setuptools_package.yml@DEVOPS-1154 # TEMPORARY for testing
         with:
             package-name: ${{ inputs.package-name }}
             python-version: ${{ inputs.python-version }}
@@ -100,7 +104,7 @@ jobs:
 
     is_publishable:
         name: Check version publishability
-        uses: MiraGeoscience/CI-tools/.github/workflows/reusable-version-check.yml@3ff92aeffa5b92d646abea073ed5ad06117e57f6 # v3.11.0
+        uses: MiraGeoscience/CI-tools/.github/workflows/reusable-version-check.yml@7241532854727d993872b67fc761139b8438615b # v3.12.0
         with:
           version-tag: ${{ inputs.version-tag || github.ref_name }}
 
@@ -134,7 +138,7 @@ jobs:
                     name: ${{ inputs.package-name }}-pip-package-build
                     path: ${{ env.build-dir-path }}
             -   name: Publish package to Artifactory
-                uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-publish_to_artifactory@3ff92aeffa5b92d646abea073ed5ad06117e57f6 # v3.11.0
+                uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-publish_to_artifactory@DEVOPS-1154 # TEMPORARY for testing
                 if: ${{ matrix.virtual-repo-name != 'pypi' && matrix.virtual-repo-name != 'test-pypi' }}
                 with:
                     build-dir-path: ${{ env.build-dir-path }}
@@ -159,7 +163,7 @@ jobs:
         timeout-minutes: 5
         steps:
             -   name: Get draft release
-                uses: MiraGeoscience/CI-tools/.github/actions/reusable-get_draft_release@3ff92aeffa5b92d646abea073ed5ad06117e57f6 # v3.11.0
+                uses: MiraGeoscience/CI-tools/.github/actions/reusable-get_draft_release@7241532854727d993872b67fc761139b8438615b # v3.12.0
                 id: get-draft-release
                 with:
                     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/reusable-python-publish_rattler_package.yml b/.github/workflows/reusable-python-publish_rattler_package.yml
index 9c4568c4..4164cc4e 100644
--- a/.github/workflows/reusable-python-publish_rattler_package.yml
+++ b/.github/workflows/reusable-python-publish_rattler_package.yml
@@ -158,7 +158,7 @@ jobs:
 
     is_publishable:
         name: Check version publishability
-        uses: MiraGeoscience/CI-tools/.github/workflows/reusable-version-check.yml@3ff92aeffa5b92d646abea073ed5ad06117e57f6 # v3.11.0
+        uses: MiraGeoscience/CI-tools/.github/workflows/reusable-version-check.yml@7241532854727d993872b67fc761139b8438615b # v3.12.0
         with:
           version-tag: ${{ inputs.version-tag || github.ref_name }}
 
@@ -178,7 +178,7 @@ jobs:
                     name: ${{ inputs.package-name }}-conda-package-build
                     path: build-dir
             -   name: Publish package to Artifactory
-                uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-publish_to_artifactory@3ff92aeffa5b92d646abea073ed5ad06117e57f6 # v3.11.0
+                uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-publish_to_artifactory@7241532854727d993872b67fc761139b8438615b # v3.12.0
                 with:
                     build-dir-path: build-dir/noarch
                     artifactory-dir-path: ${{ matrix.publish-repo-name}}/noarch
@@ -194,7 +194,7 @@ jobs:
         timeout-minutes: 5
         steps:
             -   name: Get draft release
-                uses: MiraGeoscience/CI-tools/.github/actions/reusable-get_draft_release@3ff92aeffa5b92d646abea073ed5ad06117e57f6 # v3.11.0
+                uses: MiraGeoscience/CI-tools/.github/actions/reusable-get_draft_release@7241532854727d993872b67fc761139b8438615b # v3.12.0
                 id: get-draft-release
                 with:
                     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/reusable-python-pytest.yml b/.github/workflows/reusable-python-pytest.yml
index 37bf4a62..78480ff8 100644
--- a/.github/workflows/reusable-python-pytest.yml
+++ b/.github/workflows/reusable-python-pytest.yml
@@ -133,7 +133,7 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
 
-      - uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_conda@3ff92aeffa5b92d646abea073ed5ad06117e57f6 # v3.11.0
+      - uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_conda@7241532854727d993872b67fc761139b8438615b # v3.12.0
         name: Setup conda env
         if: ${{ inputs.package-manager == 'conda' }}
         env:
@@ -145,7 +145,7 @@ jobs:
           JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }}
           JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
 
-      - uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_poetry@3ff92aeffa5b92d646abea073ed5ad06117e57f6 # v3.11.0
+      - uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_poetry@7241532854727d993872b67fc761139b8438615b # v3.12.0
         name: Setup poetry env
         if: ${{ inputs.package-manager == 'poetry' }}
         with:
@@ -155,7 +155,7 @@ jobs:
           virtual-repo-names: ${{ inputs.virtual-repo-names }}
           JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
 
-      - uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_hatch@3ff92aeffa5b92d646abea073ed5ad06117e57f6 # v3.11.0
+      - uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_hatch@7241532854727d993872b67fc761139b8438615b # v3.12.0
         name: Setup hatch env
         if: ${{ inputs.package-manager == 'hatch' }}
         with:
@@ -188,7 +188,7 @@ jobs:
         shell: bash
         run: gh auth setup-git
 
-      - uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_pixi@3ff92aeffa5b92d646abea073ed5ad06117e57f6 # v3.11.0
+      - uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_pixi@7241532854727d993872b67fc761139b8438615b # v3.12.0
         name: Setup pixi env
         if: ${{ inputs.package-manager == 'pixi' }}
         with:
diff --git a/.github/workflows/reusable-python-release_conda_assets.yml b/.github/workflows/reusable-python-release_conda_assets.yml
index ae8161b6..a7e4a601 100644
--- a/.github/workflows/reusable-python-release_conda_assets.yml
+++ b/.github/workflows/reusable-python-release_conda_assets.yml
@@ -39,7 +39,7 @@ jobs:
                 virtual-repo-name: ${{ fromJson(inputs.virtual-repo-names) }}
         steps:
             -   name: Find release from tag
-                uses: MiraGeoscience/CI-tools/.github/actions/reusable-get_draft_release@3ff92aeffa5b92d646abea073ed5ad06117e57f6 # v3.11.0
+                uses: MiraGeoscience/CI-tools/.github/actions/reusable-get_draft_release@7241532854727d993872b67fc761139b8438615b # v3.12.0
                 id: find-release
                 with:
                     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -54,7 +54,7 @@ jobs:
                     cd download-assets
                     gh release download ${INPUTS_RELEASE_TAG} -p '*.conda'
             -   name: Publish package to Artifactory
-                uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-publish_to_artifactory@3ff92aeffa5b92d646abea073ed5ad06117e57f6 # v3.11.0
+                uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-publish_to_artifactory@7241532854727d993872b67fc761139b8438615b # v3.12.0
                 with:
                     build-dir-path: download-assets
                     artifactory-dir-path: ${{ matrix.virtual-repo-name}}/noarch
diff --git a/.github/workflows/reusable-python-release_pypi_assets.yml b/.github/workflows/reusable-python-release_pypi_assets.yml
index 4cd4e565..9bf6bf38 100644
--- a/.github/workflows/reusable-python-release_pypi_assets.yml
+++ b/.github/workflows/reusable-python-release_pypi_assets.yml
@@ -10,7 +10,7 @@ on:
         virtual-repo-names:
             description: >
                 List of repository names to publish to (e.g. ["public-pypi-prod", "geophysics-pypi-prod"]).
-                "pypi"/"test-pypi" are a deliberate no-op here; PyPI publishing runs in the caller (DEVOPS-1154).
+                "pypi" and "test-pypi" are not supported: publish to PyPI from the calling workflow.
             required: true
             type: string
         release-tag:
@@ -47,7 +47,7 @@ jobs:
                 virtual-repo-name: ${{ fromJson(inputs.virtual-repo-names) }}
         steps:
             -   name: Find release from tag
-                uses: MiraGeoscience/CI-tools/.github/actions/reusable-get_draft_release@3ff92aeffa5b92d646abea073ed5ad06117e57f6 # v3.11.0
+                uses: MiraGeoscience/CI-tools/.github/actions/reusable-get_draft_release@7241532854727d993872b67fc761139b8438615b # v3.12.0
                 id: find-release
                 with:
                     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -62,7 +62,7 @@ jobs:
                     cd download-assets
                     gh release download ${INPUTS_RELEASE_TAG} -p '*.tar.gz' -p '*.whl'
             -   name: Publish package to Artifactory
-                uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-publish_to_artifactory@3ff92aeffa5b92d646abea073ed5ad06117e57f6 # v3.11.0
+                uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-publish_to_artifactory@7241532854727d993872b67fc761139b8438615b # v3.12.0
                 if: ${{ matrix.virtual-repo-name != 'pypi' && matrix.virtual-repo-name != 'test-pypi' }}
                 with:
                     build-dir-path: download-assets
diff --git a/.github/workflows/reusable-python-static_analysis.yml b/.github/workflows/reusable-python-static_analysis.yml
index ed0d3a23..7d95b807 100644
--- a/.github/workflows/reusable-python-static_analysis.yml
+++ b/.github/workflows/reusable-python-static_analysis.yml
@@ -178,7 +178,7 @@ jobs:
         with:
           python-version: ${{inputs.python-version}}
 
-      - uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_conda@3ff92aeffa5b92d646abea073ed5ad06117e57f6 # v3.11.0
+      - uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_conda@7241532854727d993872b67fc761139b8438615b # v3.12.0
         name: Setup conda env
         env:
           GIT_LFS_SKIP_SMUDGE: "1"
@@ -190,7 +190,7 @@ jobs:
           JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }}
           JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
 
-      - uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_poetry@3ff92aeffa5b92d646abea073ed5ad06117e57f6 # v3.11.0
+      - uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_poetry@7241532854727d993872b67fc761139b8438615b # v3.12.0
         name: Setup poetry env
         if: ${{ inputs.package-manager == 'poetry' }}
         with:
@@ -200,7 +200,7 @@ jobs:
           virtual-repo-names: ${{ inputs.virtual-repo-names }}
           JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
 
-      - uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_hatch@3ff92aeffa5b92d646abea073ed5ad06117e57f6 # v3.11.0
+      - uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_hatch@7241532854727d993872b67fc761139b8438615b # v3.12.0
         name: Setup hatch env
         if: ${{ inputs.package-manager == 'hatch' }}
         with:
@@ -233,7 +233,7 @@ jobs:
         shell: bash
         run: gh auth setup-git
 
-      - uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_pixi@3ff92aeffa5b92d646abea073ed5ad06117e57f6 # v3.11.0
+      - uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-setup_pixi@7241532854727d993872b67fc761139b8438615b # v3.12.0
         name: Setup pixi env
         if: ${{ inputs.package-manager == 'pixi' }}
         with:
diff --git a/.github/workflows/reusable-zizmor-advanced-security.yml b/.github/workflows/reusable-zizmor-advanced-security.yml
index 1c6376d8..05546280 100644
--- a/.github/workflows/reusable-zizmor-advanced-security.yml
+++ b/.github/workflows/reusable-zizmor-advanced-security.yml
@@ -36,7 +36,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Zizmor Config
-        uses: MiraGeoscience/CI-tools/.github/actions/setup-zizmor-config@3ff92aeffa5b92d646abea073ed5ad06117e57f6 # v3.11.0
+        uses: MiraGeoscience/CI-tools/.github/actions/setup-zizmor-config@7241532854727d993872b67fc761139b8438615b # v3.12.0
 
       - name: Run Zizmor Security Scan
         uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # v0.5.0
diff --git a/.github/workflows/reusable-zizmor-annotate.yml b/.github/workflows/reusable-zizmor-annotate.yml
index 12d0f13a..47796927 100644
--- a/.github/workflows/reusable-zizmor-annotate.yml
+++ b/.github/workflows/reusable-zizmor-annotate.yml
@@ -36,7 +36,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Zizmor Config
-        uses: MiraGeoscience/CI-tools/.github/actions/setup-zizmor-config@3ff92aeffa5b92d646abea073ed5ad06117e57f6 # v3.11.0
+        uses: MiraGeoscience/CI-tools/.github/actions/setup-zizmor-config@7241532854727d993872b67fc761139b8438615b # v3.12.0
 
       - name: Run Zizmor Security Scan
         uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # v0.5.0
diff --git a/.github/workflows/reusable-zizmor-security.yml b/.github/workflows/reusable-zizmor-security.yml
index 31ad66af..27c06995 100644
--- a/.github/workflows/reusable-zizmor-security.yml
+++ b/.github/workflows/reusable-zizmor-security.yml
@@ -35,7 +35,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Zizmor Config
-        uses: MiraGeoscience/CI-tools/.github/actions/setup-zizmor-config@3ff92aeffa5b92d646abea073ed5ad06117e57f6 # v3.11.0
+        uses: MiraGeoscience/CI-tools/.github/actions/setup-zizmor-config@7241532854727d993872b67fc761139b8438615b # v3.12.0
 
       - name: Run Zizmor Security Scan
         uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # v0.5.0

From 4e5fc0650751ad148c62f0432d62469afc432c5f Mon Sep 17 00:00:00 2001
From: Romain Floreani <romainf@mirageoscience.com>
Date: Thu, 24 Sep 2026 15:29:52 -0400
Subject: [PATCH 10/10] Fix JFrog warnings in publish workflows

- Disable auto build-info publish in setup-jfrog-cli (403 + missing .git warnings)
- Point conda publish/release jobs to DEVOPS-1154 action (setup-jfrog-cli v5.2.0, removes Node 20 warning)
---
 .../actions/reusable-python-publish_to_artifactory/action.yml   | 2 ++
 .github/workflows/reusable-python-build_poetry_package.yml      | 2 ++
 .github/workflows/reusable-python-build_setuptools_package.yml  | 2 ++
 .github/workflows/reusable-python-publish_rattler_package.yml   | 2 +-
 .github/workflows/reusable-python-release_conda_assets.yml      | 2 +-
 5 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/actions/reusable-python-publish_to_artifactory/action.yml b/.github/actions/reusable-python-publish_to_artifactory/action.yml
index 77c3d24f..cd6dd914 100644
--- a/.github/actions/reusable-python-publish_to_artifactory/action.yml
+++ b/.github/actions/reusable-python-publish_to_artifactory/action.yml
@@ -23,6 +23,8 @@ runs:
   steps:
     - name: Setup JFrog CLI
       uses: jfrog/setup-jfrog-cli@68c0efdc951dd2359bbbfa15c48bc67b3ae8e4d6 # v5.2.0
+      with:
+        disable-auto-build-publish: true
       env:
         JF_URL: https://${{ inputs.JFROG_ARTIFACTORY_URL }}
         JF_ACCESS_TOKEN: ${{ inputs.JFROG_ARTIFACTORY_TOKEN }}
diff --git a/.github/workflows/reusable-python-build_poetry_package.yml b/.github/workflows/reusable-python-build_poetry_package.yml
index 5051520d..f07807ed 100644
--- a/.github/workflows/reusable-python-build_poetry_package.yml
+++ b/.github/workflows/reusable-python-build_poetry_package.yml
@@ -89,6 +89,8 @@ jobs:
                     echo "version=${VERSION}" >> $GITHUB_OUTPUT
             -   uses: jfrog/setup-jfrog-cli@68c0efdc951dd2359bbbfa15c48bc67b3ae8e4d6 # v5.2.0
                 name: Setup JFrog CLI
+                with:
+                    disable-auto-build-publish: true
                 env:
                     JF_URL: https://${{ secrets.JFROG_ARTIFACTORY_URL }}
                     JF_ACCESS_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
diff --git a/.github/workflows/reusable-python-build_setuptools_package.yml b/.github/workflows/reusable-python-build_setuptools_package.yml
index bf30826d..313b6589 100644
--- a/.github/workflows/reusable-python-build_setuptools_package.yml
+++ b/.github/workflows/reusable-python-build_setuptools_package.yml
@@ -84,6 +84,8 @@ jobs:
                     echo "version=${VERSION}" >> $GITHUB_OUTPUT
             -   uses: jfrog/setup-jfrog-cli@68c0efdc951dd2359bbbfa15c48bc67b3ae8e4d6 # v5.2.0
                 name: Setup JFrog CLI
+                with:
+                    disable-auto-build-publish: true
                 env:
                     JF_URL: https://${{ secrets.JFROG_ARTIFACTORY_URL }}
                     JF_ACCESS_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
diff --git a/.github/workflows/reusable-python-publish_rattler_package.yml b/.github/workflows/reusable-python-publish_rattler_package.yml
index 4164cc4e..f8d00901 100644
--- a/.github/workflows/reusable-python-publish_rattler_package.yml
+++ b/.github/workflows/reusable-python-publish_rattler_package.yml
@@ -178,7 +178,7 @@ jobs:
                     name: ${{ inputs.package-name }}-conda-package-build
                     path: build-dir
             -   name: Publish package to Artifactory
-                uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-publish_to_artifactory@7241532854727d993872b67fc761139b8438615b # v3.12.0
+                uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-publish_to_artifactory@DEVOPS-1154 # TEMPORARY for testing
                 with:
                     build-dir-path: build-dir/noarch
                     artifactory-dir-path: ${{ matrix.publish-repo-name}}/noarch
diff --git a/.github/workflows/reusable-python-release_conda_assets.yml b/.github/workflows/reusable-python-release_conda_assets.yml
index a7e4a601..2b5bb39b 100644
--- a/.github/workflows/reusable-python-release_conda_assets.yml
+++ b/.github/workflows/reusable-python-release_conda_assets.yml
@@ -54,7 +54,7 @@ jobs:
                     cd download-assets
                     gh release download ${INPUTS_RELEASE_TAG} -p '*.conda'
             -   name: Publish package to Artifactory
-                uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-publish_to_artifactory@7241532854727d993872b67fc761139b8438615b # v3.12.0
+                uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-publish_to_artifactory@DEVOPS-1154 # TEMPORARY for testing
                 with:
                     build-dir-path: download-assets
                     artifactory-dir-path: ${{ matrix.virtual-repo-name}}/noarch