Debugging workflow permissions and add PR dry-run (#2082)

.github/workflows/ci-build-docs.yml

@@ -33,8 +33,7 @@ jobs:
           activate-environment: true
 
       - name: 🏗️ Install dependencies
-        run: |
-          uv pip install -r pyproject.toml --group docs
+        run: uv pip install -r pyproject.toml --group docs
 
       - name: 🧪 Test Docs Build
         run: uv run mkdocs build --verbose

.github/workflows/publish-pre-release.yml

@@ -7,11 +7,18 @@ on:
       - "[0-9]+.[0-9]+[0-9]+.[0-9]+b[0-9]"
       - "[0-9]+.[0-9]+[0-9]+.[0-9]+rc[0-9]"
   workflow_dispatch:
+  pull_request:
+    branches: [main, develop]
+    paths:
+      - '.github/workflows/build-package.yml'
+      - '.github/workflows/publish-pre-release.yml'
 
 permissions: {} # Explicitly remove all permissions by default
 
 jobs:
   build:
+    permissions:
+      contents: read
     uses: ./.github/workflows/build-package.yml
 
   publish-pre-release:
@@ -32,6 +39,7 @@ jobs:
           name: dist
 
       - name: 🚀 Publish to PyPi
+        if: github.event_name != 'pull_request'
         uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
         with:
           attestations: true

.github/workflows/publish-release.yml

@@ -5,11 +5,18 @@ on:
     tags:
       - "[0-9]+.[0-9]+[0-9]+.[0-9]"
   workflow_dispatch:
+  pull_request:
+    branches: [main, develop]
+    paths:
+      - '.github/workflows/build-package.yml'
+      - '.github/workflows/publish-release.yml'
 
 permissions: {} # Explicitly remove all permissions by default
 
 jobs:
   build:
+    permissions:
+      contents: read
     uses: ./.github/workflows/build-package.yml
 
   publish-release:
@@ -30,6 +37,7 @@ jobs:
           name: dist
 
       - name: 🚀 Publish to PyPi
+        if: github.event_name != 'pull_request'
         uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
         with:
           attestations: true

.github/workflows/publish-testpypi.yml

@@ -2,11 +2,18 @@ name: Publish Supervision Releases to TestPyPI
 
 on:
   workflow_dispatch:
+  pull_request:
+    branches: [main, develop]
+    paths:
+      - '.github/workflows/build-package.yml'
+      - '.github/workflows/publish-testpypi.yml'
 
 permissions: {} # Explicitly remove all permissions by default
 
 jobs:
   build:
+    permissions:
+      contents: read
     uses: ./.github/workflows/build-package.yml
 
   publish-testpypi:
@@ -27,6 +34,7 @@ jobs:
           name: dist
 
       - name: 🚀 Publish to Test-PyPi
+        if: github.event_name != 'pull_request'
         uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
         with:
           repository-url: https://test.pypi.org/legacy/