[BRE-1935] Migrate workflow: cd.yml (Phase 2)

.github/workflows/cd.yml

@@ -1,38 +1,34 @@
+---
 name: Release
 
 on:
   release:
     types: [created]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag to publish (e.g., v1.2.3)"
+        required: true
+        type: string
+
+permissions: {}
 
 jobs:
-  publish:
-    name: Publish
-    environment: PyPI
+  trigger-publish:
+    name: Trigger Publish in Deploy Repo
     runs-on: ubuntu-24.04
     permissions:
-      contents: read
+      deployments: write
       id-token: write
     steps:
-      - name: Checkout Repo
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Install poetry
-        run: pipx install poetry
-
-      - name: Set up Python
-        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
+      - name: Trigger publish via bitwarden/deploy
+        uses: bitwarden/gh-actions/trigger-actions@main
         with:
-          python-version: '3.10'
-          cache: 'poetry'
-
-      - name: Setup
-        run: poetry env use 3.10
-
-      - name: Environment information
-        run: poetry env info
-      - name: Build package
-        run: poetry build
-      - name: Publish - PyPI
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+          azure_subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+          azure_tenant_id: ${{ secrets.AZURE_TENANT_ID }}
+          azure_client_id: ${{ secrets.AZURE_CLIENT_ID }}
+          task: publish-passwordless-python
+          data: |
+            {
+              "tag": "${{ inputs.tag || github.event.release.tag_name }}"
+            }