chore(ci): harden release workflow (#5669)

.github/workflows/deploy_docs.yml

@@ -35,16 +35,7 @@ jobs:
         with:
           filter: "docs/docs/**"
 
-  # TODO: Uncomment this to run on PRs
-  # run-changed-notebooks:
-  #   needs: get-changed-files
-  #   uses: ./.github/workflows/run_notebooks.yml
-  #   secrets: inherit
-  #   with:
-  #     changed-files: ${{ needs.get-changed-files.outputs.changed-files }}
-
   deploy:
-    # needs: run-changed-notebooks
     runs-on: ubuntu-latest
     timeout-minutes: 10 # Job will be cancelled if it runs for more than 10 minutes
     env:

.github/workflows/pr_lint.yml

@@ -39,6 +39,7 @@ jobs:
             scheduler-kafka
             sdk-py
             docs
+            ci
           requireScope: false
           ignoreLabels: |
             ignore-lint-pr-title

.github/workflows/release.yml

@@ -137,7 +137,9 @@ jobs:
     needs:
       - build
       - release-notes
-    permissions: write-all
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/_test_release.yml
     with:
       working-directory: ${{ inputs.working-directory }}