fix (cd): passed the secrets env var from Orchestrator to the subworkflows explicitly

Signed-off-by: rafaeljohn9 <rafaeljohb@gmail.com>

Author: RafaelJohn9

.github/workflows/publish-cargo.yml

@@ -1,7 +1,12 @@
+# .github/workflows/publish-cargo.yml
 name: Publish Cargo
 
 on:
   workflow_call:
+    inputs:
+      cargo_token:
+        required: true
+        type: string
   workflow_dispatch:
 
 permissions:
@@ -16,4 +21,5 @@ jobs:
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
 
-      - run: cargo publish --token "${{ secrets.CARGO_REGISTRY_TOKEN }}"
+      - name: Publish to crates.io
+        run: cargo publish --token "${{ inputs.cargo_token }}"

.github/workflows/publish-pypi.yml

@@ -2,6 +2,10 @@ name: Publish PyPI
 
 on:
   workflow_call:
+    inputs:
+      pypi_token:
+        required: true
+        type: string
   workflow_dispatch:
 
 jobs:
@@ -26,4 +30,4 @@ jobs:
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          password: ${{ secrets.PYPI_API_TOKEN }}
+          password: ${{ inputs.pypi_token }}

.github/workflows/release-tag.yml

@@ -12,6 +12,10 @@ jobs:
   publish-pypi:
     uses: ./.github/workflows/publish-pypi.yml
     needs: build  # ← Can run after build, even in parallel with cargo
+    with:
+      pypi_token: ${{ secrets.PYPI_API_TOKEN }}
 
   publish-cargo:
-    uses: ./.github/workflows/publish-cargo.yml
+    uses: ./.github/workflows/publish-cargo.yml
+    with:
+      cargo_token: ${{ secrets.CARGO_REGISTRY_TOKEN }}