chore(github-actions): Review workflow structure and fine tune permissions (#30789)

Issue number: resolves #

---------

<!-- Please do not submit updates to dependencies unless it fixes an
issue. -->

<!-- Please try to limit your pull request to one type (bugfix, feature,
etc). Submit multiple pull requests if needed. -->

## What is the current behavior?
<!-- Please describe the current behavior that you are modifying. -->

- Permissions not set as expected

## What is the new behavior?
<!-- Please describe the behavior or changes that are being added by
this PR. -->

- Permissions are properly set throughout the hierarchy
- Workflow structure prevents unintended standalone executions

## Does this introduce a breaking change?

- [ ] Yes
- [x] No

<!--
  If this introduces a breaking change:
1. Describe the impact and migration path for existing applications
below.
  2. Update the BREAKING.md file with the breaking change.
3. Add "BREAKING CHANGE: [...]" to the commit description when merging.
See
https://github.com/ionic-team/ionic-framework/blob/main/docs/CONTRIBUTING.md#footer
for more information.
-->


## Other information

<!-- Any other information that is important to this PR such as
screenshots of how the component looks before and after the change. -->

.github/workflows/dev-build.yml

@@ -1,7 +1,6 @@
 name: 'Ionic Dev Build'
 
 on:
-  workflow_dispatch:
   workflow_call:
 
 permissions:
@@ -30,6 +29,7 @@ jobs:
   release-ionic:
     needs: [create-dev-hash]
     permissions:
+      contents: read
       id-token: write
     uses: ./.github/workflows/release-ionic.yml
     with:

.github/workflows/nightly.yml

@@ -1,10 +1,6 @@
 name: 'Ionic Nightly Build'
 
 on:
-  schedule:
-    # Run every Monday-Friday
-    # at 6:00 UTC (6:00 am UTC)
-    - cron: '00 06 * * 1-5'
   workflow_call:
 
 permissions:
@@ -35,6 +31,7 @@ jobs:
   release-ionic:
     needs: [create-nightly-hash]
     permissions:
+      contents: read
       id-token: write
     uses: ./.github/workflows/release-ionic.yml
     with:

.github/workflows/publish-npm.yml

@@ -1,59 +0,0 @@
-name: 'Release'
-description: 'Releases a package'
-inputs:
-  scope:
-    description: 'The package to release. Must match a package specified in lerna.json.'
-  version:
-    description: 'The type of version to release.'
-  tag:
-    description: 'The tag to publish to on NPM.'
-  preid:
-    description: "Prerelease identifier such as 'alpha', 'beta', 'rc', or 'next'. Leave blank to skip prerelease tagging."
-  working-directory:
-    description: 'The directory of the package.'
-  folder:
-    default: './'
-    description: 'A folder containing a package.json file.'
-  node-version:
-    description: 'Node.js version to use when publishing.'
-    required: false
-    default: '24.x'
-runs:
-  using: 'composite'
-  steps:
-    - name: 🟢 Configure Node for Publish
-      uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
-      with:
-        node-version: ${{ inputs.node-version }}
-        registry-url: 'https://registry.npmjs.org'
-        scope: '@ionic'
-    # Provenance requires npm 9.5.0+
-    - name: 📦 Install latest npm
-      run: npm install -g npm@latest
-      shell: bash
-    # This ensures the local version of Lerna is installed
-    # and that we do not use the global Lerna version
-    - name: 🕸️ Install root dependencies
-      run: npm ci
-      shell: bash
-    - name: 📦 Install Dependencies
-      run: npx lerna@5 bootstrap --include-dependencies --scope ${{ inputs.scope }} --ignore-scripts -- --legacy-peer-deps
-      shell: bash
-      working-directory: ${{ inputs.working-directory }}
-    - name: 🏷️ Set Version
-      run: |
-        if [ -z "${{ inputs.preid }}" ]; then
-          npx lerna@5 version ${{ inputs.version }} --yes --exact --no-changelog --no-push --no-git-tag-version
-        else
-          npx lerna@5 version ${{ inputs.version }} --yes --exact --no-changelog --no-push --no-git-tag-version --preid=${{ inputs.preid }}
-        fi
-      shell: bash
-      working-directory: ${{ inputs.working-directory }}
-    - name: 🏗️ Run Build
-      run: npm run build
-      shell: bash
-      working-directory: ${{ inputs.working-directory }}
-    - name: 🚀 Publish to NPM
-      run: npm publish ${{ inputs.folder }} --tag ${{ inputs.tag }} --provenance
-      shell: bash
-      working-directory: ${{ inputs.working-directory }}

.github/workflows/release-ionic.yml

@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-    - uses: ./.github/workflows/publish-npm.yml
+    - uses: ./.github/actions/publish-npm
       with:
         scope: '@ionic/core'
         tag: ${{ inputs.tag }}
@@ -55,7 +55,7 @@ jobs:
         name: ionic-docs
         path: ./packages/docs
         filename: DocsBuild.zip
-    - uses: ./.github/workflows/publish-npm.yml
+    - uses: ./.github/actions/publish-npm
       with:
         scope: '@ionic/docs'
         tag: ${{ inputs.tag }}
@@ -74,7 +74,7 @@ jobs:
         name: ionic-core
         path: ./core
         filename: CoreBuild.zip
-    - uses: ./.github/workflows/publish-npm.yml
+    - uses: ./.github/actions/publish-npm
       with:
         scope: '@ionic/angular'
         tag: ${{ inputs.tag }}
@@ -100,7 +100,7 @@ jobs:
         name: ionic-core
         path: ./core
         filename: CoreBuild.zip
-    - uses: ./.github/workflows/publish-npm.yml
+    - uses: ./.github/actions/publish-npm
       with:
         scope: '@ionic/react'
         tag: ${{ inputs.tag }}
@@ -125,7 +125,7 @@ jobs:
         name: ionic-core
         path: ./core
         filename: CoreBuild.zip
-    - uses: ./.github/workflows/publish-npm.yml
+    - uses: ./.github/actions/publish-npm
       with:
         scope: '@ionic/vue'
         tag: ${{ inputs.tag }}
@@ -150,7 +150,7 @@ jobs:
         name: ionic-core
         path: ./core
         filename: CoreBuild.zip
-    - uses: ./.github/workflows/publish-npm.yml
+    - uses: ./.github/actions/publish-npm
       with:
         scope: '@ionic/angular-server'
         tag: ${{ inputs.tag }}
@@ -176,7 +176,7 @@ jobs:
         name: ionic-react
         path: ./packages/react
         filename: ReactBuild.zip
-    - uses: ./.github/workflows/publish-npm.yml
+    - uses: ./.github/actions/publish-npm
       with:
         scope: '@ionic/react-router'
         tag: ${{ inputs.tag }}
@@ -201,7 +201,7 @@ jobs:
         name: ionic-vue
         path: ./packages/vue
         filename: VueBuild.zip
-    - uses: ./.github/workflows/publish-npm.yml
+    - uses: ./.github/actions/publish-npm
       with:
         scope: '@ionic/vue-router'
         tag: ${{ inputs.tag }}

.github/workflows/release-orchestrator.yml

@@ -1,4 +1,4 @@
-name: 'Ionic Release'
+name: 'Release - Ionic Framework'
 
 on:
   schedule:

.github/workflows/release.yml

@@ -1,37 +1,6 @@
 name: 'Ionic Production Release'
 
 on:
-  workflow_dispatch:
-    inputs:
-      version:
-        required: true
-        type: choice
-        description: Which version should be published?
-        options:
-          - patch
-          - minor
-          - major
-          - prepatch
-          - preminor
-          - premajor
-          - prerelease
-      tag:
-        required: true
-        type: choice
-        description: Which npm tag should this be published to?
-        options:
-          - latest
-          - next
-      preid:
-        type: choice
-        description: Which prerelease identifier should be used? This is only needed when version is "prepatch", "preminor", "premajor", or "prerelease".
-        default: ''
-        options:
-          - ''
-          - alpha
-          - beta
-          - rc
-          - next
   workflow_call:
     inputs:
       version: