CWG-75: Secure jobs with secrets and raise awareness

Closes CWG-75

{{cookiecutter.project_slug}}/.gitlab-ci.yml

@@ -101,7 +101,8 @@ run_unit_tests_coverage:
 
 package_files:
   stage: package
-#  image: python:3.8
+  tags:
+    - dind
   artifacts:
     expire_in: 1w
     paths:
@@ -155,6 +156,7 @@ publish_on_test_pypi:
   when: manual
   rules:
     - if: $CI_COMMIT_TAG
+  allow_failure: true
   script:
     - echo "run twine for test pypi"
     # - |
@@ -163,6 +165,7 @@ publish_on_test_pypi:
     # TODO: replace URL with a pipy URL
     #   python -m twine upload \
     #   --repository-url ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/pypi dist/*
+    - exit 1
 
 publish_on_pypi:
   stage: publish
@@ -172,6 +175,7 @@ publish_on_pypi:
   when: manual
   rules:
     - if: $CI_COMMIT_TAG
+  allow_failure: true
   script:
     - echo "run twine for pypi"
     # - |
@@ -180,6 +184,7 @@ publish_on_pypi:
     # TODO: replace URL with a pipy URL
     #   python -m twine upload \
     #   --repository-url ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/pypi dist/*
+    - exit 1
 
 publish_to_readthedocs:
   stage: publish
@@ -193,3 +198,14 @@ publish_to_readthedocs:
   script:
     - echo "scp docs/* ???"
     - exit 1
+
+release_job:
+  stage: publish
+  image: registry.gitlab.com/gitlab-org/release-cli:latest
+  rules:
+    - if: '$CI_COMMIT_TAG && $CI_COMMIT_REF_PROTECTED == "true"'
+  script:
+    - echo "running release_job"
+  release:
+    tag_name: '$CI_COMMIT_TAG'
+    description: '$CI_COMMIT_TAG'