Decouple Moldflow API public PyPI publish from GitHub Release (#85)

* [IM-14373] Decouple GitHub Release from PyPI publish

Split publish.yml into github-release.yml and pypi-publish.yml. Add PyPI ordering guard that blocks publishing newer versions before older ones are on PyPI. Update RELEASE.md to document two-step release process.

* fix: avoid gitleaks false positive on Authorization header

* fix: suppress checkov CKV2_GHA_1 and gitleaks false positives

Author: sankalps0549

.github/workflows/github-release.yml

@@ -0,0 +1,124 @@
+name: Create GitHub Release (manual)
+
+on:
+  workflow_dispatch:
+    inputs:
+      confirm:
+        description: "Confirm create release"
+        required: true
+        type: boolean
+
+permissions: {}
+
+jobs:
+  guard-ci-success:
+    runs-on: windows-2022
+    permissions:
+      contents: read
+      statuses: read
+      actions: read
+    steps:
+      - name: Ensure CI for this commit succeeded
+        shell: pwsh
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          $ownerRepo = $env:GITHUB_REPOSITORY
+          $sha = $env:GITHUB_SHA
+          $authValue = "token $env:GITHUB_TOKEN"
+          $headers = @{
+            Authorization = $authValue #gitleaks:allow
+            Accept = 'application/vnd.github+json'
+            'X-GitHub-Api-Version' = '2022-11-28'
+          }
+
+          $workflow = 'ci.yml'
+          $branch = $env:GITHUB_REF_NAME
+          $url = "https://api.github.com/repos/$ownerRepo/actions/workflows/$workflow/runs?branch=$branch&per_page=20"
+
+          try {
+            $resp = Invoke-RestMethod -Method Get -Uri $url -Headers $headers -ErrorAction Stop
+          } catch {
+            Write-Error "Blocking release: failed to query CI workflow runs ($($_.Exception.Message))"
+            exit 1
+          }
+
+          if (-not $resp.workflow_runs) {
+            Write-Error "Blocking release: no CI runs found on branch '$branch'"
+            exit 1
+          }
+
+          $matching = $resp.workflow_runs | Where-Object { $_.head_sha -eq $sha -and $_.status -eq 'completed' }
+          if (-not $matching) {
+            Write-Error "Blocking release: no completed CI run found for commit $sha"
+            exit 1
+          }
+
+          $success = $matching | Where-Object { $_.conclusion -eq 'success' } | Select-Object -First 1
+          if (-not $success) {
+            $concl = ($matching | Select-Object -First 1).conclusion
+            Write-Error "Blocking release: CI conclusion for $sha is '$concl'"
+            exit 1
+          }
+
+  build-and-release:
+    needs: guard-ci-success
+    if: ${{ github.event.inputs.confirm == 'true' && startsWith(github.ref_name, 'release/') }}
+    runs-on: windows-2022
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.13'
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+
+      - name: Check release tag does not already exist
+        shell: pwsh
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          $ownerRepo = $env:GITHUB_REPOSITORY
+          $versionJson = Get-Content -Raw -Path version.json | ConvertFrom-Json
+          $tag = "v$($versionJson.major).$($versionJson.minor).$($versionJson.patch)"
+          $authValue = "token $env:GITHUB_TOKEN"
+          $headers = @{
+            Authorization = $authValue #gitleaks:allow
+            Accept = 'application/vnd.github+json'
+            'X-GitHub-Api-Version' = '2022-11-28'
+          }
+
+          $url = "https://api.github.com/repos/$ownerRepo/releases/tags/$tag"
+          try {
+            $release = Invoke-RestMethod -Method Get -Uri $url -Headers $headers -ErrorAction Stop
+            Write-Error "Release tag '$tag' already exists (id: $($release.id)). Bump version.json before creating a new release."
+            exit 1
+          } catch {
+            $statusCode = $null
+            if ($_.Exception.Response) {
+              $statusCode = [int]$_.Exception.Response.StatusCode
+            }
+            if ($statusCode -eq 404) {
+              Write-Output "Release tag '$tag' not found — proceeding."
+            } else {
+              Write-Error "Failed to check for existing release tag '$tag': $($_.Exception.Message)"
+              exit 1
+            }
+          }
+
+      - name: Build package
+        run: python run.py build
+
+      - name: Create GitHub Release
+        run: python run.py release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}