Apply suggestions from code review

Co-authored-by: Sviatoslav Sydorenko <wk.cvs.github@sydorenko.org.ua>

Author: chrysle

source/guides/github-actions-ci-cd-sample/publish-to-test-pypi.yml

@@ -40,23 +40,29 @@ jobs:
       # for <package-name>
       url: https://pypi.org/p/<package-name>
     permissions:
-      id-token: write
+      id-token: write  # IMPORTANT: mandatory for trusted publishing
 
     steps:
-     - name: Download all the dists
-       uses: actions/download-artifact@v3
-       with:
-         name: python-package-distributions
-         path: dist/
-     - name: Publish distribution 📦 to PyPI
-       uses: pypa/gh-action-pypi-publish@release/v1
+    - name: Download all the dists
+      uses: actions/download-artifact@v3
+      with:
+        name: python-package-distributions
+        path: dist/
+    - name: Publish distribution 📦 to PyPI
+      uses: pypa/gh-action-pypi-publish@release/v1
 
   github-release:
     name: >-
       Sign the Python 🐍 distribution 📦 with Sigstore
       and upload them to GitHub Release
     needs:
     - publish-to-pypi
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: write  # IMPORTANT: mandatory for making GitHub Releases
+      id-token: write  # IMPORTANT: mandatory for sigstore
+
     steps:
      - name: Sign the dists with Sigstore
        uses: sigstore/gh-action-sigstore-python@v1.2.3
@@ -70,20 +76,22 @@ jobs:
        # created the release above.
        uses: softprops/action-gh-release@v1
        with:
-         # dist/ contains the built packages, which smoketest-artifacts/
-         # contains the signatures and certificates.
+         # `dist/` contains the built packages, and the
+         # sigstore-produced signatures and certificates.
          files: dist/**
 
   publish-to-testpypi:
     name: Publish Python 🐍 distribution 📦 to TestPyPI
     needs:
     - build
     runs-on: ubuntu-latest
+
     environment:
       name: testpypi
       url: https://test.pypi.org/p/<package-name>
+
     permissions:
-      id-token: write
+      id-token: write  # IMPORTANT: mandatory for trusted publishing
 
     steps:
     - name: Download all the dists