I see, so to confirm, I could have the workflow in a seperate repo than the repo I'm publishing? That would solve my concerns.

I see in your docs that there is a repository config option, so that could work. If directory works with a submodule or repo pulled in previous job, that could also be an option. I'll give it a try later.