diff --git a/.github/actions/ci/action.yml b/.github/actions/ci/action.yml
new file mode 100644
index 0000000..c115772
--- /dev/null
+++ b/.github/actions/ci/action.yml
@@ -0,0 +1,48 @@
+name: Shared CI
+description: Shared build, style, test, and coverage steps for okhttp-eventsource.
+inputs:
+  java_version:
+    description: 'Java version to use (e.g. 8, 11, 17).'
+    required: true
+  run_tests:
+    description: 'If true, run unit tests, coverage report, and coverage verification.'
+    required: false
+    default: 'true'
+
+runs:
+  using: composite
+  steps:
+    - uses: actions/setup-java@v4
+      with:
+        distribution: 'temurin'
+        java-version: ${{ inputs.java_version }}
+
+    - name: Restore dependencies
+      shell: bash
+      run: ./gradlew dependencies
+
+    - name: Build jar
+      shell: bash
+      run: ./gradlew jar
+
+    - name: Checkstyle
+      shell: bash
+      run: ./gradlew checkstyleMain
+
+    - name: Unit tests
+      if: ${{ inputs.run_tests == 'true' }}
+      shell: bash
+      run: make test
+
+    - name: Generate test coverage report
+      if: ${{ inputs.run_tests == 'true' }}
+      shell: bash
+      run: |
+        ./gradlew jacocoTestReport
+        mkdir -p coverage/
+        cp -r build/reports/jacoco/test/* ./coverage
+
+    - name: Enforce test coverage
+      if: ${{ inputs.run_tests == 'true' }}
+      shell: bash
+      run: ./gradlew jacocoTestCoverageVerification
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index beaf543..6f370ad 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,30 +15,18 @@ jobs:
     runs-on: ubuntu-latest
 
     strategy:
-      fail-fast: false
+      fail-fast: false # false = do not cancel sibling matrix jobs when one leg fails
       matrix:
         java-version: ["8", "11", "17"]
 
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-java@v4
-        with:
-          distribution: 'temurin' # See 'Supported distributions' for available options
-          java-version: ${{ matrix.java-version }}
-
-      - run: ./gradlew dependencies
-      - run: ./gradlew jar
-      - run: ./gradlew checkstyleMain
-
-      - run: make test
 
-      - name: Generate test coverage report
-        run: |
-            ./gradlew jacocoTestReport
-            mkdir -p coverage/
-            cp -r build/reports/jacoco/test/* ./coverage
-      - name: Enforce test coverage
-        run: ./gradlew jacocoTestCoverageVerification
+      - name: Shared CI
+        uses: ./.github/actions/ci
+        with:
+          java_version: ${{ matrix.java-version }}
+          run_tests: true
 
       - name: Save test results
         run: |
@@ -55,7 +43,8 @@ jobs:
           name: ${{ matrix.java-version }} code coverage
           path: ./coverage
 
-      - name: run contract tests
+      # After junit/coverage artifacts: contract test failures must not skip uploads above.
+      - name: Contract tests
         run: make contract-tests
 
   windows:
@@ -66,7 +55,7 @@ jobs:
         shell: powershell
 
     strategy:
-      fail-fast: false
+      fail-fast: false # false = do not cancel sibling matrix jobs when one leg fails
       matrix:
         java-version: ["11.0.2.01", "17.0.1"]
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 981a92e..cb2c8b1 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -31,7 +31,24 @@ on:
         required: true
 
 jobs:
+  ci:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false # false = do not cancel sibling matrix jobs when one leg fails
+      matrix:
+        java-version: ["8", "11", "17"]
+    steps:
+      # https://github.com/actions/checkout/releases/tag/v4.3.1
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - name: Shared CI
+        uses: ./.github/actions/ci
+        with:
+          java_version: ${{ matrix.java-version }}
+          run_tests: ${{ inputs.run_tests }}
+
   build-and-publish:
+    needs: ci
     runs-on: ubuntu-latest
     permissions:
       id-token: write
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 6a12a7d..14bd0de 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -27,6 +27,9 @@ jobs:
 
   call-workflow-publish:
     needs: release-please
+    permissions:
+      id-token: write
+      contents: write
     uses: ./.github/workflows/publish.yml
     if: ${{ needs.release-please.outputs.releases_created == 'true' }}
     with: