trusted publishing

.github/workflows/release.yml

@@ -0,0 +1,46 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v[0-9]*"
+
+permissions: {}
+
+# Never cancel an in-flight publish: a half-completed release (tag pushed,
+# artifact missing) is worse than two overlapping runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    name: Publish
+    runs-on: ubuntu-latest
+    environment: publish
+    permissions:
+      contents: read
+      id-token: write # OIDC token for crates.io trusted publishing
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Verify version
+        env:
+          EXPECTED: ${{ github.ref_name }}
+        run: |
+          ACTUAL=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[0].version')
+          if [ "v$ACTUAL" != "$EXPECTED" ]; then
+            echo "::error::Tag ($EXPECTED) does not match Cargo.toml version ($ACTUAL)"
+            exit 1
+          fi
+
+      - name: Authenticate with crates.io
+        uses: rust-lang/crates-io-auth-action@bbd81622f20ce9e2dd9622e3218b975523e45bbe # v1.0.4
+        id: auth
+
+      - name: Publish
+        run: cargo publish
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}