| 1 | name: release-crates |
| 2 | |
| 3 | on: |
| 4 | push: |
| 5 | tags: ["v*"] |
| 6 | |
| 7 | jobs: |
| 8 | publish: |
| 9 | runs-on: ubuntu-latest |
| 10 | permissions: |
| 11 | id-token: write # required for the OIDC token exchange with crates.io |
| 12 | steps: |
| 13 | - uses: actions/checkout@v5 |
| 14 | - uses: dtolnay/rust-toolchain@stable |
| 15 | # Trusted publishing: no long-lived token to store or rotate. This action |
| 16 | # exchanges a GitHub OIDC token for a short-lived crates.io token (valid 30 |
| 17 | # minutes) and revokes it in its post step. |
| 18 | # |
| 19 | # It only works if a trusted publisher is configured for this crate on |
| 20 | # crates.io naming SplitFireAI / splitfire-agent / this exact filename |
| 21 | # (release-crates.yml). The workflow filename is part of the trust check, |
| 22 | # so renaming this file breaks publishing until crates.io is updated too. |
| 23 | - uses: rust-lang/crates-io-auth-action@v1.0.5 |
| 24 | id: auth |
| 25 | # Publishes the version in Cargo.toml to crates.io. crates.io is immutable: |
| 26 | # a version can only be published once (then yanked, never replaced), so the |
| 27 | # tag's Cargo.toml version must not already be on crates.io. |
| 28 | - run: cargo publish --locked |
| 29 | env: |
| 30 | CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }} |