From 5570de34969848746993641b4cc4e6452192134f Mon Sep 17 00:00:00 2001
From: David Hotham <david.hotham@blueyonder.co.uk>
Date: Wed, 20 May 2026 10:12:06 +0100
Subject: [PATCH] trusted publishing

---
 .github/workflows/release.yml | 46 +++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..e435f4c
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,46 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v[0-9]*"
+
+permissions: {}
+
+# Never cancel an in-flight publish: a half-completed release (tag pushed,
+# artifact missing) is worse than two overlapping runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    name: Publish
+    runs-on: ubuntu-latest
+    environment: publish
+    permissions:
+      contents: read
+      id-token: write # OIDC token for crates.io trusted publishing
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Verify version
+        env:
+          EXPECTED: ${{ github.ref_name }}
+        run: |
+          ACTUAL=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[0].version')
+          if [ "v$ACTUAL" != "$EXPECTED" ]; then
+            echo "::error::Tag ($EXPECTED) does not match Cargo.toml version ($ACTUAL)"
+            exit 1
+          fi
+
+      - name: Authenticate with crates.io
+        uses: rust-lang/crates-io-auth-action@bbd81622f20ce9e2dd9622e3218b975523e45bbe # v1.0.4
+        id: auth
+
+      - name: Publish
+        run: cargo publish
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}