0.2.4: test trusted publishing (#37)

Signed-off-by: Jason Hall <jason@chainguard.dev>

.github/workflows/release.yaml

@@ -0,0 +1,47 @@
+name: Release
+
+on:
+  release:
+    types: [published]
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  publish:
+    name: Publish to crates.io
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Install Rust
+      uses: dtolnay/rust-toolchain@stable
+      with:
+        toolchain: stable
+
+    - name: Cache cargo registry
+      uses: actions/cache@v4
+      with:
+        path: ~/.cargo/registry
+        key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
+
+    - name: Cache cargo index
+      uses: actions/cache@v4
+      with:
+        path: ~/.cargo/git
+        key: ${{ runner.os }}-cargo-index-${{ hashFiles('**/Cargo.lock') }}
+
+    - name: Verify version matches tag
+      run: |
+        CARGO_VERSION=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[0].version')
+        TAG_VERSION=${GITHUB_REF#refs/tags/v}
+        if [ "$CARGO_VERSION" != "$TAG_VERSION" ]; then
+          echo "Version mismatch: Cargo.toml has $CARGO_VERSION, but tag is $TAG_VERSION"
+          exit 1
+        fi
+
+    - name: Run tests
+      run: cargo test --verbose
+
+    - name: Publish to crates.io
+      run: cargo publish --token ${{ secrets.CARGO_TOKEN }}

.github/workflows/release.yml

@@ -11,6 +11,8 @@ jobs:
   publish:
     name: Publish to crates.io
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
     - uses: actions/checkout@v4
 
@@ -40,8 +42,11 @@ jobs:
           exit 1
         fi
 
-    - name: Run tests
-      run: cargo test --verbose
+    - run: cargo test --verbose
 
-    - name: Publish to crates.io
-      run: cargo publish --token ${{ secrets.CARGO_TOKEN }}
+    - id: auth
+      uses: rust-lang/crates-io-auth-action@v1
+
+    - run: cargo publish
+      env:
+        CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}

Cargo.lock

@@ -202,7 +202,7 @@ dependencies = [
 
 [[package]]
 name = "testscript-rs"
-version = "0.2.3"
+version = "0.2.4"
 dependencies = [
  "anyhow",
  "arbitrary",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "testscript-rs"
-version = "0.2.3"
+version = "0.2.4"
 edition = "2021"
 authors = ["Jason Hall"]
 license = "Apache-2.0"