Switch to trusted publishing

.github/workflows/publish.yml

@@ -1,27 +1,31 @@
-# This is triggered after the Release workflow successfully completes its run
+# This is triggered after a tag is pushed
+# Combining trusted publishing with cargo-dist is non-trivial, so we run the crates.io
+# and the GitHub release workflow in parallel
 name: Publish on crates.io
 on:
-  workflow_run:
-    workflows:
-      - Release
-    types:
-      - completed
-env:
-  CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+  push:
+    tags:
+      - '**[0-9]+.[0-9]+.[0-9]+*'
+
+permissions: {}
+
 jobs:
-  cargo-publish:
+  publish:
+    name: Publish to crates.io
     runs-on: ubuntu-latest
-    if: ${{ !github.event.pull_request && (github.event.workflow_run.conclusion == 'success') && (github.event.workflow.name == 'Release') }}
+    environment: publish
+    permissions:
+      id-token: write # Required for trusted publishing OIDC
     steps:
-      - name: Print workflow event name
-        run: echo "${{ github.event.workflow.name }}"
       - name: Checkout sources
-        uses: actions/checkout@v4
-      - name: Install stable toolchain
-        uses: dtolnay/rust-toolchain@master
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          toolchain: stable
+          persist-credentials: false
+      - name: Install stable toolchain
+        run: rustup update stable --no-self-update && rustup default stable
+      - uses: rust-lang/crates-io-auth-action@3268eb413133e2960fa4ae0e963ca76380c54cd9 # v1.0.6
+        id: auth
       - name: Publish bindgen (lib)
-        run: cargo publish --package bindgen --token ${CARGO_REGISTRY_TOKEN}
-      - name: Publish bindgen-cli
-        run: cargo publish --package bindgen-cli --token ${CARGO_REGISTRY_TOKEN}
+        run: cargo publish --package bindgen --package bindgen-cli
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}

CONTRIBUTING.md

@@ -580,8 +580,7 @@ The `patch` and `minor` refer to semver concepts:
 - `minor` would bump **v0.68.2** to **v0.69.0**
 
 > NOTE:
-> We use the `--no-publish` so that the crates are only published after the release is complete.
-> This is automatic, provided the release CI job is successful.
+> We use the `--no-publish`, because the crates are published to crates.io via a separate [CI workflow](#create-a-new-cratesio-release).
 
 ### Create a new release on Github
 
@@ -615,11 +614,9 @@ by running `git tag -d`. Once all the extra changes are in the `main` branch,
 you can trigger a release by creating a new tag using `git tag` and push it
 using `git push --tag`.
 
-### Create a new crates.io release
+### Creating a new crates.io release
 
-Go to [the Publish
-workflow](https://github.com/rust-lang/rust-bindgen/actions/workflows/publish.yml)
-and run a new workflow using the "Run Workflow" button.
+The bindgen crates are automatically published to crates.io when a tag is pushed to the repository.
 
 Remember that crates.io releases cannot be deleted!