fix: bypass cargo-release token check for crates.io OIDC publishing

[kurodo3]

Summary

Instead of bypassing cargo-release's token check (the previous approach of setting publish = false and running a separate cargo publish step), pre-exchange the GitHub OIDC JWT for a short-lived crates.io API token via crates.io trusted publishing, then set CARGO_REGISTRY_TOKEN before cargo-release runs.

This lets cargo-release see a valid token, pass its pre-publish check, and proceed with publish = true — so the full release (version bump → commit → tag → push → publish) is atomic again.

Why this is better than the previous approach

The previous PR set publish = false in release.toml and added a separate cargo publish step because cargo-release checks for a registry token before invoking cargo publish, which prevented the OIDC exchange from ever running.

The correct fix per crates.io trusted publishing docs is to pre-fetch the OIDC token and exchange it for an API token before cargo-release runs:

1. Fetch the GitHub OIDC JWT (ACTIONS_ID_TOKEN_REQUEST_URL with audience=crates.io)
2. Exchange with POST https://crates.io/api/v0/trusted_publishing/tokens
3. Set CARGO_REGISTRY_TOKEN in GITHUB_ENV
4. Run cargo release --execute — token check passes, publish = true works

Changes

• release.toml: reverts publish = false → publish = true; updates comment to describe the OIDC flow
• .github/workflows/release.yml: replaces split "Release + Publish" steps with a single "Get crates.io OIDC token" step followed by a unified "Release" step

Test plan

• Trigger the release workflow with a version; verify version bump commit and tag are pushed
• Verify cargo-release publishes to crates.io via OIDC (no registry token secret required)

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Updates the release configuration and GitHub Actions workflow to support crates.io “trusted publishing” by exchanging the GitHub OIDC JWT for a short-lived crates.io API token before running cargo-release, allowing publish = true and an atomic release flow again.

Changes:

• Re-enable publish = true in release.toml and document the OIDC token exchange flow.
• Add a workflow step to fetch a GitHub OIDC JWT, exchange it for a crates.io token, and export CARGO_REGISTRY_TOKEN before invoking cargo release --execute.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
release.toml	Documents the trusted publishing/OIDC flow and keeps publish = true for atomic releases.
.github/workflows/release.yml	Adds OIDC→crates.io token exchange and sets CARGO_REGISTRY_TOKEN prior to running cargo-release.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[kurodo3]

Fixed in commit 834d135 — changed to jq -er '.value'. The -e flag makes jq exit with a non-zero status when the output value is null or false, so the step fails immediately if the OIDC response doesn't contain .value rather than silently passing "null" to the exchange request.

[kurodo3]

Superseded by commit 4f01ec3 — the entire manual curl/jq exchange has been replaced by rust-lang/crates-io-auth-action@v1.0.5, the official action that handles the GitHub OIDC JWT → crates.io token exchange. The action also auto-revokes the token in its post step. No custom shell code left to mishandle missing fields.

[kurodo3]

Superseded by commit 4f01ec3 — same as above. The official rust-lang/crates-io-auth-action replaces the entire curl/jq step, so neither the .value nor the .token parsing exists anymore.

[kurodo3]

Review round addressed (commit 4f01ec3)

The Copilot jq -er feedback pointed at the right problem but the right fix was deeper: replaced the entire manual curl/jq OIDC exchange with rust-lang/crates-io-auth-action@v1.0.5, the official action built by the crates.io team for exactly this purpose.

What changed

• release.yml: The "Get crates.io OIDC token" shell step (two curl invocations + jq) is gone. In its place:

  - name: Authenticate with crates.io (trusted publishing)
    id: crates-io-auth
    uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18  # v1.0.5
  
  - name: Release
    env:
      CARGO_REGISTRY_TOKEN: ${{ steps.crates-io-auth.outputs.token }}
    run: cargo release ${{ inputs.version }} --execute --no-confirm

  The action handles the OIDC JWT fetch and crates.io exchange internally, surfaces the result as outputs.token, and automatically revokes it in its post step. CARGO_REGISTRY_TOKEN is scoped to the Release step (not exported to GITHUB_ENV) so it's not available to any other step.

• release.toml: comment updated to reference crates-io-auth-action instead of the manual curl approach.