# Publish to crates.io on a version tag (v0.1.1, v0.2.0, ...).
#
# Auth: the CARGO_REGISTRY_TOKEN repository secret (crates.io API token).
# CI correctness gates already run on every push, including the tag push —
# this job only checks tag/Cargo.toml agreement and publishes.
name: Release
on:
push:
tags:
- "v*"
jobs:
publish:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: dtolnay/rust-toolchain@stable
# Refuse to publish if the tag doesn't match the crate version.
- run: |
crate_version=$(cargo pkgid | sed 's/.*[@#]//')
tag_version=${GITHUB_REF_NAME#v}
if [ "$crate_version" != "$tag_version" ]; then
echo "Tag v$tag_version does not match Cargo.toml version $crate_version" >&2
exit 1
fi
- run: cargo publish --locked
env:
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}