name: Publish to crates.io
on:
push:
tags:
- "v*"
jobs:
publish:
runs-on: ubuntu-24.04
environment: release
permissions:
id-token: write
steps:
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd - name: Trusted publishing crates.io
uses: rust-lang/crates-io-auth-action@bbd81622f20ce9e2dd9622e3218b975523e45bbe id: auth
- name: Install Nix
uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 with:
extra_nix_config: |
experimental-features = nix-command flakes
accept-flake-config = true
- name: Verify tag version matches Cargo.toml version
run: |
TAG_VERSION="${GITHUB_REF_NAME#v}"
CARGO_VERSION=$(nix develop -c -- toml get -r Cargo.toml package.version)
echo "Tag version: $TAG_VERSION"
echo "Cargo.toml version: $CARGO_VERSION"
if [ "$TAG_VERSION" != "$CARGO_VERSION" ]; then
echo "Tag version does not match Cargo.toml version"
exit 1
fi
shell: bash
- name: Cargo publish
run: nix develop -c -- cargo publish
env:
CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}