ci: publish rust crates using OIDC

santhoshtr · santhoshtr · commit 985408c4932f · 2025-11-20T12:03:11.000+05:30
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
@@ -1,7 +1,8 @@
-name: Rust - Build and test
+name: Rust - Build, test and publish
 on:
   push:
     branches: [ "master" ]
+    tags: ['v*']  # Triggers when pushing tags starting with 'v'
   pull_request:
     branches: [ "master" ]
 
@@ -53,3 +54,17 @@ jobs:
         name: ${{ matrix.asset_name }}
         path: target/${{ matrix.target }}/release/${{ matrix.artifact_name }}
         if-no-files-found: error
+  publish:
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: build
+    environment: release  # Optional: for enhanced security
+    permissions:
+      id-token: write     # Required for OIDC token exchange
+    steps:
+    - uses: actions/checkout@v5
+    - uses: rust-lang/crates-io-auth-action@v1
+      id: auth
+    - run: cargo publish
+      env:
+        CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
