name: Publish to crates.io

on:
  release:
    types: [released] # only when creating a full release (not pre-release or draft)

jobs:
  publish:
    runs-on: ubuntu-latest

    environment: publish
    permissions:
      id-token: write

    steps:
    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
    - uses: rust-lang/crates-io-auth-action@b7e9a28eded4986ec6b1fa40eeee8f8f165559ec # v1.0.3
      id: auth
    - run: cargo publish --locked
      env:
        CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
