chore: switch to trusted crates.io publishing (#318)

Author: dsherret

.github/workflows/ci.yml

@@ -5,8 +5,6 @@ on:
     branches: [main]
   push:
     branches: [main]
-    tags:
-      - "*"
   workflow_dispatch:
 
 jobs:
@@ -23,7 +21,7 @@ jobs:
 
     steps:
       - name: Clone repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - uses: denoland/setup-deno@v1
       - uses: dsherret/rust-toolchain-file@v1
@@ -46,12 +44,3 @@ jobs:
         run: cargo build --all-targets --all-features --release
       - name: Test
         run: cargo test --all-targets --all-features --release
-
-      - name: Publish
-        if: |
-          github.repository == 'denoland/deno_ast' &&
-          startsWith(github.ref, 'refs/tags/')
-        env:
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
-        run: |
-          cargo publish

.github/workflows/publish.yml

@@ -0,0 +1,21 @@
+name: publish
+
+on:
+  push:
+    tags:
+      - "*"
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Clone repository
+        uses: actions/checkout@v5
+      - uses: rust-lang/crates-io-auth-action@v1
+        id: auth
+      - run: cargo publish
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}

.github/workflows/release.yml

@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Clone repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           token: ${{ secrets.DENOBOT_PAT }}