chore: use trusted cargo publishing (#227)

Author: dsherret

.github/workflows/ci.yml

@@ -2,7 +2,7 @@ name: ci
 on: [push, pull_request]
 
 jobs:
-  build:
+  build-rust:
     runs-on: ubuntu-latest
     env:
       RUST_BACKTRACE: full
@@ -11,40 +11,41 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
-
+        uses: actions/checkout@v5
       - name: Install rust
         uses: dsherret/rust-toolchain-file@v1
+      - name: Clippy
+        run: |
+          cargo clippy --all-targets --locked --no-default-features
+          cargo clippy --all-targets --locked
+          cargo clippy --all-targets --locked --all-features
+      - name: Test
+        run: cargo test --all-features --locked
 
+  build-javascript:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+      - name: Install rust
+        uses: dsherret/rust-toolchain-file@v1
       - name: Install Deno
         uses: denoland/setup-deno@v1
         with:
-          deno-version: 1.x
-
-      - uses: actions/setup-node@v2
+          deno-version: 2.x
+      - uses: actions/setup-node@v5
         with:
-          node-version: '18.x'
+          node-version: '20.x'
           registry-url: 'https://registry.npmjs.org'
 
-      - name: Clippy
-        run: |
-          cargo clippy --all-targets --locked --no-default-features
-          cargo clippy --all-targets --locked
-          cargo clippy --all-targets --locked --all-features
-
       - name: Build
         run: deno task build && deno task node
-
       - name: Test
-        run: |
-          cargo test --all-features --locked
-          deno task test
-
+        run: deno task test
       - name: Get tag version
         if: startsWith(github.ref, 'refs/tags/')
         id: get_tag_version
         run: echo TAG_VERSION=${GITHUB_REF/refs\/tags\//} >> "$GITHUB_OUTPUT"
-
       - name: Publish deno.land/x
         uses: denoland/publish-folder@82ce065074e7174baf444332c4b7c40869a4909a
         if: startsWith(github.ref, 'refs/tags/')
@@ -55,10 +56,8 @@ jobs:
           token: ${{ secrets.DENOBOT_PAT }}
           git-user-name: denobot
           git-user-email: denobot@users.noreply.github.com
-
       - name: Build npm
         run: deno run -A ./build_npm.ts ${{ github.ref_name }}
-
       - name: Publish npm
         if: |
           github.repository == 'denoland/eszip' &&

.github/workflows/publish.yml

@@ -0,0 +1,21 @@
+name: publish
+
+on:
+  push:
+    tags:
+      - "*"
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Clone repository
+        uses: actions/checkout@v5
+      - uses: rust-lang/crates-io-auth-action@v1
+        id: auth
+      - run: cargo publish
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}

.github/workflows/release.yml

@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Clone repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           token: ${{ secrets.DENOBOT_PAT }}
 
@@ -34,4 +34,4 @@ jobs:
         run: |
           git config user.email "denobot@users.noreply.github.com"
           git config user.name "denobot"
-          deno run -A https://raw.githubusercontent.com/denoland/automation/0.14.1/tasks/publish_release.ts --${{github.event.inputs.releaseKind}} eszip
+          deno run -A jsr:@deno/rust-automation@0.21.0/publish-release --${{github.event.inputs.releaseKind}} eszip