Publish to Hex from the release script

release.sh stopped after generating checksums and printed the remaining
four steps for the operator to run by hand. It now commits and pushes
the checksum file and runs mix hex.publish --yes, so a release is one
command.

Non-interactive publishing needs HEX_API_KEY, Hex's unencrypted write
key, since without it hex.publish prompts for the local password. The
script checks for it alongside the gh CLI check so a missing key fails
before the tag is pushed rather than after CI has built every target.
Set SKIP_PUBLISH=1 for the previous behaviour.

Author: lpgauth

CLAUDE.md

@@ -59,10 +59,19 @@ tag).
 ## Releasing
 
 ```bash
-./scripts/release.sh  # tags, pushes, waits for CI, generates checksums
+export HEX_API_KEY=...   # key with api:write permission
+./scripts/release.sh     # tag, wait for CI, checksums, commit, publish
 ```
 
-The script reads the version from `mix.exs`, creates a git tag, waits for the release workflow to build precompiled NIFs for all targets, then generates checksums. After it completes, commit the checksum file and run `mix hex.publish`.
+The script reads the version from `mix.exs`, creates a git tag, waits for the
+release workflow to build precompiled NIFs for all targets, generates checksums,
+commits and pushes them, then runs `mix hex.publish --yes`.
+
+`HEX_API_KEY` is Hex's unencrypted write key: setting it skips the local-password
+prompt, which is what makes the publish step non-interactive. Mint one with
+`mix hex.user key generate --key-name torque-release --permission api:write`.
+The script fails up front (before tagging) if it's missing. To stop after
+checksums and publish by hand instead, run with `SKIP_PUBLISH=1`.
 
 ### Version bumping
 

scripts/release.sh

@@ -37,6 +37,13 @@ if ! command -v gh >/dev/null 2>&1; then
   exit 1
 fi
 
+if [ -z "${SKIP_PUBLISH:-}" ] && [ -z "${HEX_API_KEY:-}" ]; then
+  echo "error: HEX_API_KEY not set — export a key with api:write permission"
+  echo "  generate: mix hex.user key generate --key-name torque-release --permission api:write"
+  echo "  or set SKIP_PUBLISH=1 to stop after checksums and publish by hand"
+  exit 1
+fi
+
 # Create and push tag
 echo "==> Creating tag ${TAG}"
 git tag "$TAG"
@@ -74,10 +81,28 @@ gh release edit "$TAG" --draft=false
 echo "==> Generating checksums..."
 TORQUE_BUILD=true mix rustler_precompiled.download Torque.Native --all --print
 
-echo "==> Checksums written to checksum-Elixir.Torque.Native.exs"
+if [ -n "${SKIP_PUBLISH:-}" ]; then
+  echo "==> Checksums written to checksum-Elixir.Torque.Native.exs"
+  echo ""
+  echo "Next steps:"
+  echo "  1. git add checksum-Elixir.Torque.Native.exs"
+  echo "  2. git commit -m 'Add checksums for ${TAG}'"
+  echo "  3. git push origin main"
+  echo "  4. mix hex.publish"
+  exit 0
+fi
+
+echo "==> Committing checksums..."
+git add checksum-Elixir.Torque.Native.exs
+if [ -n "$(git status --porcelain checksum-Elixir.Torque.Native.exs)" ]; then
+  git commit -m "Add checksums for ${TAG}"
+  git push origin HEAD
+else
+  echo "    no changes to commit"
+fi
+
+echo "==> Publishing to Hex..."
+mix hex.publish --yes
+
 echo ""
-echo "Next steps:"
-echo "  1. git add checksum-Elixir.Torque.Native.exs"
-echo "  2. git commit -m 'Add checksums for ${TAG}'"
-echo "  3. git push origin main"
-echo "  4. mix hex.publish"
+echo "==> torque ${TAG} published"