From 3c9234283fadeebec2aa1b246642d75b917a8ac0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jakub=20Ber=C3=A1nek?= <berykubik@gmail.com>
Date: Wed, 2 Sep 2026 10:20:56 +0200
Subject: [PATCH] Use trusted publishing for Cargo crates

---
 .github/workflows/release.yml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 76ffc8483e8..697e188288d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,8 +18,9 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      id-token: write     # Required for OIDC token exchange
 
-    # Gain access to the crates.io publishing token.
+    # Required for trusted publishing to work.
     environment:
       name: release
 
@@ -27,7 +28,10 @@ jobs:
       - name: Checkout the source code
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
 
+      - uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18  # v1.0.5
+        id: auth
+
       - name: Publish Cargo to crates.io
         run: ./publish.py
         env:
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}