chore: use trusted cargo publishing

Author: dsherret

.github/workflows/ci.yml

@@ -2,9 +2,6 @@ name: ci
 
 on: [push, pull_request]
 
-permissions:
-  contents: write
-
 jobs:
   rust:
     name: deno_lint-${{ matrix.os }}
@@ -26,52 +23,22 @@ jobs:
 
     steps:
       - name: Clone repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
         with:
           submodules: true
           persist-credentials: false
 
       - uses: dsherret/rust-toolchain-file@v1
 
-      - name: Install Deno
-        uses: denoland/setup-deno@v1
-        with:
-          deno-version: v2.x
-
-      - name: Install Node.js
-        if: contains(matrix.os, 'ubuntu')
-        uses: actions/setup-node@v3
-        with:
-          node-version: "18"
-
-      - name: Install npm packages
-        if: contains(matrix.os, 'ubuntu')
-        run: npm install --ci
-        working-directory: benchmarks
-
       - uses: Swatinem/rust-cache@v2
         with:
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
-      - name: Format
-        if: contains(matrix.os, 'ubuntu')
-        run: deno run --allow-run ./tools/format.ts --check
-
       - name: Build
         run: cargo build --locked --release --all-targets --all-features
 
       - name: Test
-        run: |
-          cargo test --locked --release --all-targets --all-features
-          deno test --unstable --allow-read=. --allow-write=. --allow-run --allow-env ./tools
-
-      - name: Lint
-        if: contains(matrix.os, 'ubuntu')
-        run: deno run --allow-run --allow-env ./tools/lint.ts --release
-
-      - name: Benchmarks
-        if: contains(matrix.os, 'ubuntu')
-        run: deno run -A --quiet benchmarks/benchmarks.ts
+        run: cargo test --locked --release --all-targets --all-features
 
       - name: Pre-release (linux)
         if: |
@@ -107,12 +74,38 @@ jobs:
             target/release/examples/dlint-x86_64-apple-darwin.zip
           draft: true
 
-      - name: Publish
-        if: |
-          contains(matrix.os, 'ubuntu') &&
-          github.repository == 'denoland/deno_lint' &&
-          startsWith(github.ref, 'refs/tags/')
-        env:
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
-        run: |
-          cargo publish -vv
+  javascript:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Clone repository
+        uses: actions/checkout@v5
+        with:
+          submodules: true
+          persist-credentials: false
+      - uses: dsherret/rust-toolchain-file@v1
+      - name: Install Deno
+        uses: denoland/setup-deno@v1
+        with:
+          deno-version: v2.x
+      - name: Install Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: "20"
+      - name: Install npm packages
+        run: npm install --ci
+        working-directory: benchmarks
+      - uses: Swatinem/rust-cache@v2
+        with:
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+
+      - name: Format
+        run: deno run --allow-run ./tools/format.ts --check
+
+      - name: Test
+        run: deno test --unstable --allow-read=. --allow-write=. --allow-run --allow-env ./tools
+
+      - name: Lint
+        run: deno run --allow-run --allow-env ./tools/lint.ts --release
+
+      - name: Benchmarks
+        run: deno run -A --quiet benchmarks/benchmarks.ts

.github/workflows/publish.yml

@@ -0,0 +1,21 @@
+name: publish
+
+on:
+  push:
+    tags:
+      - "*"
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Clone repository
+        uses: actions/checkout@v5
+      - uses: rust-lang/crates-io-auth-action@v1
+        id: auth
+      - run: cargo publish
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}

.github/workflows/release.yml

@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Clone repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
         with:
           token: ${{ secrets.DENOBOT_PAT }}
 
@@ -34,4 +34,4 @@ jobs:
         run: |
           git config user.email "[email protected]"
           git config user.name "denobot"
-          deno run -A https://raw.githubusercontent.com/denoland/automation/0.16.1/tasks/publish_release.ts --${{github.event.inputs.releaseKind}}
+          deno run -A jsr:@deno/rust-automation@0.22.0/publish-release --${{github.event.inputs.releaseKind}}