chore(release): v0.30.2

.github/dependabot.yml

@@ -1,8 +1,8 @@
 # Every `uses:` in the workflows names a commit hash (CLAUDE.md § Standing decisions), and a hash
 # does not move: dependabot opens a PR per upstream release that rewrites the hash and the version
 # comment together, and scripts/check-actions-pinned.sh holds that PR to the hash-only form like
-# any other. Nothing merges on its own. The tarball digests in golden.yml are not actions and stay
-# by hand.
+# any other. Nothing merges on its own. The tarball digests in ci.yml's golden jobs are not actions
+# and stay by hand.
 version: 2
 updates:
   - package-ecosystem: github-actions

.github/workflows/publish.yml

@@ -0,0 +1,110 @@
+# The crates.io publish, on the owner's manual trigger alone (CLAUDE.md § Standing decisions: "make
+# it a ci publish on my manual trigger"): never on a tag push, so a tag on its own publishes nothing.
+#
+#   a dispatch            names the tag release.yml cut and the authentication
+#
+# `token` reads the repository secret CARGO_REGISTRY_TOKEN, the first publish's route, because
+# crates.io grants Trusted Publishing only to a crate that already exists; `trusted` exchanges the
+# job's OIDC token for a thirty-minute crates.io token through rust-lang/crates-io-auth-action, every
+# later release's route once the owner configures it on the crate (owner jbrjake, repository
+# float-abel, workflow publish.yml, environment release). The .crate is built with --locked, attested
+# with actions/attest-build-provenance, which needs the repository public, and uploaded onto the
+# GitHub Release release.yml made for the tag. This workflow is outside the release process until the
+# owner brings crates.io in.
+name: publish
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "The tag to publish, vX.Y.Z, naming Cargo.toml's version"
+        required: true
+        type: string
+      auth:
+        description: "trusted: crates.io Trusted Publishing; token: the CARGO_REGISTRY_TOKEN secret, the first publish's route"
+        required: true
+        type: choice
+        options: [trusted, token]
+        default: trusted
+
+# One publish at a time, and a running one is never cancelled under a second dispatch.
+concurrency:
+  group: publish
+  cancel-in-progress: false
+
+env:
+  CARGO_TERM_COLOR: always
+
+permissions: {}
+
+jobs:
+  publish:
+    name: cargo publish ${{ inputs.tag }} by ${{ inputs.auth }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    environment: release
+    permissions:
+      contents: write      # the GitHub release and its asset
+      id-token: write      # the OIDC token, for crates.io's exchange and the attestation's signing
+      attestations: write  # the provenance attestation
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: refs/tags/${{ inputs.tag }}
+      # The inputs reach the shell through env, never by interpolation into a script.
+      - name: The tag names Cargo.toml's version
+        env:
+          TAG: ${{ inputs.tag }}
+        run: |
+          version=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[] | select(.name == "float-abel") | .version')
+          if [ "$TAG" != "v$version" ]; then
+            echo "release: tag $TAG does not name Cargo.toml's version $version" >&2
+            exit 1
+          fi
+          echo "release: $TAG is version $version"
+      - name: Install the toolchain
+        run: |
+          rustup toolchain install stable --profile minimal
+          rustup default stable
+          cargo --version && rustc --version
+      - name: Authenticate with crates.io by Trusted Publishing
+        if: inputs.auth == 'trusted'
+        id: auth
+        uses: rust-lang/crates-io-auth-action@3268eb413133e2960fa4ae0e963ca76380c54cd9 # v1.0.6
+      # cargo package builds the archive from the tag's tree and lockfile, builds it once more from
+      # the archive to verify it, and leaves it at target/package/. The attestation is of that file.
+      - name: Package with the lockfile
+        run: |
+          cargo package --locked
+          sha256sum target/package/float-abel-*.crate | tee target/package/sha256
+      - name: Attest the .crate's provenance
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-path: target/package/float-abel-*.crate
+      # cargo publish re-packages the same tree with the same cargo, byte for byte, and uploads it;
+      # --no-verify skips the second verify build, not the packaging. A missing token fails before
+      # anything is uploaded, and the digest is re-asserted on whatever cargo leaves behind.
+      - name: Publish
+        env:
+          AUTH: ${{ inputs.auth }}
+          TRUSTED_TOKEN: ${{ steps.auth.outputs.token }}
+          SECRET_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+        run: |
+          case "$AUTH" in
+            trusted) token="$TRUSTED_TOKEN" ;;
+            token) token="$SECRET_TOKEN" ;;
+            *) token="" ;;
+          esac
+          if [ -z "$token" ]; then
+            echo "release: no crates.io token for auth=$AUTH" >&2
+            exit 1
+          fi
+          CARGO_REGISTRY_TOKEN="$token" cargo publish --locked --no-verify
+          if ls target/package/float-abel-*.crate >/dev/null 2>&1; then
+            sha256sum --check target/package/sha256
+          fi
+      - name: Upload the published .crate onto the tag's GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ inputs.tag }}
+        run: gh release upload "$TAG" target/package/float-abel-*.crate --clobber