From d8fa733d8b0d7982f8fac20a6ae380bd9a6921b8 Mon Sep 17 00:00:00 2001
From: 0xNeshi <nenad.misic@openzeppelin.com>
Date: Fri, 19 Sep 2025 13:33:16 +0200
Subject: [PATCH 1/3] add publish ci job

---
 .github/workflows/publish.yml | 37 +++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 .github/workflows/publish.yml

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 00000000..76f503a9
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,37 @@
+name: publish event-scanner
+
+# This workflow publishes event-scanner on crates.io.
+permissions:
+  contents: read
+
+on:
+  push:
+    tags:
+      - v*
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  check-publish:
+    name: Publish event-scanner on crates.io
+    env:
+      EVENT_SCANNER_TOKEN: ${{ secrets.EVENT_SCANNER_TOKEN }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          rustflags: ""
+
+      - name: Check event-scanner
+        run: cargo publish -p event-scanner --locked --dry-run
+
+      - name: Publish event-scanner
+        run: cargo publish -p event-scanner --locked --token $EVENT_SCANNER_TOKEN
\ No newline at end of file

From 616ad1fda5f5361e6648f365f41c11b0c79bea1f Mon Sep 17 00:00:00 2001
From: 0xNeshi <nenad.misic@openzeppelin.com>
Date: Fri, 19 Sep 2025 13:34:26 +0200
Subject: [PATCH 2/3] missing newline

---
 .github/workflows/publish.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 76f503a9..04e41bbe 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -34,4 +34,4 @@ jobs:
         run: cargo publish -p event-scanner --locked --dry-run
 
       - name: Publish event-scanner
-        run: cargo publish -p event-scanner --locked --token $EVENT_SCANNER_TOKEN
\ No newline at end of file
+        run: cargo publish -p event-scanner --locked --token $EVENT_SCANNER_TOKEN

From 3d4abfae462d3a0af8f2cf93647881d92ec7cf10 Mon Sep 17 00:00:00 2001
From: 0xNeshi <nenad.misic@openzeppelin.com>
Date: Fri, 19 Sep 2025 16:45:20 +0200
Subject: [PATCH 3/3] increase robustness of the script

---
 .github/workflows/publish.yml | 33 ++++++++++++++++++++++++++++-----
 1 file changed, 28 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 04e41bbe..23321455 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -19,19 +19,42 @@ env:
 jobs:
   check-publish:
     name: Publish event-scanner on crates.io
-    env:
-      EVENT_SCANNER_TOKEN: ${{ secrets.EVENT_SCANNER_TOKEN }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
 
       - name: Install rust
         uses: actions-rust-lang/setup-rust-toolchain@v1
-        with:
-          rustflags: ""
+
+      - name: Verify tag matches crate version
+        id: version-check
+        run: |
+          PKG_VERSION=$(cargo metadata --no-deps --format-version 1 \
+            | jq -r '.packages[] | select(.name=="event-scanner") | .version')
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+
+          echo "Package:  ${PKG_VERSION}"
+          echo "Tag:      ${TAG_VERSION}"
+
+          if [ -z "$PKG_VERSION" ]; then
+            echo "Failed to determine package version via cargo metadata" >&2
+            exit 1
+          fi
+          if [ "$PKG_VERSION" != "$TAG_VERSION" ]; then
+            echo "Tag v${TAG_VERSION} does not match package version ${PKG_VERSION}" >&2
+            exit 1
+          fi
 
       - name: Check event-scanner
         run: cargo publish -p event-scanner --locked --dry-run
 
+      # cargo automatically picks up CARGO_REGISTRY_TOKEN from environment variables
       - name: Publish event-scanner
-        run: cargo publish -p event-scanner --locked --token $EVENT_SCANNER_TOKEN
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+        run: |
+          if [ -z "${CARGO_REGISTRY_TOKEN:-}" ]; then
+            echo "CARGO_REGISTRY_TOKEN is not set in repository secrets" >&2
+            exit 1
+          fi
+          cargo publish -p event-scanner --locked