From 4cb69c0a6f653630fea64820c4eb37b5c2e481a6 Mon Sep 17 00:00:00 2001
From: David Cook <dcook@divviup.org>
Date: Tue, 9 Dec 2025 10:24:28 -0600
Subject: [PATCH] Use trusted publishing with crates.io

---
 .github/workflows/publish-crate.yml | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/publish-crate.yml b/.github/workflows/publish-crate.yml
index 3a30cfcf725..dbca35cdf21 100644
--- a/.github/workflows/publish-crate.yml
+++ b/.github/workflows/publish-crate.yml
@@ -7,8 +7,15 @@ on:
 jobs:
   crate:
     runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      id-token: write
     steps:
     - uses: actions/checkout@v6
+    - name: Install Rust toolchain
+      uses: dtolnay/rust-toolchain@stable
+    - id: auth
+      uses: rust-lang/crates-io-auth-action@v1
     - run: cargo publish
       env:
-        CARGO_REGISTRY_TOKEN: ${{ secrets.DIVVIUP_GITHUB_AUTOMATION_CRATES_IO_API_TOKEN }}
+        CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}