Merge pull request #306 from glotzerlab/trusted-publishing

Switch to the trusted publishing workflow.

Author: joaander

.github/workflows/release.yaml

@@ -14,7 +14,7 @@ on:
     branches:
     - trunk
     tags:
-      - "*"
+      - "[0-9]+.[0-9]+.[0-9]+"
 
   workflow_dispatch:
 
@@ -158,7 +158,11 @@ jobs:
 
   publish_cargo:
     name: Publish [Cargo]
+    if: startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-24.04
+    environment: release
+    permissions:
+      id-token: write
     steps:
     - name: Checkout
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -167,8 +171,10 @@ jobs:
       uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9
       with:
         toolchain: 1.94.0
-    - name: Dry run
-      run: cargo publish --all-features --dry-run
+    - name: Authorize with crates.io
+      uses: rust-lang/crates-io-auth-action@b7e9a28eded4986ec6b1fa40eeee8f8f165559ec # v1.0.3
+      id: auth
     - name: Publish to crates.io
-      if: startsWith(github.ref, 'refs/tags/')
-      run: cargo publish --all-features --token ${{ secrets.CRATES_IO_API_TOKEN }}
+      run: cargo publish --all-features
+      env:
+        CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}