ci(release): enable trusted publishing

Author: Boshen

.github/workflows/release-plz.yml renamed to .github/workflows/release.yml

@@ -19,19 +19,30 @@ jobs:
     permissions:
       pull-requests: write
       contents: write
+      id-token: write
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
           token: ${{ secrets.OXC_BOT_PAT }}
           persist-credentials: true # required by release-plz
 
-      - name: Run release-plz
+      - uses: dorny/paths-filter@v3
+        id: changes
+        with:
+          filters: |
+            src:
+              - 'Cargo.toml'
+              - '**/Cargo.toml'
+
+      - uses: rust-lang/crates-io-auth-action@v1
+        if: steps.changes.outputs.src == 'true'
+        id: auth
+
+      - uses: release-plz/action@ccf6dd998441f26020f4315f1ebe95d9e2e42600 # v0.5.110
         id: release-plz
-        uses: release-plz/action@ccf6dd998441f26020f4315f1ebe95d9e2e42600 # v0.5.110
         env:
           GITHUB_TOKEN: ${{ secrets.OXC_BOT_PAT }}
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
 
       - name: Bump package.json
         if: ${{ steps.release-plz.outputs.prs_created }}