chore: trusted publishing

Author: dsherret

.github/workflows/ci.yml

@@ -19,7 +19,7 @@ jobs:
       RUST_BACKTRACE: full
 
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
     - uses: dsherret/rust-toolchain-file@v1
     - name: Install wasm32 target
       if: matrix.config.kind == 'test_release'
@@ -52,35 +52,17 @@ jobs:
     - uses: actions/setup-node@v6
       if: matrix.config.kind == 'test_release'
       with:
-        node-version: '20.x'
+        node-version: '24.x'
         registry-url: 'https://registry.npmjs.org'
 
     - name: Setup and test npm deployment
       if: matrix.config.kind == 'test_release'
       run: |
         cd deployment/npm
         npm install
-        node setup.js ${{ steps.get_tag_version.outputs.TAG_VERSION }}
+        node setup.js
         npm run test
 
-    - name: npm publish
-      if: matrix.config.kind == 'test_release' && startsWith(github.ref, 'refs/tags/')
-      env:
-        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-      run: |
-        cd deployment/npm
-        npm publish --access public
-        git reset --hard
-
-      # CARGO PUBLISH
-    - name: Cargo login
-      if: matrix.config.kind == 'test_release' && startsWith(github.ref, 'refs/tags/')
-      run: cargo login ${{ secrets.CRATES_TOKEN }}
-
-    - name: Cargo publish
-      if: matrix.config.kind == 'test_release' && startsWith(github.ref, 'refs/tags/')
-      run: cargo publish
-
       # GITHUB RELEASE
     - uses: denoland/setup-deno@v2
       if: matrix.config.kind == 'test_release' && startsWith(github.ref, 'refs/tags/')

.github/workflows/publish.yml

@@ -0,0 +1,47 @@
+name: publish
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - '*'
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  cargo:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dsherret/rust-toolchain-file@v1
+      - uses: rust-lang/crates-io-auth-action@v1
+        id: auth
+      - name: Cargo publish
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
+        run: cargo publish
+
+  npm:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dsherret/rust-toolchain-file@v1
+      - name: Install wasm32 target
+        run: rustup target add wasm32-unknown-unknown
+      - name: Build release
+        run: cargo build --target wasm32-unknown-unknown --features wasm --release
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '24.x'
+          registry-url: 'https://registry.npmjs.org'
+      - name: Setup and test npm deployment
+        run: |
+          cd deployment/npm
+          npm install
+          node setup.js sync-version
+      - name: npm publish
+        run: |
+          cd deployment/npm
+          npm publish --access public

.github/workflows/release.yml

@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Clone repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           token: ${{ secrets.GH_DPRINTBOT_PAT }}
 

deployment/npm/setup.js

@@ -10,6 +10,16 @@ if (args.length > 0) {
   const packageJsonPath = path.join(__dirname, "package.json");
   const packageJsonText = fs.readFileSync(packageJsonPath, "utf8");
   const packageJson = JSON.parse(packageJsonText);
-  packageJson.version = args[0];
+  if (args[0] === "sync-version") {
+    const cargoTomlPath = path.join(__dirname, "../../Cargo.toml");
+    const cargoTomlText = fs.readFileSync(cargoTomlPath, "utf8");
+    const versionMatch = cargoTomlText.match(/^version\s*=\s*"([^"]+)"/m);
+    if (!versionMatch) {
+      throw new Error("Could not find version in Cargo.toml");
+    }
+    packageJson.version = versionMatch[1];
+  } else {
+    packageJson.version = args[0];
+  }
   fs.writeFileSync(packageJsonPath, JSON.stringify(packageJson, undefined, 2) + "\n");
 }