chore(workflow): switch to Trusted Publish

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @kanarus

.github/workflows/CI.yml

@@ -3,7 +3,7 @@ name: CI
 on:
   pull_request:
   push:
-    branches: [main, v*]
+    branches: ['main', 'v*']
 
 jobs:
   build:
@@ -14,7 +14,7 @@ jobs:
         toolchain: [stable, nightly]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - run: |
           rustup update

.github/workflows/Publish.yml

@@ -2,45 +2,53 @@ name: Publish
 
 on:
   push:
-    tags: [v*]
-
-permissions:
-  contents: write
+    tags: ['v*']
 
 jobs:
   publish:
     runs-on: ubuntu-latest
 
+    environment:
+      name: publishing
+
+    permissions:
+      contents: write # for creating GitHub Release
+      id-token: write # for OIDC authentication
+
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           ref: main
           fetch-depth: 0
-
-      - run: |
+
+      - name: Ensure main branch
+        run: |
           BRANCHS=$(git branch --contains ${{ github.ref_name }})
           set -- $BRANCHS
-          for BRANCH in $BRANCHS ; do
+          for BRANCH in $BRANCHS; do
             if [[ "$BRANCH" == "main" ]]; then
               exit 0
             fi
           done
           exit 1
-          
-      - name: (for compiling to pass) install mujoco and set MUJOCO_DIR
+
+      - name: install MuJoCo and set MUJOCO_DIR (for compiling to pass)
         run: |
           mkdir -p $HOME/.mujoco && cd $HOME/.mujoco
           wget https://github.com/google-deepmind/mujoco/releases/download/3.3.2/mujoco-3.3.2-linux-x86_64.tar.gz
           tar -xzf mujoco-3.3.2-linux-x86_64.tar.gz
           echo "MUJOCO_DIR=$HOME/.mujoco/mujoco-3.3.2" >> $GITHUB_ENV
 
-      - name: Publish packages
+      - uses: rust-lang/crates-io-auth-action@v1
+        id: cratesio_auth
+
+      - name: Trusted Publish to crates.io
         env:
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CRATES_IO_TOKEN }}
+          CARGO_REGISTRY_TOKEN: ${{ steps.cratesio_auth.outputs.token }}
         run: |
-          cargo publish -p rusty_mujoco
+          cargo publish --package rusty_mujoco
 
-      - name: Create release
+      - name: Create GitHub Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |