ci: add publish step to the release workflow

[newpavlov]

Bumps the crate version to v0.10.0-rc-2 for testing purposes.

[newpavlov]

It would be nice to also check that the tag corresponds to the version in Cargo.toml, but I am not sure how to do it and it's possible to add it later.

[dhardy]

Do we want this workflow? I.e.:

# <merge PR>
jj git fetch
jj new master
git tag v$VERSION
git push --tags

As opposed to

# <merge PR>
jj git fetch
jj new master
cargo publish
git tag $PUBLISHED_VERSION
git push --tags

Since $PUBLISHED_VERSION is just copy+paste the latter seems easier, but it may just be me.

Further, this permits publishing from GH actions. But that may not be much different from what we already had (GitHub already controls who has permissions to publish to crates.io).

[dhardy]

Since we have a v in the tag name we need to modify RELEASEVERSION. See https://github.com/rust-random/getrandom/pull/740/files#diff-87db21a973eed4fef5f32b267aa60fcee5cbdf03c67fafdc2a9b553bb0b15f34R25

[newpavlov]

Do we want this workflow?

The idea is that it allows to remove crates.io credentials from your local machine where they can be vulnerable to malicious actors (which is especially bad considering that cargo stores them in plaintext...). You also could configure the environment rules for better protection of releases.

As you correctly noticed, GH already fully controls our access to crates.io, so security-wise trusted publishing is not worse than publishing manually.

[newpavlov]

Damn, we get the following error:

(Line: 24, Col: 12): Unexpected symbol: '('. Located at position 22 within expression: github.ref_name.slice(1)

[dhardy]

Looks like we can't run JavaScript expressions during variable expansion.

An alternative would be to remove the v using shell commands; I just didn't find a good way to do that. cut would work... I'm no bash guru.

[newpavlov]

Also, are you sure that the awk part works correctly? Running:

awk -v ver="0.9.2" '/^## / { if (p) { exit }; if ($2 == ver) { p=1; next } } p && NF' CHANGELOG.md

Outputs nothing for me.

[dhardy]

Try ver="[0.9.2]".