chore(ci): use crates.io trusted publishing in release-plz

[jdx]

Summary

• Switches the release-plz workflow from a long-lived CARGO_REGISTRY_TOKEN secret to an OIDC-minted, 30-minute token via rust-lang/crates-io-auth-action.
• Adds id-token: write permission and wires the action's token output into cargo publish (called from xtasks/release-plz).
• Action is SHA-pinned to v1.0.4 to match the rest of the workflow.

Required crates.io setup (before this merges)

For each crate published from this repo — mise, vfox, aqua-registry, mise-interactive-config — go to crates.io → crate Settings → Trusted Publishing → Add → GitHub, and fill in:

• Repository owner: jdx
• Repository name: mise
• Workflow filename: release-plz.yml
• Environment: (leave blank — release-plz runs unattended on cron, an environment with required reviewers would block it)

Both auth methods work simultaneously, so secrets.CARGO_REGISTRY_TOKEN can stay configured during rollout and be deleted after the first successful release on the new flow.

Test plan

• Trusted publisher configured for mise on crates.io before merge
• Trusted publisher configured for vfox, aqua-registry, mise-interactive-config
• Watch the next release-plz run; verify crates-io-auth step mints a token and cargo publish succeeds for each crate
• After one clean release: delete the CARGO_REGISTRY_TOKEN repo secret

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes the release workflow’s crates.io authentication mechanism, which could break automated publishing if OIDC/trusted publishing isn’t configured correctly. Permissions are adjusted to allow OIDC (id-token: write), increasing the blast radius of misconfiguration.

Overview
Switches the release-plz workflow from using secrets.CARGO_REGISTRY_TOKEN to rust-lang/crates-io-auth-action and wires its minted token into CARGO_REGISTRY_TOKEN for the release step.

Moves workflow permissions to the job level and adds id-token: write to enable OIDC-based authentication during publishing.

^{Reviewed by Cursor Bugbot for commit ab3726b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[greptile-apps]

Greptile Summary

Replaces the long-lived CARGO_REGISTRY_TOKEN secret with a short-lived OIDC token minted by the SHA-pinned rust-lang/crates-io-auth-action, reducing credential exposure during crates.io publishing.

• Moves the permissions block from workflow-level to job-level, following least-privilege principles.
• Adds id-token: write only to the release-plz job, wires steps.crates-io-auth.outputs.token into CARGO_REGISTRY_TOKEN, and relies on the 20-minute job timeout keeping execution well within the token's 30-minute validity window.

Confidence Score: 5/5

Safe to merge once the crates.io trusted publisher entries are configured as described in the PR checklist.

The change is a targeted credential hygiene improvement: long-lived secret replaced by a 30-minute OIDC token, permissions narrowed to job scope, action SHA-pinned. The 20-minute job timeout keeps execution well within the token's validity window, and both auth methods work simultaneously so rollout is safe.

No files require special attention; the only prerequisite is the out-of-band crates.io trusted publisher setup documented in the PR.

Important Files Changed

Filename	Overview
.github/workflows/release-plz.yml	Migrates crates.io publishing auth from a long-lived CARGO_REGISTRY_TOKEN secret to a short-lived OIDC token via SHA-pinned rust-lang/crates-io-auth-action@v1.0.4; also moves permissions from workflow-level to job-level.

_{Reviews (2): Last reviewed commit: "chore(ci): scope release-plz permissions..." | Re-trigger Greptile}

[github-actions]

Hyperfine Performance

mise x -- echo

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.5.6 x -- echo	18.3 ± 0.8	16.9	22.2	1.00
mise x -- echo	18.7 ± 1.1	16.7	32.3	1.02 ± 0.07

mise env

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.5.6 env	18.3 ± 0.9	16.3	22.8	1.00
mise env	18.3 ± 0.7	16.6	21.6	1.00 ± 0.06

mise hook-env

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.5.6 hook-env	19.3 ± 0.9	17.7	24.6	1.00
mise hook-env	19.5 ± 0.9	17.5	23.2	1.01 ± 0.06

mise ls

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.5.6 ls	15.7 ± 0.7	14.1	19.2	1.00
mise ls	15.9 ± 0.8	13.9	20.7	1.02 ± 0.07

xtasks/test/perf

Command	mise-2026.5.6	mise	Variance
install (cached)	123ms	125ms	-1%
ls (cached)	58ms	57ms	+1%
bin-paths (cached)	61ms	63ms	-3%
task-ls (cached)	484ms	486ms	+0%