ci: release only from a signed tag and an approved deployment

[P4suta]

Releases now follow the shape OComment uses: a machine proposes, and the maintainer signs and approves.

• release-plz.yml only keeps a draft release pull request, bumping the version and updating CHANGELOG.md; it never tags and never publishes.
• The maintainer's signed vX.Y.Z tag starts the new release.yml:
  1. candidate requires an annotated tag GitHub verified as signed, verifies that it names a commit on main whose Cargo version it matches, builds the reproducible release candidate, and attests SLSA v1 provenance and the CycloneDX SBOM.
  2. publish waits in the crates-io environment for the maintainer's approval, and takes a crates.io token through trusted publishing only.
     It publishes only if cargo package makes the attested archive, and then requires crates.io to serve that archive.
  3. github-release attaches the crate, SBOMs, and checksums to a draft release and publishes it, as release-finalize.yml did.
• cargo xtask crates-io-auth-mode and the bootstrap-token fallback go: 0.1.0 is out, so trusted publishing is the only credential.
• docs/releasing.md describes the new flow.

Settings this needs

Already done:

• the crates-io environment: the maintainer is its required reviewer, and it deploys from v* tags only;
• the release environment deploys from main only;
• no administrator may bypass crates-io.

Left for the maintainer:

• the trusted publisher on crates.io for P4suta/windows-spawn, workflow release.yml, environment crates-io, with trusted publishing required;
• revoking the bootstrap token, and deleting the CRATES_IO_BOOTSTRAP_TOKEN secret;
• two v* tag rulesets, because a bypass actor skips every rule of its ruleset: one where only the maintainer may bypass creation, and one with update, deletion and required_signatures that nobody bypasses.

Verification

• actionlint and zizmor report nothing on either workflow.
• cargo xtask gates, the xtask tests, typos and reuse lint pass.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 6381960a-0f06-4f92-8505-7746a1063495

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}