Release #22

	# Publish to crates.io on a pushed `v*` tag (design §11: V1 publishes to
	# crates.io). The crate must already pass CI on `main`; this only fires from a
	# tag, so cut a tag only after the `main` CI run is green.
	#
	# The crate.io token is the `CARGO_REGISTRY_TOKEN` repo secret — set once via:
	# gh secret set CARGO_REGISTRY_TOKEN
	# It never lives in a file or in the chat.
	name: Release

	on:
	push:
	tags:
	- 'v*'

	env:
	CARGO_TERM_COLOR: always

	jobs:
	publish:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	# Match the pinned toolchain in rust-toolchain.toml so the published
	# crate is built with the same rustc we tested under.
	- uses: dtolnay/rust-toolchain@master
	with:
	toolchain: '1.95.0'
	- uses: Swatinem/rust-cache@v2
	- name: Verify the tag version matches Cargo.toml
	run: \|
	tag="${GITHUB_REF#refs/tags/}"
	cargo_ver=$(grep -E '^version' Cargo.toml \| head -1 \| sed -E 's/."([^"]+)"./\1/')
	if [ "$tag" != "v$cargo_ver" ]; then
	echo "Tag $tag does not match Cargo.toml version $cargo_ver (expected v$cargo_ver)"
	exit 1
	fi
	- name: cargo publish
	run: cargo publish --locked --token "$CARGO_REGISTRY_TOKEN"
	env:
	CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

Provide feedback