fix: have release-plz publish to crates.io directly

- Pass CARGO_REGISTRY_TOKEN to release-plz for crates.io publishing
- Trigger release.yml on PR merge instead of tag push
- Explicitly enable git tagging and releases in release-plz config

GITHUB_TOKEN-created tags don't trigger other workflows, so we now
trigger on release PR merge directly.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: shikhar

.github/workflows/release-tag.yml

@@ -5,7 +5,7 @@ on:
     types: [closed]
 
 jobs:
-  release-tag:
+  release:
     if: github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'release')
     runs-on: ubuntu-latest
     permissions:
@@ -25,3 +25,4 @@ jobs:
           command: release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CRATES_IO_TOKEN }}

.github/workflows/release.yml

@@ -1,10 +1,15 @@
 name: release
-on:  
-  push:
-    tags: ["[0-9]+.[0-9]+.[0-9]+*"]
+
+on:
+  pull_request:
+    types: [closed]
   workflow_dispatch:
+
 jobs:
   build_binaries:
+    if: |
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'release'))
     name: ${{ matrix.target }}
     runs-on: ${{ matrix.os }}
     strategy:
@@ -38,7 +43,7 @@ jobs:
             target: aarch64-pc-windows-msvc
     steps:
       - name: checkout
-        uses: actions/checkout@v4      
+        uses: actions/checkout@v4
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
           rustflags: ""
@@ -59,7 +64,7 @@ jobs:
         if: matrix.os == 'macos-latest'
         run: |
           echo "${{ secrets.MACOS_PEM }}" | base64 -d -o macos.pem
-          echo "${{ secrets.MACOS_CERTIFICATE_DER }}" | base64 -d -o certificate.der      
+          echo "${{ secrets.MACOS_CERTIFICATE_DER }}" | base64 -d -o certificate.der
       - name: Sign macos binary
         if: matrix.os == 'macos-latest'
         uses: indygreg/apple-code-sign-action@v1
@@ -73,20 +78,20 @@ jobs:
         shell: bash
         run: |
             cd target/${{ matrix.target }}/release
-            
-            if [ "${{ matrix.os }}" = "windows-latest" ]; 
+
+            if [ "${{ matrix.os }}" = "windows-latest" ];
             then
                 7z a ../../../s2-${{ matrix.target }}.zip s2.exe
             else
                 zip -r ../../../s2-${{ matrix.target }}.zip s2
-            fi      
+            fi
       - name: App store connect api key
         if: matrix.os == 'macos-latest'
         run: echo "${{ secrets.APP_STORE_CONNECT_API_KEY }}" | base64 -d -o app_store_connect_api_key.json
-      - name: Notarize macos binary              
-        if: matrix.os == 'macos-latest'  
+      - name: Notarize macos binary
+        if: matrix.os == 'macos-latest'
         uses: indygreg/apple-code-sign-action@v1
-        with:          
+        with:
           input_path: s2-${{ matrix.target }}.zip
           sign: false
           notarize: true
@@ -95,14 +100,13 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           name: ${{ matrix.target }}
-          path: |            
+          path: |
             *.zip
           if-no-files-found: error
 
   create_release:
     needs: build_binaries
     runs-on: ubuntu-22.04
-    if: github.event_name != 'workflow_dispatch'
     permissions:
       contents: write
     steps:
@@ -118,25 +122,21 @@ jobs:
         id: changelog_reader
         with:
           version: ${{ steps.version.outputs.value }}
-      - name: install rust
-        uses: dtolnay/rust-toolchain@stable
-      - name: publish to crates.io
-        run: cargo publish --token ${{ secrets.CRATES_IO_TOKEN }}          
       - name: download artifacts
         uses: actions/download-artifact@v4
       - name: create release
         uses: softprops/action-gh-release@v2
         with:
+          tag_name: ${{ steps.version.outputs.value }}
           files: |
             **/*.tar.gz
             **/*.zip
           name: ${{ steps.version.outputs.value }}
-          body: ${{ steps.changelog_reader.outputs.changes }}       
+          body: ${{ steps.changelog_reader.outputs.changes }}
 
   update_homebrew:
     needs: [create_release, build_binaries]
     runs-on: ubuntu-22.04
-    if: github.event_name != 'workflow_dispatch'
     steps:
       - name: checkout
         uses: actions/checkout@v4
@@ -147,29 +147,29 @@ jobs:
           file: Cargo.toml
           field: package.version
       - name: Download artifacts
-        uses: actions/download-artifact@v4      
+        uses: actions/download-artifact@v4
       - name: sha256sum
-        run: |          
+        run: |
           LINUX_INTEL_SHA256=$(shasum -a 256 x86_64-unknown-linux-gnu/s2-x86_64-unknown-linux-gnu.zip | awk '{print $1}')
-          echo "LINUX_INTEL_SHA256=$LINUX_INTEL_SHA256" >> $GITHUB_ENV  
+          echo "LINUX_INTEL_SHA256=$LINUX_INTEL_SHA256" >> $GITHUB_ENV
           LINUX_ARM_SHA256=$(shasum -a 256 aarch64-unknown-linux-gnu/s2-aarch64-unknown-linux-gnu.zip | awk '{print $1}')
           echo "LINUX_ARM_SHA256=$LINUX_ARM_SHA256" >> $GITHUB_ENV
           MAC_INTEL_SHA256=$(shasum -a 256 x86_64-apple-darwin/s2-x86_64-apple-darwin.zip | awk '{print $1}')
           echo "MAC_INTEL_SHA256=$MAC_INTEL_SHA256" >> $GITHUB_ENV
           MAC_ARM_SHA256=$(shasum -a 256 aarch64-apple-darwin/s2-aarch64-apple-darwin.zip | awk '{print $1}')
-          echo "MAC_ARM_SHA256=$MAC_ARM_SHA256" >> $GITHUB_ENV        
+          echo "MAC_ARM_SHA256=$MAC_ARM_SHA256" >> $GITHUB_ENV
       - name: checkout into the formula repo
         uses: actions/checkout@v4
         with:
           repository: 's2-streamstore/homebrew-s2'
           token: ${{ secrets.HOMEBREW_PAT }}
       - name: update formula
-        run: |          
+        run: |
           sed -i.bak "s/^  version \".*\"$/  version \"${{ steps.version.outputs.value }}\"/" s2.rb
           sed -z -i -e 's/[0-9a-f]\{64\}/${{ env.MAC_INTEL_SHA256 }}/1' s2.rb
           sed -z -i -e 's/[0-9a-f]\{64\}/${{ env.MAC_ARM_SHA256 }}/2' s2.rb
           sed -z -i -e 's/[0-9a-f]\{64\}/${{ env.LINUX_INTEL_SHA256 }}/3' s2.rb
-          sed -z -i -e 's/[0-9a-f]\{64\}/${{ env.LINUX_ARM_SHA256 }}/4' s2.rb          
+          sed -z -i -e 's/[0-9a-f]\{64\}/${{ env.LINUX_ARM_SHA256 }}/4' s2.rb
       - name: release
         run: |
           git config --global user.email "mehul@s2.dev"

release-plz.toml

@@ -1,7 +1,6 @@
 [workspace]
 changelog_config = "cliff.toml"
-publish = false
 git_tag_enable = true
 git_tag_name = "{{ version }}"
-git_release_enable = false
+git_release_enable = true
 pr_labels = ["release"]