ci: publish crates to crates.io on release (cargo-dist custom job)

Add a reusable workflow (.github/workflows/publish-crates.yml) that runs
cargo publish for deepshrink-ffmpeg -> deepshrink-core -> deepshrink in
dependency order, wired into the release pipeline via publish-jobs =
["homebrew", "./publish-crates"] and regenerated into release.yml by dist.

It runs in the publish stage after the GitHub Release is created, with
secrets: inherit — so it needs a CARGO_REGISTRY_TOKEN repo secret. cargo-dist
did not publish crates before, which is why 0.3.4 had to be pushed by hand.

Author: deeplabua

.github/workflows/publish-crates.yml

@@ -0,0 +1,41 @@
+# Custom cargo-dist publish job: push the workspace crates to crates.io.
+#
+# Wired in via `publish-jobs = ["./publish-crates"]` in Cargo.toml's
+# `[workspace.metadata.dist]`; cargo-dist regenerates release.yml to call this
+# reusable workflow in the publish stage (after the GitHub Release is created)
+# and passes it the dist plan. cargo-dist invokes publish jobs with
+# `secrets: inherit`, so `CARGO_REGISTRY_TOKEN` (a repo secret) is available here.
+#
+# crates.io has no atomic multi-crate publish, so the members go up in dependency
+# order — deepshrink-ffmpeg, then deepshrink-core (depends on ffmpeg), then the
+# deepshrink binary (depends on both) — with `cargo publish` waiting for each to
+# appear in the index before returning.
+name: Publish to crates.io
+
+on:
+  workflow_call:
+    # cargo-dist passes the plan; we don't read it, but the input must be declared.
+    inputs:
+      plan:
+        required: true
+        type: string
+  # Allow a manual re-run from the Actions tab if a publish half-fails.
+  workflow_dispatch:
+
+jobs:
+  publish-crates:
+    runs-on: ubuntu-22.04
+    env:
+      CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - name: Install Rust
+        run: rustup toolchain install stable --profile minimal
+      - name: Publish deepshrink-ffmpeg
+        run: cargo publish -p deepshrink-ffmpeg
+      - name: Publish deepshrink-core
+        run: cargo publish -p deepshrink-core
+      - name: Publish deepshrink
+        run: cargo publish -p deepshrink

.github/workflows/release.yml

@@ -324,15 +324,30 @@ jobs:
           done
           git push
 
+  custom-publish-crates:
+    needs:
+      - plan
+      - host
+    if: ${{ !fromJson(needs.plan.outputs.val).announcement_is_prerelease || fromJson(needs.plan.outputs.val).publish_prereleases }}
+    uses: ./.github/workflows/publish-crates.yml
+    with:
+      plan: ${{ needs.plan.outputs.val }}
+    secrets: inherit
+    # publish jobs get escalated permissions
+    permissions:
+      "id-token": "write"
+      "packages": "write"
+
   announce:
     needs:
       - plan
       - host
       - publish-homebrew-formula
+      - custom-publish-crates
     # use "always() && ..." to allow us to wait for all publish jobs while
     # still allowing individual publish jobs to skip themselves (for prereleases).
     # "host" however must run to completion, no skipping allowed!
-    if: ${{ always() && needs.host.result == 'success' && (needs.publish-homebrew-formula.result == 'skipped' || needs.publish-homebrew-formula.result == 'success') }}
+    if: ${{ always() && needs.host.result == 'success' && (needs.publish-homebrew-formula.result == 'skipped' || needs.publish-homebrew-formula.result == 'success') && (needs.custom-publish-crates.result == 'skipped' || needs.custom-publish-crates.result == 'success') }}
     runs-on: "ubuntu-22.04"
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Cargo.toml

@@ -42,8 +42,10 @@ ci = "github"
 installers = ["shell", "powershell", "homebrew"]
 # A GitHub repo to push Homebrew formulas to
 tap = "deeplabua/homebrew-tap"
-# Publish jobs to run in CI
-publish-jobs = ["homebrew"]
+# Publish jobs to run in CI. `./publish-crates` is the local reusable workflow
+# `.github/workflows/publish-crates.yml` (crates.io publish; needs the
+# CARGO_REGISTRY_TOKEN repo secret).
+publish-jobs = ["homebrew", "./publish-crates"]
 # Target platforms to build apps for (Rust target-triple syntax)
 targets = ["aarch64-apple-darwin", "x86_64-apple-darwin", "x86_64-unknown-linux-gnu", "x86_64-pc-windows-msvc"]
 # Whether to install an updater program