Replace the tag-push release trigger with cargo-dist's dispatch-releases
mode. release-on-bump.yml (replacing tag-release.yml) dispatches release.yml
with tag=v<version> using the default GITHUB_TOKEN — workflow_dispatch is
the documented exception to GitHub's "GITHUB_TOKEN events don't trigger
workflows" rule, so no PAT or secret is required. Nothing pushes a tag
anymore: dist creates the tag implicitly when it publishes the GitHub
Release at the end of a successful run, so the tag can never exist without
its release (the v0.1.16 failure mode) and there is no credential to manage
or rotate.
release.yml regenerated with dist 0.32.0 (dist generate); dist plan passes.
tag-release.yml: on every push to main, mirror the package version into a
v<version> tag if one doesn't exist yet; the tag push triggers the existing
cargo-dist release workflow. The version is never invented or incremented
by CI — merging a PR that bumps Cargo.toml IS the release act. Refuses
(loudly, before tagging) when the RELEASE_TAG_TOKEN secret is missing,
because tags pushed with the default GITHUB_TOKEN don't trigger workflows.
ci.yml version-guard (PRs only): the version may only move forward, may not
reuse an already-released tag, and a bump must come with a regenerated
Cargo.lock — so a malformed bump can't reach main, where merging it would
be the release trigger. Closes the tag/manifest drift class that produced
v0.1.15 (tagged while main said 0.1.14) and v0.1.16 (tagged on a pre-merge
commit, shipping without the feature it was cut for).
Daniel Kim