switch to token auth

[MusicalNinjaDad]

No description provided.

[sourcery-ai]

Hey - I've found 1 issue, and left some high level feedback:

• The comments around the publish step still describe using OIDC and 'OR' options, which is now misleading; update the comments to reflect that the workflow exclusively uses the CRATES_IO_TOKEN secret.
• The large block of commented-out steps for the old OIDC-based publish flow can be removed to keep the workflow minimal and easier to maintain unless you expect to toggle back to it soon.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The comments around the publish step still describe using OIDC and 'OR' options, which is now misleading; update the comments to reflect that the workflow exclusively uses the CRATES_IO_TOKEN secret.
- The large block of commented-out steps for the old OIDC-based publish flow can be removed to keep the workflow minimal and easier to maintain unless you expect to toggle back to it soon.

## Individual Comments

### Comment 1
<location path=".github/workflows/rust-publish.yml" line_range="209" />
<code_context>
     - name: Publish
       env:
-        CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
+        CARGO_REGISTRY_TOKEN: ${{ secrets.CRATES_IO_TOKEN }}
       run:
         cargo publish
</code_context>
<issue_to_address>
**🚨 issue (security):** Consider implications of switching from OIDC to a long-lived API token

Using a static `CRATES_IO_TOKEN` instead of the OIDC-based `rust-lang/crates-io-auth-action` introduces a long-lived secret where there was previously an ephemeral credential. If this is required (e.g., due to environment/OIDC limitations), please ensure the token is minimally scoped, easy to rotate, and that this persistent secret dependency is documented. If OIDC is still an option, consider keeping it as the default and using the token only as a fallback to reduce exposure.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[sourcery-ai]

🚨 issue (security): Consider implications of switching from OIDC to a long-lived API token

Using a static CRATES_IO_TOKEN instead of the OIDC-based rust-lang/crates-io-auth-action introduces a long-lived secret where there was previously an ephemeral credential. If this is required (e.g., due to environment/OIDC limitations), please ensure the token is minimally scoped, easy to rotate, and that this persistent secret dependency is documented. If OIDC is still an option, consider keeping it as the default and using the token only as a fallback to reduce exposure.