[jonathan-kosgei]

Summary

Merging a version bump to main is now enough to tag, create the GitHub release and publish the crate to crates.io; nothing is tagged by hand any more.

• .github/workflows/ci.yml: a new release job runs after test on pushes to the default branch only (permissions: contents: write, concurrency: release). It reads version from Cargo.toml, derives the tag vX.Y.Z and, when that tag does not exist yet, creates the tag and the GitHub release with generated notes in one step. When the tag exists it does nothing and says so. A new publish job (needs: release, if: needs.release.outputs.created == 'true') calls publish.yml with the tag and secrets: inherit.
• .github/workflows/publish.yml: now also callable (on: workflow_call with a required tag input). The release: published trigger is kept, so a release published by hand still publishes as before. The checkout names the tag being published (refs/tags/<input>, or the release's own tag when triggered by a release); the fmt, clippy, test and cargo publish steps and the CARGO_REGISTRY_TOKEN secret are unchanged.
• README.md: a short "Releasing" section for maintainers.

How it works

1. A push to the default branch runs test, then release, which runs git ls-remote --exit-code --tags origin refs/tags/vX.Y.Z: exit 0 means the tag exists (created=false), exit 2 means it is missing and gh release create vX.Y.Z --target $GITHUB_SHA --title vX.Y.Z --generate-notes creates the tag and the release (created=true); any other exit status fails the job rather than guessing. The job's tag and created outputs drive the next step.
2. A tag or release created with the workflow's own GITHUB_TOKEN does not trigger other workflows, so the publish steps have to run in the same workflow run: the publish job calls publish.yml as a reusable workflow with the tag as input.
3. Pull requests still run only test; release is skipped by its if and publish with it. The concurrency group makes concurrent pushes queue, and the second one finds the tag already present.

Verification

• Both workflow files load with PyYAML, and actionlint 1.7.12 reports no problems.
• The version command (sed -nE 's/^version *= *"([^"]+)".*/\1/p' Cargo.toml | head -1) prints 0.1.2 for the current Cargo.toml.
• The release step was exercised locally with a stub gh: an existing tag (v0.1.2) gives created=false and calls nothing, a missing tag (v9.9.9) calls gh release create v9.9.9 --target <sha> --title v9.9.9 --generate-notes and gives created=true, an unreachable remote fails the step with the git ls-remote status, and a Cargo.toml without a version fails it with an error annotation.
• v0.1.2 is already tagged and published, so merging this pull request creates no release and publishes nothing; the first version bump merged afterwards will be the first automatic release. The push-triggered release job itself cannot run before the merge.

🤖 Generated with Claude Code