ci: use trusted publishing

Author: newAM

.github/workflows/ci.yml

@@ -69,9 +69,14 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/v')
     needs: [build, test, clippy, format, doc, rustdoc]
     runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      id-token: write
     steps:
       - uses: actions/checkout@v6
+      - uses: rust-lang/crates-io-auth-action@v1
+        id: auth
       - uses: dtolnay/rust-toolchain@stable
-      - run: cargo publish --token ${CRATES_IO_TOKEN}
+      - run: cargo publish --no-verify
         env:
-          CRATES_IO_TOKEN: ${{ secrets.CRATES_IO_TOKEN }}
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}