From 5f915705bf5e165bd05fe2c3f6bc76e72fc8f09b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eric=20Meadows-J=C3=B6nsson?=
 <eric.meadows.jonsson@gmail.com>
Date: Tue, 20 Oct 2026 18:11:27 +0200
Subject: [PATCH] Publish with Workload Identity

The Publish workflow exchanges the job's GitHub OIDC token for a token that
can only publish castore, matched against the package's workload identity on
hex.pm, so it no longer uses the HEX_API_KEY secret. The job runs in the
release environment that the workload identity names and installs Hex
2.6.0-dev from a pinned hexpm/hex commit, the first Hex that publishes with
Workload Identity.

That Hex needs OTP 27 or later, so the job moves to OTP 28 and Elixir 1.19,
the versions CI lints with. actions/checkout moves to v6, the version CI
uses, because v3's Node runtime is too old for GitHub's runners.
---
 .github/workflows/publish.sh  |  6 +++---
 .github/workflows/publish.yml | 21 ++++++++++++++++-----
 2 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/publish.sh b/.github/workflows/publish.sh
index 4e80973..7fa1f29 100755
--- a/.github/workflows/publish.sh
+++ b/.github/workflows/publish.sh
@@ -18,8 +18,8 @@ if mix hex.info $package "$(cat VERSION)"; then
   echo "NOT PUBLISHING"
 else
   echo "PUBLISHING"
-  
-  # Assumes HEX_API_KEY is set in GitHub Actions secrets
-  # https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions
+
+  # Authenticates with the package's workload identity on hex.pm
+  # https://hex.pm/docs/workload-identity
   mix hex.publish --yes
 fi
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index b240549..e270bd6 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -5,25 +5,36 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   publish:
     name: Publish
     runs-on: ubuntu-24.04
+    # The GitHub environment that castore's workload identity on hex.pm names
+    environment: release
+    permissions:
+      contents: write # push the version tag
+      id-token: write # the OIDC token mix hex.publish exchanges with Workload Identity
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: Install OTP and Elixir
         uses: erlef/setup-beam@v1
         with:
-          otp-version: 25.3
-          elixir-version: 1.14.3
+          otp-version: "28"
+          elixir-version: "1.19"
+          install-hex: false
+
+      # Hex 2.6.0-dev, the first version that publishes with Workload Identity
+      - name: Install Hex
+        run: mix archive.install github hexpm/hex ref 1d155e718aa76ab75d03f6f4bdcb0d8042f9a0ad --force
 
       - name: Publish
         run: |
           mix deps.get
           mix compile
           .github/workflows/publish.sh
-        env:
-          HEX_API_KEY: ${{ secrets.HEX_API_KEY }}