[ericmj]

Pushing a v* tag runs the new Release workflow in the release environment. It installs Hex 2.6.0-dev from a pinned hexpm/hex commit, checks that the tag matches the version in src/hex_core.app.src and takes the version's CHANGELOG section as the release notes. It then publishes the package and docs with mix hex.publish, which exchanges the job's OIDC token for a token that can only publish hex_core, and creates the GitHub release with the notes. The GitHub release is created after the publish, so a failed publish doesn't leave a release for a version that isn't on Hex.

publish.exs is the Mix project mix hex.publish needs, used with MIX_EXS=publish.exs. It reads the version and metadata from src/hex_core.app.src, lists rebar3 as the build tool and builds the docs with rebar3 ex_doc, so the package has the same metadata and files as the ones rebar3 hex publish built. It isn't named mix.exs because Mix would then build a git dependency on hex_core with Mix instead of rebar3, and Mix can't compile hex_core.

Before the first tag, hex.pm needs https://github.com/hexpm/hexpm-ops/pull/560 and hexpm/hexpm#2064 deployed, and a workload identity on the hex organization, which owns hex_core. The identity has the write role, trusts hexpm/hex_core with workflow release.yml and environment release, covers the public package hex_core and doesn't cover private packages. This repository's release environment only allows v* tags.

The release workflow uses rebar3 3.27.3, the latest release, and so do the OTP 27, 28 and master test jobs. Its escript is built with OTP 27, so the OTP 24, 25 and 26 jobs keep their rebar3 versions.