Crates.io now supports trusted publishing: https://crates.io/docs/trusted-publishing
We should use it as it no longer involves generating api tokens that are individually owned. Better to deploy via CI using repo trust relationship. It also gives our users confidence that what is in crates.io is what is in github.
We probably should use release-plz rather than the naked cargo publish n the crates.io doc.
Release-plz:
https://github.com/release-plz/release-plz
Sample usage:
https://github.com/async-profiler/rust-agent/blob/main/.github/workflows/release.yml