chore(ci): fix release-plz + crates.io secret wiring

.github/workflows/release-plz.yml

@@ -22,7 +22,8 @@ jobs:
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
-          persist-credentials: false
+          # release-plz needs to push tags / release commits with GITHUB_TOKEN
+          persist-credentials: true
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -32,14 +33,13 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y pkg-config libmariadb-dev libmariadb-dev-compat libpq-dev libsqlite3-dev
 
-      - name: Run release-plz
+      - name: Run release-plz release
         uses: release-plz/action@v0.5
         with:
           command: release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # Same crates.io token the Publish workflow uses; expose as CARGO_REGISTRY_TOKEN for release-plz.
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN || secrets.CRATES_IO_TOKEN }}
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
 
   # Open/update a PR that bumps versions for the next release.
   release-plz-pr:
@@ -57,15 +57,15 @@ jobs:
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
-          persist-credentials: false
+          persist-credentials: true
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
 
-      - name: Run release-plz
+      - name: Run release-plz release-pr
         uses: release-plz/action@v0.5
         with:
           command: release-pr
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN || secrets.CRATES_IO_TOKEN }}
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

.gitignore

@@ -5,8 +5,12 @@
 .env
 .env.*
 !.env.example
-/scripts
-!scripts/run-verification-plan.ps1
+# Ignore local helper scripts, but allow the few that are intentionally tracked.
+# (Cannot re-include a file if the parent dir itself is ignored.)
+/scripts/*
+!/scripts/run-verification-plan.ps1
+!/scripts/smart_publish.sh
+!/scripts/smart_publish.ps1
 /terminals
 
 # /benches
@@ -25,7 +29,27 @@ answer.md
 /.github/instructions
 /.github/prompts
 /.github/skills
+
+# Markdown: ignore by default, but never dual-track (committed + ignored).
+# Dual-tracked files break release-plz ("working directory has uncommitted changes").
 *.md
+# Root project docs (tracked on purpose)
+!README.md
+!CHANGELOG.md
+!CONTRIBUTING.md
+!CODE_OF_CONDUCT.md
+!CONTRACT.md
+!RELEASES.md
+!SECURITY.md
+!LICENSE*
+# GitHub meta
+!.github/BRANCH_PROTECTION.md
+!.github/PULL_REQUEST_TEMPLATE.md
+!.github/**/*.md
+# Crate + example READMEs
+!crates/**/README.md
+!crates/**/examples/**/*.md
+# Published docs tree
 !docs/COMMUNITY.md
 !docs/README.md
 !docs/GETTING_STARTED.md
@@ -38,7 +62,10 @@ answer.md
 !docs/PRODUCTION_CHECKLIST.md
 !docs/GOLDEN_PATH.md
 !docs/cookbook/src/**/*.md
+# Keep agent-only notes ignored even if under docs/
+docs/UPDATE_SUMMARIES.md
 tasks.md
+
 /mcps
 /agent-tools
 /apps

release-plz.toml

@@ -12,6 +12,8 @@ changelog_update = false
 changelog_path = "CHANGELOG.md"
 dependencies_update = false
 semver_check = false
+# Tolerate transient dirty state (e.g. generated files) during CI updates.
+allow_dirty = true
 repo_url = "https://github.com/Tuntii/RustAPI"
 git_release_enable = true
 git_release_name = "v{{ version }}"
@@ -26,10 +28,10 @@ git_tag_name = "v{{ version }}"
 pr_name = "release: v{{ version }}"
 pr_labels = ["release"]
 pr_branch_prefix = "release-plz-"
-# Publish any unpublished workspace versions on main (version bumps still come from
-# the release PR or an intentional SemVer bump like this 0.2.0 cut).
+# Publish unpublished crates when versions land on main (release PR or manual SemVer bump).
 release_always = true
 publish_timeout = "30m"
+publish_no_verify = true
 
 # Shared version group: every publishable crate stays aligned.
 [[package]]