add crates release (#250)

- **Add crates.io release workflow**
- **Make idempotent**

## Description

### Why is this change being made?

1. Add a workflow to release crates in order.


### What is changing?

1. Created a new workflow to run integ tests, then release the crates.
This uses trusted publishing.


### Related Links
- **Issue #, if available**:

---

## Testing

### How was this tested?

1. 

### When testing locally, provide testing artifact(s):

1. 

---

## Reviewee Checklist

**Update the checklist after submitting the PR**

- [x] I have reviewed, tested and understand all changes
  *If not, why:*
- [x] I have filled out the Description and Testing sections above
  *If not, why:*
- [x] Build and Unit tests are passing
  *If not, why:*
- [x] Unit test coverage check is passing
  *If not, why:*
- [x] Integration tests pass locally
  *If not, why:*
- [ ] I have updated integration tests (if needed)
  *If not, why:*
- [x] I have ensured no sensitive information is leaking (i.e., no
logging of sensitive fields, or otherwise)
  *If not, why:*
- [x] I have added explanatory comments for complex logic, new
classes/methods and new tests
  *If not, why:*
- [ ] I have updated README/documentation (if needed)
  *If not, why:*
- [ ] I have clearly called out breaking changes (if any)
  *If not, why:*

---

## Reviewer Checklist

**All reviewers please ensure the following are true before reviewing:**

- Reviewee checklist has been accurately filled out
- Code changes align with stated purpose in description
- Test coverage adequately validates the changes

---

By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 license.

Author: simonmarty

.github/workflows/publish-crates.yml

@@ -0,0 +1,81 @@
+name: Publish Crates
+
+# Publishes the workspace crates to crates.io after integration tests pass.
+# The integration-tests crate is not published (publish = false in its
+# Cargo.toml, and it is omitted from the publish list below).
+
+on:
+  workflow_dispatch:
+  workflow_call:
+
+env:
+  CARGO_TERM_COLOR: always
+
+concurrency:
+  group: publish-crates
+  cancel-in-progress: false
+
+jobs:
+  integ:
+    uses: ./.github/workflows/integration-tests.yml
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: write
+    secrets: inherit
+
+  publish:
+    needs: [integ]
+    permissions:
+      contents: read
+      id-token: write
+    environment: publish-crates
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 1
+
+      - name: Authenticate to crates.io
+        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
+        id: auth
+
+      - name: Publish crates to crates.io
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
+        run: |
+          set -euo pipefail
+          # Publish in dependency (topological) order.
+          # Before publishing a crate check whether
+          # its current version is already on crates.io and skip it if so.
+          crates=(
+            aws_workload_credentials_provider_common
+            aws_secretsmanager_caching
+            aws_certificatemanager_provider
+            aws_secretsmanager_provider
+            aws_workload_credentials_provider
+          )
+          for crate in "${crates[@]}"; do
+            version=$(cargo metadata --format-version 1 --no-deps \
+              | jq -r --arg name "$crate" '.packages[] | select(.name == $name) | .version')
+            echo "::group::$crate@$version"
+
+            http_code=$(curl -sSL -o /dev/null -w '%{http_code}' \
+              -A "aws-workload-credentials-provider-publish-ci" \
+              "https://crates.io/api/v1/crates/$crate/$version")
+            if [[ "$http_code" == "200" ]]; then
+              echo "$crate@$version already published — skipping"
+            elif [[ "$http_code" == "404" ]]; then
+              cargo publish -p "$crate"
+            else
+              echo "unexpected HTTP $http_code from crates.io for $crate@$version" >&2
+              exit 1
+            fi
+            echo "::endgroup::"
+          done