From 9ae8345601591daf4def0509c62fed77b62b2513 Mon Sep 17 00:00:00 2001
From: Jheison Martinez Bolivar <jheison.mb@gmail.com>
Date: Tue, 20 Oct 2026 23:12:53 -0500
Subject: [PATCH 1/3] ci(release): cut releases by hand from main through the
 approved manual workflow

---
 .github/workflows/ci.yml      |  7 ++++++-
 .github/workflows/release.yml | 21 +++++++++++++--------
 2 files changed, 19 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ec44e2d..d6f1049 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -3,7 +3,12 @@ name: CI
 on:
   pull_request:
   workflow_dispatch:
+  # release.yml calls it to run CI again on main, where merged PRs meet.
+  workflow_call:
+
+permissions:
+  contents: read
 
 jobs:
   rust-ci:
-    uses: UniverLab/workflows/.github/workflows/rust-ci.yml@main
\ No newline at end of file
+    uses: UniverLab/workflows/.github/workflows/rust-ci.yml@main
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 031582a..fc97b3f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,20 +1,25 @@
 name: Release
 
+# Trunk-based release (decision 10eadef1), run by hand on main: CI on main,
+# then UniverLab/workflows rust-release-manual.yml checks the version bump,
+# builds the binaries, publishes to crates.io through Trusted Publishing in
+# the `production` environment (admin approval, main only) and creates the
+# tag and GitHub release last. crates.io trusts this file name (release.yml)
+# and that environment.
 on:
-  pull_request:
-    branches: [main]
-    types: [closed]
-    paths: [Cargo.toml]
   workflow_dispatch:
 
 permissions:
   contents: write
-  actions: read # reuse the release binaries the PR to main already built
+  id-token: write
 
 jobs:
+  ci:
+    uses: ./.github/workflows/ci.yml
+    secrets: inherit
+
   release:
-    if: github.event.pull_request.merged == true || github.event_name == 'workflow_dispatch'
-    uses: UniverLab/workflows/.github/workflows/rust-release.yml@main
+    needs: ci
+    uses: UniverLab/workflows/.github/workflows/rust-release-manual.yml@main
     with:
       binary-name: ghscaff
-    secrets: inherit

From dcfb0b968d5a4a9900e7141ba619c06f5aeeca4e Mon Sep 17 00:00:00 2001
From: Jheison Martinez Bolivar <jheison.mb@gmail.com>
Date: Tue, 20 Oct 2026 23:12:53 -0500
Subject: [PATCH 2/3] docs(readme): open with the experiment's banner

---
 README.md | 16 +++-------------
 1 file changed, 3 insertions(+), 13 deletions(-)

diff --git a/README.md b/README.md
index 2b4b2e7..ea6730f 100644
--- a/README.md
+++ b/README.md
@@ -1,16 +1,6 @@
-```
-          █████       █████████                        ██████     ██████ 
-         ░░███       ███░░░░░███                      ███░░███   ███░░███
-  ███████ ░███████  ░███    ░░░   ██████   ██████    ░███ ░░░   ░███ ░░░ 
- ███░░███ ░███░░███ ░░█████████  ███░░███ ░░░░░███  ███████    ███████   
-░███ ░███ ░███ ░███  ░░░░░░░░███░███ ░░░   ███████ ░░░███░    ░░░███░    
-░███ ░███ ░███ ░███  ███    ░███░███  ███ ███░░███   ░███       ░███     
-░░███████ ████ █████░░█████████ ░░██████ ░░████████  █████      █████    
- ░░░░░███░░░░ ░░░░░  ░░░░░░░░░   ░░░░░░   ░░░░░░░░  ░░░░░      ░░░░░     
- ███ ░███                                                                
-░░██████                                                                 
- ░░░░░░                                                                  
-```
+<p align="center">
+  <img src="https://raw.githubusercontent.com/UniverLab/.github/main/assets/banner-ghscaff.svg" alt="ghScaff"/>
+</p>
 
 <p align="center">
   <a href="https://github.com/UniverLab/ghscaff/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/UniverLab/ghscaff/ci.yml?branch=main&style=for-the-badge&label=CI" alt="CI"/></a>

From 6ff9b9ac05ad069750f6d8b9f135dedb06f0e8c0 Mon Sep 17 00:00:00 2001
From: Jheison Martinez Bolivar <jheison.mb@gmail.com>
Date: Tue, 20 Oct 2026 23:30:35 -0500
Subject: [PATCH 3/3] fix(deps): bump rustls-webpki, rustls and webpki-roots
 past the October RustSec advisories

---
 Cargo.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index c850cc7..9108705 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1279,9 +1279,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.45"
+version = "0.23.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
+checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
 dependencies = [
  "once_cell",
  "ring",
@@ -1303,9 +1303,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.15"
+version = "0.103.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
+checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -1959,9 +1959,9 @@ dependencies = [
 
 [[package]]
 name = "webpki-roots"
-version = "1.0.8"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf85cb06032201fa7c6f829d7db5a7e5aa45bcc0655327713065f6f0576731bf"
+checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9"
 dependencies = [
  "rustls-pki-types",
 ]