Add audio support, the v2 header, and automated publishing

.github/workflows/python.yml

@@ -1,9 +1,12 @@
 name: python
 
+# Wheels build on every push and pull request. They are published to PyPI from a
+# version tag: `v*` ships the bindings alongside a CLI release, and `py-v*` ships a
+# bindings-only release without cutting a new CLI version.
 on:
   push:
     branches: [main]
-    tags: ["py-v*"]
+    tags: ["v*", "py-v*"]
   pull_request:
   workflow_dispatch:
 
@@ -46,7 +49,9 @@ jobs:
 
   publish:
     name: publish to PyPI
-    if: startsWith(github.ref, 'refs/tags/py-v')
+    # Any version tag publishes: `v*` from a CLI release, `py-v*` from a
+    # bindings-only release. `--skip-existing` makes a re-run harmless.
+    if: startsWith(github.ref, 'refs/tags/v') || startsWith(github.ref, 'refs/tags/py-v')
     needs: test
     runs-on: ubuntu-latest
     permissions:

.github/workflows/release.yml

@@ -2,12 +2,14 @@ name: release
 
 # Build and publish binaries when a version tag is pushed. Each target is built on
 # a native runner, tested, packaged, and attached to the GitHub Release for the tag.
+# Once every target has passed, the crate is published to crates.io.
 on:
   push:
     tags:
       - "v*"
 
-# The release upload needs permission to write to the repository's releases.
+# The release upload needs permission to write to the repository's releases. The
+# publish job requests its own id-token permission, since it needs an OIDC token.
 permissions:
   contents: write
 
@@ -56,3 +58,32 @@ jobs:
         uses: softprops/action-gh-release@v2
         with:
           files: decayfmt-${{ matrix.target }}.*
+
+  publish:
+    name: publish to crates.io
+    # Only after every target has built and tested, so a failing platform stops the
+    # publish. A crates.io version can never be reused, unlike a GitHub release.
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      # Required to request the OIDC token that crates.io exchanges for a
+      # short-lived publish token. No API token is stored in the repository.
+      id-token: write
+      contents: read
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+
+      - name: install rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: authenticate with crates.io
+        id: auth
+        uses: rust-lang/crates-io-auth-action@v1
+
+      - name: publish
+        # The workspace contains decayfmt-py, which is publish = false and ships to
+        # PyPI instead, so only the root crate is published here.
+        run: cargo publish --package decayfmt
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "decayfmt"
-version = "0.1.1"
+version = "0.2.0"
 edition = "2021"
 description = "A file format where decay is a first-class property. Every open permanently corrupts the file."
 license = "MIT"
@@ -12,12 +12,17 @@ exclude = ["assets/", ".github/"]
 
 [dependencies]
 clap = { version = "4", features = ["derive"] }
+fs2 = "0.4"
+hound = "3.5"
 image = { version = "0.25", default-features = false, features = [
     "bmp", "dds", "exr", "ff", "gif", "hdr", "ico", "jpeg", "png", "pnm",
     "qoi", "tga", "tiff", "webp",
 ] }
 rand = "0.8"
 rayon = "1"
+symphonia = { version = "0.6", default-features = false, features = [
+    "wav", "flac", "mp3", "ogg", "vorbis", "pcm",
+] }
 
 [profile.release]
 strip = true