Migrate to ATRAPS LLC: copyright, CI lint scope, trusted publishing

.github/workflows/ci.yml

@@ -31,7 +31,7 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy
-      - run: cargo clippy -- -D warnings
+      - run: cargo clippy --all-targets --all-features -- -D warnings
 
   fmt:
     name: Format

.github/workflows/publish.yml

@@ -7,14 +7,36 @@ on:
 env:
   CARGO_TERM_COLOR: always
 
+permissions:
+  contents: read
+
 jobs:
   publish:
     name: Publish
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write        # required to mint the crates.io OIDC token
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0     # merge-base needs real history
+
+      # A GitHub release can be cut from any commit, including one that never
+      # landed on main. Publishing is restricted to release tags that are
+      # actually contained in main.
+      - name: Refuse releases not contained in main
+        run: |
+          git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
+          git merge-base --is-ancestor "$GITHUB_SHA" refs/remotes/origin/main \
+            || { echo "::error::release commit $GITHUB_SHA is not contained in main"; exit 1; }
+
       - uses: dtolnay/rust-toolchain@stable
       - run: cargo test
+
+      - uses: rust-lang/crates-io-auth-action@v1
+        id: auth
+
       - run: cargo publish
         env:
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}

CHANGELOG.md

@@ -6,6 +6,20 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.3.1]
+
+### Changed
+
+- Recorded ATRAPS LLC as copyright holder and added a `NOTICE` file. The Apache-2.0
+  appendix was never filled in — it still carried the literal
+  `[yyyy] [name of copyright owner]` placeholder, so nothing in this repo stated
+  who owned it. No functional change.
+- Dropped the deprecated `authors` field and repointed `repository` at the organisation.
+- Refreshed transitive dependencies (`cargo update`).
+- CI lints `--all-targets --all-features`, so lint failures outside the library are
+  gated rather than invisible.
+- Publishing now uses crates.io trusted publishing instead of a stored registry token.
+
 ## [0.3.0] — 2026-06-09
 
 ### Added
@@ -315,7 +329,9 @@ Affects `vbobject.rs`, `pcodemethod.rs`, `methodlink.rs`,
 
 Initial public release.
 
-[Unreleased]: https://github.com/BinFlip/visualbasic-rs/compare/v0.2.1...HEAD
-[0.2.1]: https://github.com/BinFlip/visualbasic-rs/compare/v0.2.0...v0.2.1
-[0.2.0]: https://github.com/BinFlip/visualbasic-rs/compare/v0.1.0...v0.2.0
-[0.1.0]: https://github.com/BinFlip/visualbasic-rs/releases/tag/v0.1.0
+[Unreleased]: https://github.com/ATRAPSLLC/visualbasic-rs/compare/v0.3.1...HEAD
+[0.3.1]: https://github.com/ATRAPSLLC/visualbasic-rs/compare/v0.3.0...v0.3.1
+[0.3.0]: https://github.com/ATRAPSLLC/visualbasic-rs/compare/v0.2.1...v0.3.0
+[0.2.1]: https://github.com/ATRAPSLLC/visualbasic-rs/compare/v0.2.0...v0.2.1
+[0.2.0]: https://github.com/ATRAPSLLC/visualbasic-rs/compare/v0.1.0...v0.2.0
+[0.1.0]: https://github.com/ATRAPSLLC/visualbasic-rs/releases/tag/v0.1.0