Automatically publish new releases to Hex

.github/workflows/ci.yml

@@ -16,7 +16,7 @@ jobs:
       matrix:
         os: ['ubuntu-24.04']
         otp: ['28', '27', '26']
-        rebar3: ['3.25.0']
+        rebar3: ['3.27.0']
     runs-on: ${{matrix.os}}
     steps:
       - uses: actions/checkout@v4
@@ -59,7 +59,7 @@ jobs:
       matrix:
         os: ['macos-14', 'macos-15']
         otp: ['28', '27']
-        rebar3: ['3.25.0']
+        rebar3: ['3.27.0']
     runs-on: ${{matrix.os}}
     steps:
       - uses: actions/checkout@v4

.github/workflows/release.yml

@@ -0,0 +1,23 @@
+name: Publish to Hex
+
+on:
+  release:
+    types: [ released ] # pre- and draft releases are excluded
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: erlef/setup-beam@v1
+        with:
+          otp-version: "28"
+          rebar3-version: "3.27"
+      - run: rebar3 compile
+      - run: rebar3 hex publish -r hexpm --yes
+        env:
+          HEX_API_KEY: ${{ secrets.HEX_API_KEY }}

.github/workflows/revert-release.yml

@@ -0,0 +1,25 @@
+name: Revert published version from Hex
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Package version to revert (e.g. 1.0.0)"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  revert:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: erlef/setup-beam@v1
+        with:
+          otp-version: "28"
+          rebar3-version: "3.27"
+      - run: rebar3 hex publish --revert ${{ inputs.version }} -r hexpm --yes
+        env:
+          HEX_API_KEY: ${{ secrets.HEX_API_KEY }}

README.md

@@ -46,6 +46,13 @@ Is partial. We don't expect to have the fastest implementation, as that would be
 ### The outcome
 On average it's 30% faster than the pure OpenSSL implementation, which `crypto:pbkdf2_hmac/5` calls without yielding, and 10x times faster (and x3N less memory, where N is the iteration count!) than a pure erlang equivalent (you can compare using the provided module in `./benchmarks/bench.ex`).
 
+## Releasing to Hex.pm
+Creating a GitHub release (non-draft, non-prerelease) automatically publishes the package to [Hex.pm](https://hex.pm/) via the **Publish to Hex** workflow.
+This workflow can also be triggered manually from the Actions tab — make sure to run it from the specific tag you want to publish.
+
+To revert a published version, run the **Revert published version from Hex** workflow from the Actions tab, providing the version to revert.
+Hex.pm only allows reverting within 1 hour of publishing — after that, the version can only be *retired*.
+
 ## Credit where credit is due
 The initial algorithm and optimisations were taken from Joseph Birr-Pixton's
 [fastpbkdf2](https://github.com/ctz/fastpbkdf2)'s repository.