Enable crates.io packaging for sysprims libraries

.github/workflows/release.yml

@@ -77,6 +77,18 @@ jobs:
           done
 
           echo "Go binding assets verified."
+  verify-cargo-package:
+    name: Verify Cargo Package
+    runs-on: ubuntu-latest
+    needs: validate-version
+    steps:
+      - uses: actions/checkout@v7
+      - name: Install Rust 1.88.0
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: 1.88.0
+      - name: Package crates without publishing
+        run: cargo package --workspace --no-verify
   # Build Linux targets using cargo-zigbuild for glibc version targeting
   build-linux:
     name: Build Linux
@@ -663,6 +675,7 @@ jobs:
     needs:
       - validate-version
       - verify-go-bindings-assets
+      - verify-cargo-package
       - build-linux
       - build-macos
       - build-windows

Cargo.toml

@@ -17,14 +17,16 @@ edition = "2021"
 rust-version = "1.88.0"
 license = "MIT OR Apache-2.0"
 repository = "https://github.com/3leaps/sysprims"
+homepage = "https://github.com/3leaps/sysprims"
 authors = ["3leaps Architecture Council"]
+publish = false
 
 [workspace.dependencies]
-sysprims-core = { path = "crates/sysprims-core" }
-sysprims-timeout = { path = "crates/sysprims-timeout" }
-sysprims-signal = { path = "crates/sysprims-signal" }
-sysprims-proc = { path = "crates/sysprims-proc" }
-sysprims-session = { path = "crates/sysprims-session" }
+sysprims-core = { version = "0.2.2", path = "crates/sysprims-core" }
+sysprims-timeout = { version = "0.2.2", path = "crates/sysprims-timeout" }
+sysprims-signal = { version = "0.2.2", path = "crates/sysprims-signal" }
+sysprims-proc = { version = "0.2.2", path = "crates/sysprims-proc" }
+sysprims-session = { version = "0.2.2", path = "crates/sysprims-session" }
 
 # Fulmen Ecosystem
 # NOTE: Pinned to ensure stable semantics across bindings and avoid accidental

Makefile

@@ -15,7 +15,7 @@
 .PHONY: check-windows check-windows-msvc check-windows-gnu
 .PHONY: build-release build-ffi cbindgen typescript-api-generate typescript-api-check
 .PHONY: build-local-go build-local-ffi-shared go-test header-go go-header go-prebuilt-darwin
-.PHONY: release-clean release-download release-checksums release-sign
+.PHONY: release-check release-clean release-download release-checksums release-sign
 .PHONY: release-export-keys release-verify-checksums release-verify-signatures
 .PHONY: release-verify-keys release-notes release-upload release-preflight
 .PHONY: release-guard-tag-version release-guard-tag-version-post
@@ -96,6 +96,7 @@ help: ## Show available targets
 	@echo ""
 	@echo "Release (manual signing workflow):"
 	@echo "  release-preflight     Verify all pre-tag requirements (REQUIRED before tagging)"
+	@echo "  release-check         Version consistency + cargo package (does not publish)"
 	@echo "  release-download      Download CI artifacts from GitHub"
 	@echo "  release-checksums     Generate SHA256SUMS and SHA512SUMS"
 	@echo "  release-sign          Sign checksums (requires SYSPRIMS_MINISIGN_KEY)"
@@ -699,6 +700,18 @@ release-verify-keys: ## Verify exported keys are public-only
 release-verify: release-verify-checksums release-verify-signatures release-verify-keys ## Run all release verification
 	@echo "[ok] All release verifications passed"
 
+release-check: version-check ## Version consistency + package check (does not publish)
+	@echo "Checking release readiness..."
+	@echo ""
+	@echo "Packaging workspace crates (does not cargo publish)..."
+	$(CARGO) package --workspace --no-verify
+	@echo "[ok] Package check passed"
+	@echo ""
+	@echo "Release checklist:"
+	@echo "  ✓ Version consistency validated"
+	@echo "  ✓ Package check passed"
+	@echo "  ✓ cargo publish was not run"
+
 release-notes: ## Copy release notes to dist
 	@src="docs/releases/$(SYSPRIMS_RELEASE_TAG).md"; \
 	if [ -f "$$src" ]; then \

RELEASE_CHECKLIST.md

@@ -197,6 +197,75 @@ Notes:
 
   Integrity rule: anything we intentionally publish as a release asset must be covered by the signed checksum manifests.
 
+### crates.io (library crates only, after the tag)
+
+Do this only after the exact release tag is on `origin` and points at the
+intended release commit. The principal or Echo lead must explicitly cue the
+upload. Token and owners stay out of the tree.
+
+`make release-check` / `cargo package --workspace --no-verify` creates local
+tarballs. It does **not** publish anything to crates.io. On the first
+publication of these crate names, dependent build verification happens in the
+cued publish sequence after predecessor crates are indexed.
+
+What gets published:
+
+| Crate | crates.io |
+|-------|-----------|
+| `sysprims-core` | yes (first) |
+| `sysprims-signal` | yes (after core is indexed) |
+| `sysprims-session` | yes (after core is indexed) |
+| `sysprims-proc` | yes (after signal is indexed) |
+| `sysprims-timeout` | yes (last) |
+| `sysprims-cli` | **never** (`publish = false`) |
+| `sysprims-ffi` | **no** (`publish = false`) |
+| `sysprims-ts-napi` | **no** (`publish = false`) |
+
+Workspace `publish` stays `false`. The five public Rust libraries opt in.
+
+Use a crates.io token scoped to the five library crate names. First upload of a
+crate name requires `publish-new` and `publish-update`; later releases should
+use update-only scope. Never store the token in this repository.
+
+Publish from a clean checkout of the tag:
+
+```bash
+VERSION=$(cat VERSION)
+git checkout "v${VERSION}"
+cargo publish --dry-run -p sysprims-core
+cargo publish -p sysprims-core
+cargo info --registry crates-io "sysprims-core@${VERSION}"
+cargo publish --dry-run -p sysprims-signal
+cargo publish -p sysprims-signal
+cargo info --registry crates-io "sysprims-signal@${VERSION}"
+cargo publish --dry-run -p sysprims-session
+cargo publish -p sysprims-session
+cargo info --registry crates-io "sysprims-session@${VERSION}"
+cargo publish --dry-run -p sysprims-proc
+cargo publish -p sysprims-proc
+cargo info --registry crates-io "sysprims-proc@${VERSION}"
+cargo publish --dry-run -p sysprims-timeout
+cargo publish -p sysprims-timeout
+```
+
+- [ ] Dry-run then publish each crate in dependency order.
+- [ ] Confirm each predecessor with
+      `cargo info --registry crates-io <crate>@${VERSION}` before the next
+      dependent publish.
+- [ ] On the first upload of these crate names, expect standalone dry-runs for
+      dependent crates to fail until predecessor crates are actually indexed.
+- [ ] Do **not** `cargo publish -p sysprims-cli`, `sysprims-ffi`, or
+      `sysprims-ts-napi`.
+
+Negative control:
+
+```bash
+cargo publish --dry-run -p sysprims-cli
+cargo publish --dry-run -p sysprims-ffi
+cargo publish --dry-run -p sysprims-ts-napi
+# expected: error, crate cannot be published
+```
+
 ## 2. Manual Signing (Local Machine)
 
 ### Set Environment Variables

bindings/typescript/sysprims/native/Cargo.toml

@@ -4,7 +4,9 @@ version.workspace = true
 edition.workspace = true
 license.workspace = true
 repository.workspace = true
+homepage.workspace = true
 authors.workspace = true
+publish.workspace = true
 # NOTE: napi-build requires rustc >= 1.88.
 rust-version = "1.88.0"
 description = "Node-API addon for @3leaps/sysprims (TypeScript bindings)"

crates/sysprims-cli/Cargo.toml

@@ -4,8 +4,10 @@ version.workspace = true
 edition.workspace = true
 license.workspace = true
 repository.workspace = true
+homepage.workspace = true
 authors.workspace = true
 rust-version.workspace = true
+publish.workspace = true
 description = "CLI tools for sysprims process utilities"
 
 [[bin]]

crates/sysprims-core/Cargo.toml

@@ -4,9 +4,13 @@ version.workspace = true
 edition.workspace = true
 license.workspace = true
 repository.workspace = true
+homepage.workspace = true
 authors.workspace = true
 rust-version.workspace = true
+publish = true
 description = "Core types, errors, and platform abstractions for sysprims"
+documentation = "https://docs.rs/sysprims-core"
+readme = "README.md"
 
 [dependencies]
 rsfulmen = { workspace = true }

crates/sysprims-core/README.md

@@ -0,0 +1,6 @@
+# sysprims-core
+
+Core types, errors, and platform abstractions for the sysprims Rust crates.
+
+See the [sysprims repository](https://github.com/3leaps/sysprims) for
+documentation, release notes, and supported platform policy.

crates/sysprims-proc/Cargo.toml

@@ -4,9 +4,13 @@ version.workspace = true
 edition.workspace = true
 license.workspace = true
 repository.workspace = true
+homepage.workspace = true
 authors.workspace = true
 rust-version.workspace = true
+publish = true
 description = "Process inspection and enumeration utilities"
+documentation = "https://docs.rs/sysprims-proc"
+readme = "README.md"
 
 [features]
 default = ["proc_ext"]

crates/sysprims-proc/README.md

@@ -0,0 +1,6 @@
+# sysprims-proc
+
+Process inspection and enumeration utilities for sysprims.
+
+See the [sysprims repository](https://github.com/3leaps/sysprims) for
+documentation, release notes, and supported platform policy.

crates/sysprims-session/Cargo.toml

@@ -4,9 +4,13 @@ version.workspace = true
 edition.workspace = true
 license.workspace = true
 repository.workspace = true
+homepage.workspace = true
 authors.workspace = true
 rust-version.workspace = true
+publish = true
 description = "GPL-free session and process group management (setsid, nohup)"
+documentation = "https://docs.rs/sysprims-session"
+readme = "README.md"
 
 [dependencies]
 sysprims-core.workspace = true

crates/sysprims-session/README.md

@@ -1,5 +1,10 @@
 # sysprims-session
 
+Session and process group acquisition primitives for sysprims.
+
+See the [sysprims repository](https://github.com/3leaps/sysprims) for
+documentation, release notes, and supported platform policy.
+
 GPL-free session and process group management primitives.
 
 ## Overview

crates/sysprims-signal/Cargo.toml

@@ -4,9 +4,13 @@ version.workspace = true
 edition.workspace = true
 license.workspace = true
 repository.workspace = true
+homepage.workspace = true
 authors.workspace = true
 rust-version.workspace = true
+publish = true
 description = "Signal dispatch and process group management"
+documentation = "https://docs.rs/sysprims-signal"
+readme = "README.md"
 
 [features]
 default = []