Repository navigation
ci(release): GitHub Actions cuts the release from a dispatch on main - #117
Closed
Industrial wants to merge 1 commit into
Closed
Industrial wants to merge 1 commit into
Industrial wants to merge 1 commit into
Conversation
publish.yml can now do a release end to end, with no hand-pushed tag and no owner steps on crates.io: - S6: a real run dispatched on main is authorized when the actor is a repository admin, GitHub verifies the HEAD commit (squash merges are GitHub-signed) and no v<version> tag points elsewhere. The release job creates the v<version> tag on that commit with the GitHub Release; the verify job checks the provenance with --source-branch for such a run. A pushed signed tag still works as before. - S3: trusted publishing stays the default. A crate's first version, or a crate whose trusted publishing is denied, falls back to the CARGO_REGISTRY_TOKEN secret of the crates-io environment, after which publish-crate.sh adds publish.yml as the crate's trusted publisher. The plan fails a real release before any upload when a new crate has no working token; a dry run warns. docs/RELEASING.md describes the dispatch flow and the fallback. Signed-off-by: Tom Wieland <tom.wieland@gmail.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Owner
Author
|
Superseded: going back to the 0.10.1 release flow (tag push + CARGO_REGISTRY_TOKEN) instead. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lets GitHub Actions cut a release end to end: run Publish to crates.io on
main(Dry run unchecked) and it publishes every crate, verifies them, and creates thev<version>tag and the GitHub Release.mainis allowed when the actor is a repo admin, GitHub verifies the HEAD commit (squash merges are GitHub-signed), and nov<version>tag points elsewhere. A pushed signed tag still works.id_effect_rpc_macros,id_effect_lintsthis release), or a crate without a trusted publisher yet, falls back to the existingCARGO_REGISTRY_TOKENsecret of thecrates-ioenvironment;publish-crate.shthen addspublish.ymlas that crate's trusted publisher. The plan fails a real release before any upload if a new crate has no working token; a dry run warns.verifyusesslsa-verifier --source-branchfor a dispatched run (no tag exists yet then).docs/RELEASING.mdupdated.Local: actionlint, shellcheck,
bash -n; plan mode exercised against the live index (new crate without/with bad token → refused, dry run → warning, existing crate → publish, published version → skip). A dry-run dispatch on this branch is linked in the comments.🤖 Generated with Claude Code