Repository navigation
ci(release): let a release create a new crate, so 0.58.0 and later finish unattended - #651
Merged
Merged
Conversation
…sher without a person crates.io trusted publishing cannot create a crate, so a new workspace crate used to need a hand upload with a personal token before a release could finish. The release now reads the CRATES_IO_NEW_CRATE_TOKEN secret (publish-new, publish-update and trusted-publishing on geiserx_*): a crate missing from crates.io gets its first version uploaded with it, and release.yml is then registered as its trusted publisher, so later releases use OIDC like every other crate.
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 4 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A new workspace crate stopped the 0.58.0 publish halfway: crates.io trusted publishing only covers crates that already exist, so
geiserx_ts_portmappercould not be created by the release, and nothing in CI could do it. Every future new crate would need the same hand step.The release workflow now passes the
CRATES_IO_NEW_CRATE_TOKENsecret toscripts/publish-crates.sh. The token has the scopes publish-new, publish-update and trusted-publishing, is limited togeiserx_*, and does not expire. For each crate the script asks crates.io whether it exists:release.ymlin this repo is registered as its trusted publisher throughPOST /api/v1/trusted_publishing/github_configs, with the same fields the other 44 crates carry;Checked against live crates.io:
geiserx_ts_runtimereads as existing with a trusted publisher already set, so no write is made, andgeiserx_ts_portmapperreads as missing.After merge, a
workflow_dispatchof Release on main finishes 0.58.0: it skips the 39 crates already up and publishes the remaining five, the new one through this path.