mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-30 07:37:36 +00:00
Johnathan Corgan
51efa43ec3
The publish job authenticated with a long-lived API token stored as the crates-io environment's CARGO_REGISTRY_TOKEN secret. Switch it to trusted publishing: the job requests a GitHub OIDC token (id-token: write, granted to the publish job only), rust-lang/crates-io-auth-action exchanges it for a publish token that expires after 30 minutes and is revoked when the job ends, and cargo publish uses that. crates.io accepts the exchange only from this repository, this workflow file and the crates-io environment, which keeps its approval gate. The trigger condition is unchanged: a pushed release tag without a pre-release suffix. The crate's trusted publisher must be configured on crates.io before this lands; the stored token can be revoked and the secret removed after.
94 lines
3.1 KiB
YAML
94 lines
3.1 KiB
YAML
name: Crate
|
|
|
|
# Checks on every maint push and every v* tag that the root package would
|
|
# publish to crates.io as fips-mesh (testing/check-crate.sh), and publishes it
|
|
# at a release tag. A pre-release tag (v0.5.3-rc1) is checked, not published.
|
|
#
|
|
# Only maint, for now: on master and next the root package depends on the
|
|
# unpublished fips-core by path, which crates.io refuses, so the check would
|
|
# fail there until fips-core is published too.
|
|
on:
|
|
push:
|
|
branches: [maint]
|
|
tags: ["v*"]
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
|
|
jobs:
|
|
check:
|
|
name: Check the crate
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
|
|
|
|
- name: Install system dependencies
|
|
run: sudo apt-get update && sudo apt-get install -y libdbus-1-dev nftables
|
|
|
|
- name: Install Rust toolchain
|
|
uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
|
|
with:
|
|
cache: false
|
|
rustflags: ''
|
|
|
|
- name: Check the crate would publish
|
|
run: bash testing/check-crate.sh
|
|
|
|
- name: Upload the packaged crate
|
|
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
|
|
with:
|
|
name: crate
|
|
path: target/crate-check/*.crate
|
|
if-no-files-found: error
|
|
|
|
publish:
|
|
name: Publish to crates.io
|
|
needs: check
|
|
# A pushed release tag only. A tag with a pre-release suffix (v0.5.3-rc1)
|
|
# has a '-' in its name and is not published, and a manual run never
|
|
# publishes, even one started on a release tag.
|
|
if: >-
|
|
github.event_name == 'push'
|
|
&& startsWith(github.ref, 'refs/tags/v')
|
|
&& !contains(github.ref_name, '-')
|
|
runs-on: ubuntu-latest
|
|
# The crates-io environment requires the maintainer's approval, so a tag
|
|
# push waits for it before uploading. crates.io trusts this repository,
|
|
# this workflow file and this environment name together; a change to any
|
|
# of the three must be matched in the crate's trusted publishing settings.
|
|
environment: crates-io
|
|
# id-token lets the job request the OIDC token that crates.io exchanges for
|
|
# a short-lived publish token. Job-level permissions replace the workflow's,
|
|
# so contents: read is restated for the checkout.
|
|
permissions:
|
|
contents: read
|
|
id-token: write
|
|
steps:
|
|
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
|
|
|
|
- name: Install system dependencies
|
|
run: sudo apt-get update && sudo apt-get install -y libdbus-1-dev
|
|
|
|
- name: Install Rust toolchain
|
|
uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
|
|
with:
|
|
cache: false
|
|
rustflags: ''
|
|
|
|
- name: Get a crates.io publish token
|
|
id: auth
|
|
uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
|
|
|
|
- name: Publish
|
|
env:
|
|
CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
|
|
run: cargo publish --locked -p fips-mesh
|