DanConwayDev
13d8f24a2d
The v3.0.8 crate publisher failed during Cargo package verification because its isolated runtime had no cc linker. Include stdenv.cc in that runtime alongside Rust, pkg-config and OpenSSL metadata. Share the runtime definition with an empty-environment smoke check that compiles and runs Rust and OpenSSL-linked C programs. This checks native linking without relying on the development shell's compiler. Keep Cargo verification and tag guards intact; signer recovery and publication retries are outside this change. Validation: built the crate publisher, crates-toolchain check and release-scripts check with Nix. No registry publication was attempted. Assisted-by: GPT-6
1.8 KiB
Publish ngit-grasp to crates.io
The native Nix workflow .ngit/nix/workflows/crates_release.yaml publishes
ngit-grasp after the existing formatting, lint and test steps pass for a v* tag push. The tag must exactly match v followed by the
package version in Cargo.toml, including any prerelease suffix. Branch pushes
and pull requests do not publish crates. The unpublished grasp-audit workspace
member is not selected for publication.
Configure the repository's CARGO_REGISTRY_TOKEN secret in ngit-ci with a
crates.io token scoped to publishing ngit-grasp. The token is supplied as
$NGIT_CI_SECRETS_DIR/CARGO_REGISTRY_TOKEN only to the publication command; Cargo
does not write a login credential file.
The publisher depends on the complete rust_ci.yaml workflow at the peeled
tag commit. Compatible successful CI is reused; missing checks are scheduled
and failed checks block publication. reuse: never makes publication specific
to each tag push. The command verifies the fetched tag and checkout against
NGIT_CI_COMMIT_SHA.
The workflow runs cargo publish --locked --registry crates-io --package ngit-grasp, including Cargo's package verification. A missing token or an
already-published version fails the step; the workflow does not overwrite or
automatically bump releases.
The publisher supplies its own Rust toolchain, C compiler/linker and OpenSSL
development metadata for package verification in the isolated CI runtime.
The crates-toolchain flake check compiles and runs Rust and OpenSSL-linked C
programs with that runtime and an empty inherited environment.
The workflow must be included in the tagged commit. Adding it does not backfill existing tags, and crate publication is independent of the existing archive, NIP-82 and container publication jobs. It requires no GitHub registry authentication.