mirror of
https://relay.ngit.dev/npub15qydau2hjma6ngxkl2cyar74wzyjshvl65za5k5rl69264ar2exs5cyejr/ngit-grasp.git
synced 2026-10-30 11:07:33 +00:00
DanConwayDev
13d8f24a2d
The v3.0.8 crate publisher failed during Cargo package verification because its isolated runtime had no cc linker. Include stdenv.cc in that runtime alongside Rust, pkg-config and OpenSSL metadata. Share the runtime definition with an empty-environment smoke check that compiles and runs Rust and OpenSSL-linked C programs. This checks native linking without relying on the development shell's compiler. Keep Cargo verification and tag guards intact; signer recovery and publication retries are outside this change. Validation: built the crate publisher, crates-toolchain check and release-scripts check with Nix. No registry publication was attempted. Assisted-by: GPT-6
34 lines
1.8 KiB
Markdown
34 lines
1.8 KiB
Markdown
# Publish ngit-grasp to crates.io
|
|
|
|
The native Nix workflow `.ngit/nix/workflows/crates_release.yaml` publishes
|
|
`ngit-grasp` after the existing formatting, lint and test steps pass for a `v*` tag push. The tag must exactly match `v` followed by the
|
|
package version in `Cargo.toml`, including any prerelease suffix. Branch pushes
|
|
and pull requests do not publish crates. The unpublished `grasp-audit` workspace
|
|
member is not selected for publication.
|
|
|
|
Configure the repository's `CARGO_REGISTRY_TOKEN` secret in ngit-ci with a
|
|
crates.io token scoped to publishing `ngit-grasp`. The token is supplied as
|
|
`$NGIT_CI_SECRETS_DIR/CARGO_REGISTRY_TOKEN` only to the publication command; Cargo
|
|
does not write a login credential file.
|
|
|
|
The publisher depends on the complete `rust_ci.yaml` workflow at the peeled
|
|
tag commit. Compatible successful CI is reused; missing checks are scheduled
|
|
and failed checks block publication. `reuse: never` makes publication specific
|
|
to each tag push. The command verifies the fetched tag and checkout against
|
|
`NGIT_CI_COMMIT_SHA`.
|
|
|
|
The workflow runs `cargo publish --locked --registry crates-io --package
|
|
ngit-grasp`, including Cargo's package verification. A missing token or an
|
|
already-published version fails the step; the workflow does not overwrite or
|
|
automatically bump releases.
|
|
|
|
The publisher supplies its own Rust toolchain, C compiler/linker and OpenSSL
|
|
development metadata for package verification in the isolated CI runtime.
|
|
The `crates-toolchain` flake check compiles and runs Rust and OpenSSL-linked C
|
|
programs with that runtime and an empty inherited environment.
|
|
|
|
The workflow must be included in the tagged commit. Adding it does not
|
|
backfill existing tags, and crate publication is independent of the existing
|
|
archive, NIP-82 and container publication jobs. It requires no GitHub registry
|
|
authentication.
|