From 9d7639f3948c87b9bed7c07d18081c3d6d41c1b3 Mon Sep 17 00:00:00 2001 From: Luca Muscariello Date: Fri, 4 Sep 2026 10:01:47 +0200 Subject: [PATCH] ci: publish crates via crates.io Trusted Publishing, not a static token MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit release-plz already exchanges a GitHub Actions OIDC token for a short-lived crates.io token whenever no CARGO_REGISTRY_TOKEN is set — no flag needed. All 13 published crates are registered as Trusted Publishers on crates.io for this repo + release-rust.yml, so the static secret and the step that checked for it can just go. agntcy/slim's release-rust.yaml, pinned to the same release-plz/action commit, already runs this way. Signed-off-by: Luca Muscariello --- .github/workflows/release-rust.yml | 8 -------- 1 file changed, 8 deletions(-) diff --git a/.github/workflows/release-rust.yml b/.github/workflows/release-rust.yml index 69e77ae4..a4562077 100644 --- a/.github/workflows/release-rust.yml +++ b/.github/workflows/release-rust.yml @@ -22,7 +22,6 @@ jobs: pull-requests: read id-token: write env: - CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} PYO3_PYTHON: python steps: - name: Checkout repository @@ -53,13 +52,6 @@ jobs: # shipped, so this is safe to run on every push. run: cargo publish --dry-run -p agntcy-shadi-agent-secrets - - name: Require crates.io publish token - run: | - if [ -z "${CARGO_REGISTRY_TOKEN}" ]; then - echo "::error::CARGO_REGISTRY_TOKEN is not configured. Set the repository secret to allow release-plz to publish crates." - exit 1 - fi - - name: Run release-plz publish id: release-plz uses: release-plz/action@2eb1d8bcb770b4c48ccfaad919734b38b51958c9 # v0.5.131