Publish crates to crates.io via trusted publishing - #157
Merged
Conversation
bb8gh
force-pushed
the
bb8gh/trusted-publishing
branch
2 times, most recently
from
September 4, 2026 23:13
5e2029f to
89c3784
Compare
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The publishing workflow needs environment protection and immutable action pinning before safely receiving OIDC credentials.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review tier: Balanced
Findings: 1
New issues introduced by this change (2)
| Severity | Finding |
|---|---|
 |
.github/workflows/publish-crates.yaml — Naming the environment does not itself apply protection rules. Because workflow_dispatch can run… |
 |
.github/workflows/publish-crates.yaml — This job has id-token: write, so using the mutable v7 tag lets code fetched through this step… |
What changed in this PR
Adds trusted crates.io publishing through GitHub Actions.
Changes:
- Adds selectable crate publishing with dry-run support.
- Prevents helper crates from being published.
- Documents the release process.
| File | Description |
|---|---|
.github/workflows/publish-crates.yaml |
Adds the OIDC publishing workflow. |
CONTRIBUTING.md |
Documents crate releases. |
crates/bpe/benchmarks/Cargo.toml |
Disables benchmark publishing. |
crates/bpe/tests/Cargo.toml |
Disables test-helper publishing. |
crates/casefold/benchmarks/Cargo.toml |
Disables benchmark publishing. |
crates/consistent-choose-k/benchmarks/Cargo.toml |
Disables benchmark publishing. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Adds a workflow_dispatch workflow that publishes one selected crate using crates.io trusted publishing, so no long-lived CARGO_REGISTRY_TOKEN secret is needed. rust-lang/crates-io-auth-action exchanges the job's GitHub OIDC identity for a token that is revoked when the run ends. The job runs in the crates-io environment, both because crates.io matches on it and so that protection rules gate who can release and from which ref. Also marks the benchmark and integration-test helper crates publish = false so they can never be selected or published by accident. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
bb8gh
force-pushed
the
bb8gh/trusted-publishing
branch
from
September 4, 2026 23:16
89c3784 to
710ca0e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a
Publish cratesworkflow so we can release from Actions without keeping aCARGO_REGISTRY_TOKENsecret around. It'sworkflow_dispatchonly — pick a crate from the dropdown (or type a name intocrate_name_overrideif a new crate isn't listed yet), and optionally dry-run first.rust-lang/crates-io-auth-actionswaps the job's OIDC identity for a token that's revoked when the run ends.The job runs in the
crates-ioenvironment, which is also part of what crates.io matches on. Without it, anyone who can push a branch could dispatch a modified workflow and publish from it.Also marks the benchmark/test helper crates
publish = falseso they can't be published by accident, and adds a short release section to CONTRIBUTING.Still needs a trusted publisher configured per crate at
crates.io/crates/<crate>/settings/trusted-publishing(repogithub/rust-gems, workflowpublish-crates.yaml, environmentcrates-io).