ci(publish): switch cargo publishing to trusted OIDC auth

[dev-jodee]

Summary

• Adds id-token: write permission to the publish workflow so GitHub Actions can issue OIDC identity tokens
• Removes CARGO_REGISTRY_TOKEN env vars from both cargo publish steps
• cargo publish automatically exchanges the OIDC token with crates.io when no static token is present

Prerequisites (manual, before next publish run)

On crates.io, add a Trusted Publisher for both crates:

Crate	Owner	Repository	Workflow
kora-lib	solana-foundation	kora	rust-publish.yml
kora-cli	solana-foundation	kora	rust-publish.yml

After a successful publish run, the KORA_CLI_REGISTRY_TOKEN secret can be removed from repository settings.

Test Plan

• Trigger the Publish Rust Crates workflow manually after crates.io is configured
• Confirm both publish steps succeed without the KORA_CLI_REGISTRY_TOKEN secret

---

[github-actions]

📊 TypeScript Coverage Report

Coverage: 33.1%

View detailed report

Coverage artifacts have been uploaded to this workflow run.
View Artifacts

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 2 additional findings.

[greptile-apps]

Greptile Summary

This PR migrates crates.io publishing authentication from a long-lived static CARGO_REGISTRY_TOKEN secret to GitHub Actions OIDC trusted publishing. Two changes are made: id-token: write is added to the workflow permissions so the runner can obtain a short-lived OIDC token, and the CARGO_REGISTRY_TOKEN environment variable is removed from both cargo publish steps so cargo automatically exchanges the OIDC token with crates.io.\n\n- The approach is technically correct — when no static token is present and id-token: write is available, cargo uses the OIDC exchange path with crates.io.\n- The prerequisite (registering a Trusted Publisher on crates.io for both kora-lib and kora-cli) must be completed before the next workflow run, as documented in the PR description.\n- CLAUDE.md (line 281) still lists KORA_CLI_REGISTRY_TOKEN under "GitHub Secrets Required" — consider updating that entry to document the new OIDC setup once the Trusted Publisher is in place and the old secret is removed.\n- Minor: id-token: write is declared at the workflow level rather than scoped to the single publish job; see inline comment.

Confidence Score: 5/5

Safe to merge — the change is a straightforward, correct migration to OIDC trusted publishing with no runtime risk once the crates.io Trusted Publisher prerequisite is configured.

All findings are P2 (style/best-practice). The core logic is correct: adding id-token: write and removing the static token env var is exactly the right mechanism for OIDC trusted publishing on crates.io. No blocking issues remain.

No files require special attention; the single changed file is straightforward.

Important Files Changed

Filename	Overview
.github/workflows/rust-publish.yml	Adds id-token: write at workflow level and removes both CARGO_REGISTRY_TOKEN env vars, correctly migrating from static token to crates.io OIDC trusted publishing; one minor style note about scoping the new permission to the job level instead of the workflow level.

Sequence Diagram

sequenceDiagram
    participant GHA as GitHub Actions Runner
    participant OIDC as GitHub OIDC Provider
    participant Cargo as cargo publish
    participant CratesIO as crates.io

    GHA->>OIDC: Request OIDC token (id-token: write)
    OIDC-->>GHA: Short-lived JWT (audience: crates.io)
    GHA->>Cargo: cargo publish -p kora-lib --locked
    Cargo->>CratesIO: Exchange OIDC JWT for session token
    CratesIO-->>Cargo: Session token (verified against Trusted Publisher config)
    Cargo->>CratesIO: Publish kora-lib with session token
    CratesIO-->>Cargo: Publish success
    GHA->>GHA: Wait 30s for crates.io indexing
    GHA->>Cargo: cargo publish -p kora-cli --locked
    Cargo->>CratesIO: Exchange OIDC JWT for session token
    CratesIO-->>Cargo: Session token
    Cargo->>CratesIO: Publish kora-cli with session token
    CratesIO-->>Cargo: Publish success

Loading

_{Reviews (1): Last reviewed commit: "ci(publish): switch cargo publishing to ..." | Re-trigger Greptile}