From a3e1328f638a3e4ae608ef703ccd18e0f572019b Mon Sep 17 00:00:00 2001 From: spacedevin Date: Mon, 3 Aug 2026 16:04:26 -0700 Subject: [PATCH] fix(ci): explain the missing yank scope instead of a bare 403 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The yank run failed with 403 Forbidden: this token does not have the required permissions because crates.io scopes yanking separately from publishing — a token with publish-new + publish-update, which is what releases this crate, cannot yank it. The raw error never says which scope is missing, so the next person hits the same wall. Now it names the scope, the page to fix it on, and the fact that the release scopes need keeping if it is the same token. --- .github/workflows/crates-yank.yml | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/.github/workflows/crates-yank.yml b/.github/workflows/crates-yank.yml index d3377ab..2acf3d2 100644 --- a/.github/workflows/crates-yank.yml +++ b/.github/workflows/crates-yank.yml @@ -54,10 +54,23 @@ jobs: exit 1 fi if [ "${{ inputs.undo }}" = "true" ]; then - cargo yank --undo --version "${{ inputs.version }}" deckfile + cargo yank --undo --version "${{ inputs.version }}" deckfile 2>&1 | tee out.log else - cargo yank --version "${{ inputs.version }}" deckfile + cargo yank --version "${{ inputs.version }}" deckfile 2>&1 | tee out.log fi + rc=${PIPESTATUS[0]} + # crates.io scopes yank separately from publishing, so the token that releases this crate + # is NOT automatically allowed to yank it — and the raw error does not say which scope is + # missing. + if [ $rc -ne 0 ] && grep -q "does not have the required permissions" out.log; then + echo "" + echo "The CARGO_REGISTRY_TOKEN secret lacks the 'yank' scope." + echo "Publishing and yanking are separate scopes on crates.io, so a publish token cannot yank." + echo "Fix: https://crates.io/settings/tokens — create a token with the 'yank' scope" + echo "(keep 'publish-new' + 'publish-update' if the same token is used for releases)," + echo "then update the CARGO_REGISTRY_TOKEN repository secret." + fi + exit $rc - name: Report run: |