Skip to content

fix(ci): explain the missing yank scope instead of a bare 403 #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
spacedevin merged 1 commit into from
Aug 3, 2026
Merged

fix(ci): explain the missing yank scope instead of a bare 403 #9

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 15 additions & 2 deletions .github/workflows/crates-yank.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,10 +54,23 @@ jobs:
exit 1
fi
if [ "${{ inputs.undo }}" = "true" ]; then
cargo yank --undo --version "${{ inputs.version }}" deckfile
cargo yank --undo --version "${{ inputs.version }}" deckfile 2>&1 | tee out.log
else
cargo yank --version "${{ inputs.version }}" deckfile
cargo yank --version "${{ inputs.version }}" deckfile 2>&1 | tee out.log
fi
rc=${PIPESTATUS[0]}
# crates.io scopes yank separately from publishing, so the token that releases this crate
# is NOT automatically allowed to yank it — and the raw error does not say which scope is
# missing.
if [ $rc -ne 0 ] && grep -q "does not have the required permissions" out.log; then
echo ""
echo "The CARGO_REGISTRY_TOKEN secret lacks the 'yank' scope."
echo "Publishing and yanking are separate scopes on crates.io, so a publish token cannot yank."
echo "Fix: https://crates.io/settings/tokens — create a token with the 'yank' scope"
echo "(keep 'publish-new' + 'publish-update' if the same token is used for releases),"
echo "then update the CARGO_REGISTRY_TOKEN repository secret."
fi
exit $rc

- name: Report
run: |
Expand Down
Loading