Skip to content

ci: Setup trusted Crates.io publishing #986

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jul 25, 2025
Merged

ci: Setup trusted Crates.io publishing #986

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 45 additions & 3 deletions .github/workflows/release-plz.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,45 @@ on:
- main

jobs:
release-plz-pr:
name: Create release-plz PR
runs-on: ubuntu-latest

# Ensure only one release-plz tries to create a PR at a time.
#
# If two instances update the PR simultaneously, one will see an outdated git ref
# and end up recreating the PR unnecessarily.
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}-pr
cancel-in-progress: true

steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
fetch-depth: 0
token: ${{ secrets.HUGRBOT_PAT }}
- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable

- name: Create release PR
uses: MarcoIeni/[email protected]
env:
GITHUB_TOKEN: ${{ secrets.HUGRBOT_PAT }}
with:
command: release-pr

# This job triggers the release to crates.io if the current crate version is higher than the
# ones in the registry.
#
# Release-plz will only run on commits originating from a PR whose source branch started with
# `release-plz-` (see `release-always=false` in the config).
release-plz:
name: Release-plz
name: Release the crates
runs-on: ubuntu-latest
environment: crate-release
permissions:
id-token: write # Required for OIDC token exchange
steps:
- name: Checkout repository
uses: actions/checkout@v4
Expand All @@ -18,8 +54,14 @@ jobs:
token: ${{ secrets.HUGRBOT_PAT }}
- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable

- uses: rust-lang/crates-io-auth-action@v1
id: auth

- name: Run release-plz
uses: MarcoIeni/[email protected]
env:
GITHUB_TOKEN: ${{ secrets.HUGRBOT_PAT }}
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
GITHUB_TOKEN: ${{ secrets.HUGRBOT_PAT }}
CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
with:
command: release
Loading