1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
name: publish
# crates.io Trusted Publishing: the crate owner registers this repo +
# workflow filename on crates.io (Account settings -> Trusted Publishing),
# then a manual dispatch publishes with OIDC - no crates.io token.
on:
workflow_dispatch:
permissions:
contents: read
id-token: write
jobs:
publish:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- name: Install stable Rust
run: |
rustup toolchain install stable --profile minimal
rustup default stable
- name: Verify version
run: cargo metadata --no-deps --format-version 1 | grep -o '"version":"0.2.1"'
- name: Exchange OIDC for a short-lived crates.io token
id: auth
uses: rust-lang/crates-io-auth-action@v1
# parsanol carries a local path + version dual spec for dev; the
# path is the maintainer's machine and does not exist on runners.
# cargo package's verification build resolves it from the path,
# so publishing from CI must first rewrite the dep to its crates.io
# version requirement and prove the published form builds.
- name: Verify the published form builds (path -> version dep)
run: |
sed -i.bak -E 's/\{ path = "[^"]*", version = /{ version = /' Cargo.toml
rm Cargo.toml.bak
grep -n 'parsanol = ' Cargo.toml
cargo build --release
- name: Publish to crates.io
run: cargo publish --allow-dirty --token ${{ steps.auth.outputs.token }}