1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
# Release pipeline for leptris-rs (modeled on parsanol-rs).
#
# On every push to main, release-plz:
# 1. opens/updates a release PR with version bumps + changelog
# (conventional commits), and
# 2. when that release PR merges, publishes to crates.io.
#
# Publishing uses crates.io TRUSTED PUBLISHING: the workflow's OIDC
# token is exchanged for a registry token by crates-io-auth-action.
# The crate must exist on crates.io first (manual first publish),
# and each crate's Trusted Publisher must be registered:
# repo: leptris/leptris-rs, workflow: release.yml
#
# GITHUB_TOKEN must be a PAT (LEPTRIS_CI_PAT_TOKEN) so the release
# PR itself triggers CI — the default token does not recurse.
name: Release
permissions:
pull-requests: write
contents: write
# crates.io trusted publishing: rust-lang/crates-io-auth-action@v1
# exchanges the job's OIDC token for a registry token — without
# id-token: write every release run died at the exchange step
# (found 2026-10-29: all runs since the workflow landed failed
# there, which is why crates.io sat at 1.4.1).
id-token: write
on:
push:
branches:
- main
jobs:
release-plz:
name: Release-plz
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
- name: Exchange OIDC token for crates.io token
if: github.ref == 'refs/heads/main'
id: auth
uses: rust-lang/crates-io-auth-action@v1
- name: Run release-plz
uses: MarcoIeni/release-plz-action@v0.5
env:
GITHUB_TOKEN: ${{ secrets.LEPTRIS_CI_PAT_TOKEN || github.token }}
CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
- name: Publish crates (no-verify; sys-lib)
if: steps.auth.outputs.token != ''
run: |
VER=$(cargo metadata --no-deps --format-version 1 | \
jq -r '.packages[] | select(.name=="leptris") | .version')
if cargo search leptris --limit 1 2>/dev/null | \
grep -q "^leptris = \"$VER\""; then
echo "leptris $VER already published"
else
cargo publish --no-verify -p leptris \
--token "${{ steps.auth.outputs.token }}"
echo "published leptris $VER"
fi