1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
# Publishes the crate to crates.io via trusted publishing (OIDC, no API token
# secret) when a version tag (vX.Y.Z) is pushed, then creates a GitHub Release
# so the repository's main page shows the release in the sidebar.
#
# The tag version must match the `version` field in Cargo.toml; bump both
# together before tagging (the workflow enforces this).
#
# One-time setup (crates.io side, in the browser):
# 1. Publish the first version manually (`cargo publish`) — the initial
# publish requires an API token; later versions can use trusted publishing.
# 2. crates.io -> crate page -> Settings -> Trusted Publishing -> Add ->
# GitHub: owner `agentsyaml`, repo `libdeno`, workflow `release.yml`,
# environment left empty.
name: Release
on:
push:
tags:
- "v*"
concurrency:
group: release-${{ github.ref }}
cancel-in-progress: false
permissions:
# id-token for the crates.io OIDC exchange; contents for the GitHub Release;
# deployments so the publish appears in the repo's Deployments section.
id-token: write
contents: write
deployments: write
env:
CARGO_TERM_COLOR: always
jobs:
publish:
name: publish to crates.io
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- uses: dtolnay/rust-toolchain@stable
# Tag and Cargo.toml must agree; otherwise the tag would say one version
# while crates.io receives another.
- name: Verify tag matches Cargo.toml
run: |
tag="${GITHUB_REF_NAME#v}"
crate="$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -1)"
test "$tag" = "$crate" || {
echo "tag v$tag does not match Cargo.toml version $crate"; exit 1;
}
# Exchanges the GitHub OIDC token for a short-lived crates.io token
# (auto-revoked afterwards). No CARGO_REGISTRY_TOKEN secret needed.
- uses: rust-lang/crates-io-auth-action@v1
id: auth
# cargo publish builds the crate (including the V8 snapshot) to verify
# the package before uploading; a failed build aborts the publish.
- name: Publish
env:
CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
run: cargo publish --locked
# The repo main page's Releases sidebar lists GitHub Releases, not tags
# or crates.io versions — publishing without a Release leaves it empty.
- name: Create GitHub Release
env:
GH_TOKEN: ${{ github.token }}
run: gh release create "$GITHUB_REF_NAME" --generate-notes
# The main page's Deployments/Environments area is populated only by the
# Deployments API — workflow runs don't create deployments by
# themselves. Record the publish so the vX.Y.Z release shows up there.
- name: Record deployment
env:
GH_TOKEN: ${{ github.token }}
run: |
deployment_id="$(gh api "repos/${{ github.repository }}/deployments" \
-f ref="$GITHUB_REF_NAME" \
-f environment=production \
-f description="publish libdeno $GITHUB_REF_NAME to crates.io" \
--jq '.id')"
gh api "repos/${{ github.repository }}/deployments/${deployment_id}/statuses" \
-f state=success \
-f description="published to crates.io"