1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
name: Crates
on:
release:
types:
workflow_dispatch:
permissions:
contents: read
defaults:
run:
shell: bash
jobs:
verify-ci:
runs-on: ubuntu-latest
timeout-minutes: 30
permissions:
actions: read
contents: read
steps:
# Releases are cut from commits pushed straight to main, where CI is
# advisory. This is the enforcement point: nothing publishes unless
# ci.yaml concluded success on this exact commit. Coupled by name to
# ci.yaml — if that file is renamed, this fails closed (blocks), which
# is the safe direction.
- name: Require green CI on the released commit
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GH_REPO: ${{ github.repository }}
run: |
set -euo pipefail
run_id=$(gh run list --commit "${{ github.sha }}" \
--workflow ci.yaml --limit 1 --json databaseId \
--jq '.[0].databaseId // empty')
if [ -z "$run_id" ]; then
echo "::error::No CI run found for ${{ github.sha }}. Refusing to publish."
exit 1
fi
gh run watch "$run_id" --exit-status
publish:
needs:
runs-on: ubuntu-latest
environment: crates-io
permissions:
id-token: write
contents: read
steps:
- name: Checkout repository
uses: actions/checkout@v6
# OIDC trusted publishing: exchanges this workflow run's identity for a
# short-lived crates.io token. No long-lived CARGO_REGISTRY_TOKEN secret
# is stored. Requires each crate's Trusted Publisher configured on
# crates.io (Settings -> Trusted Publishing) for this repository,
# workflow filename, and the crates-io environment.
- name: Authenticate with crates.io
id: auth
uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
# Sequential, not parallel: mdka-cli depends on mdka being resolvable
# on the index first. mdka-node and mdka-python are published per the
# Slice 4 decision recorded in RFC 015. Modern cargo waits for index
# propagation itself (observed working at 2.1.7's manual publish), so
# no manual sleep is needed between steps.
- name: Publish mdka
run: cargo publish
env:
CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
- name: Publish mdka-cli
working-directory: cli
run: cargo publish
env:
CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
- name: Publish mdka-node
working-directory: node
run: cargo publish
env:
CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
- name: Publish mdka-python
working-directory: python
run: cargo publish
env:
CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}