1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
name: Release
# Publishing muri to crates.io is deliberately tag-driven: a release only
# happens when a `vX.Y.Z` tag is pushed (never on branch pushes), and only if
# the tag matches the version in Cargo.toml. Development happens on
# dev/qa/main via git; crates.io gets complete, testable versions only
# (0.9.0 is the first). The CARGO_REGISTRY_TOKEN secret is configured on the
# repo.
on:
push:
tags:
- "v*.*.*"
permissions:
contents: read
env:
CARGO_TERM_COLOR: always
jobs:
publish:
name: cargo publish (crates.io)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
with:
toolchain: stable
- uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
- name: Verify tag matches Cargo.toml version
# Guard against a mistagged release: the pushed tag (minus the leading
# `v`) must equal the crate version, or we refuse to publish.
run: |
tag="${GITHUB_REF#refs/tags/v}"
crate="$(grep -m1 '^version' Cargo.toml | sed -E 's/.*"(.*)".*/\1/')"
if [ "$tag" != "$crate" ]; then
echo "::error::tag v$tag does not match Cargo.toml version $crate" >&2
exit 1
fi
echo "publishing muri v$tag"
- name: cargo publish
env:
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
run: cargo publish --locked