name: Publish crate
"on":
release:
types:
- published
permissions:
contents: read
concurrency:
group: crates-io-release
cancel-in-progress: false
env:
CARGO_TERM_COLOR: always
jobs:
publish:
name: publish-crates-io
runs-on: ubuntu-latest
timeout-minutes: 30
permissions:
contents: read
id-token: write
steps:
- name: Check out the released commit
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd with:
fetch-depth: 0
persist-credentials: false
ref: ${{ github.sha }}
- name: Install stable Rust
uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 with:
toolchain: stable
- name: Require a matching tag on the default branch
env:
DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
RELEASE_SHA: ${{ github.sha }}
run: bash ci/check-release.sh "${{ github.event.release.tag_name }}"
- name: Verify the extracted publication archive
run: bash ci/publish-dry-run.sh
- name: Authenticate with crates.io through Trusted Publishing
id: crates_io_auth
uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18
- name: Publish the verified archive
env:
CARGO_REGISTRY_TOKEN: ${{ steps.crates_io_auth.outputs.token }}
run: cargo publish --locked