1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
# Publish the Rust crates to crates.io on a `v*` tag, via crates.io
# trusted publishing (OIDC) - no token is stored on GitHub, and a fork
# can't mint one (OIDC claims wouldn't match the registered publisher).
#
# One-time crates.io setup (per crate, in Settings -> Trusted Publishing):
# add GitHub owner SConsul, repo vor, workflow crates.yml, environment
# crates-io - for both `vor` and `vor-macros`.
name: crates.io
on:
push:
tags:
permissions:
contents: read
jobs:
publish:
runs-on: ubuntu-latest
environment: crates-io
permissions:
id-token: write # OIDC token minted per run; crates.io verifies it
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable # vor MSRV is 1.96
- uses: rust-lang/crates-io-auth-action@v1
id: auth
# Publish vor-macros then vor (vor depends on it; cargo waits for
# each upload to be queryable before the next resolves it). Skip a
# version already on crates.io, so re-running the tag - e.g. after
# a PyPI-only fix - doesn't fail on the duplicate.
- env:
CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
run: |
ver=$(grep -m1 '^version = ' Cargo.toml | cut -d'"' -f2)
for crate in vor-macros vor; do
if curl -sf -A vor-release-ci "https://crates.io/api/v1/crates/$crate/$ver" >/dev/null; then
echo "$crate $ver already on crates.io, skipping"
else
cargo publish -p "$crate"
fi
done