Skip to content

chore: trusted publishing#45

Merged
dsherret merged 1 commit intomainfrom
chore_trusted_publishing
Dec 31, 2025
Merged

chore: trusted publishing#45
dsherret merged 1 commit intomainfrom
chore_trusted_publishing

Conversation

@dsherret
Copy link
Member

No description provided.

Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR implements trusted publishing for both npm and Cargo (crates.io) packages, migrating from token-based authentication to OIDC-based authentication. The changes remove publishing logic from the CI workflow and create a dedicated publish workflow that uses GitHub Actions OIDC tokens for secure, automated publishing.

Key Changes:

  • Created a new .github/workflows/publish.yml workflow with OIDC-based publishing for both Cargo and npm
  • Enhanced deployment/npm/setup.js to support syncing version from Cargo.toml using a sync-version argument
  • Removed manual publishing steps from the CI workflow

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File Description
.github/workflows/publish.yml New workflow implementing trusted publishing for both Cargo (using rust-lang/crates-io-auth-action@v1) and npm packages with OIDC tokens
deployment/npm/setup.js Added sync-version mode to automatically extract and sync version from Cargo.toml instead of requiring manual version argument
.github/workflows/ci.yml Removed npm and Cargo publish steps from CI, updated to Node.js 24.x, and simplified setup.js call (no version argument) for testing
.github/workflows/release.yml Updated actions/checkout from v5 to v6

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@dsherret dsherret merged commit ce580c2 into main Dec 31, 2025
10 checks passed
@dsherret dsherret deleted the chore_trusted_publishing branch December 31, 2025 19:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants