From c62995fb585c5aec60221c14e12a1ca2a5156489 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Sun, 16 Aug 2026 00:54:33 +0000 Subject: [PATCH] ci(release): publish via crates.io trusted publishing (OIDC) Replace the long-lived CARGO_REGISTRY_TOKEN secret with rust-lang/crates-io-auth-action + id-token: write. Publishing no longer needs a GitHub Actions secret once a Trusted Publisher is configured on crates.io for beyondoss/slipstream / release.yml. Co-authored-by: Jared Lunde --- .github/workflows/release.yml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 000dd0b..0784db3 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -31,9 +31,19 @@ jobs: needs: check-version if: needs.check-version.outputs.release == 'true' runs-on: ubuntu-latest + # Trusted Publishing (OIDC) — no long-lived CARGO_REGISTRY_TOKEN secret. + # Configure once at https://crates.io/crates/beyond-slipstream/settings/new-trusted-publisher + # Repository owner: beyondoss + # Repository name: slipstream + # Workflow filename: release.yml + permissions: + id-token: write + contents: read steps: - uses: actions/checkout@v5 - uses: dtolnay/rust-toolchain@stable + - uses: rust-lang/crates-io-auth-action@v1 + id: auth - run: cargo publish env: - CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} + CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}