Skip to content

Switch to trusted publishing - #3517

Open
Kobzol wants to merge 2 commits into
rust-lang:mainfrom
Kobzol:trusted-publishing
Open

Kobzol wants to merge 2 commits into
rust-lang:mainfrom
Kobzol:trusted-publishing

Conversation

@Kobzol

@Kobzol Kobzol commented Oct 12, 2026 •

Copy link
Copy Markdown
Member

So that we can track the bindgen crates in team.

CC @emilio @rust-lang/wg-bindgen

Companion PR: rust-lang/team#2848

After this PR is merged, the CARGO_REGISTRY_TOKEN secret should be removed from this repository (and invalidated).

@DanielEScherzer DanielEScherzer left a comment •

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

community review

View changes since this review

@Kobzol

Kobzol commented Oct 13, 2026

Copy link
Copy Markdown
Member Author

Regarding the second point, I don't think so! Stuff should work as before. This is essentially just an authentication change.

@Kobzol

Kobzol commented Oct 13, 2026

Copy link
Copy Markdown
Member Author

Ok nevermind, the current release workflow is broken, it doesn't work. It has to be implemented in another way, I'll check in with the maintainers.

@rustbot

This comment has been minimized.

@Kobzol
Kobzol force-pushed the trusted-publishing branch from 6f0ebff to 3786215 Compare October 28, 2026 10:25
@Kobzol
Kobzol force-pushed the trusted-publishing branch from 3786215 to e3389f0 Compare October 28, 2026 10:27
@rustbot

rustbot commented Oct 28, 2026

Copy link
Copy Markdown
Collaborator

This PR was rebased onto a different main commit. Here's a range-diff highlighting what actually changed.

Rebasing is a normal part of keeping PRs up to date, so no action is needed—this note is just to help reviewers.

@Kobzol

Kobzol commented Oct 28, 2026

Copy link
Copy Markdown
Member Author

Ok, I went back and forth on this a couple of times, the interaction with cargo-dist is tricky. I decided to just run cargo publish when a tag is pushed, in parallel with cargo-dist creating a GitHub release. I think that's the simplest solution here to avoid unnecessary complexity, because the cargo-dist workflow file is actually autogenerated, so adding custom steps to it is non-trivial.

@marcoieni

Copy link
Copy Markdown
Member

@Kobzol

Kobzol commented Oct 28, 2026

Copy link
Copy Markdown
Member Author

Updated the docs. Though when doing that, I realized that they were actually out of date, as they described running the publish workflow manually, but that's not how it works right now (before this PR). I wonder if the manual publishing through clicking in GitHub UI actually wouldn't be a better choice for bindgen maintainers.

Let's see what @emilio thinks.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants