From 52700870d80f35aa3e0c938ee18656aae4b33c8a Mon Sep 17 00:00:00 2001 From: Lucas McDonald Date: Mon, 22 Jun 2026 10:46:26 -0700 Subject: [PATCH] ci(rust): publish to crates.io via Trusted Publishing (OIDC) Replace the long-lived CARGO_REGISTRY_TOKEN secret with crates.io Trusted Publishing: rust-lang/crates-io-auth-action exchanges the workflow's GitHub OIDC token for a short-lived crates.io token that is automatically revoked when the job ends. --- .github/workflows/rust-release.yml | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/.github/workflows/rust-release.yml b/.github/workflows/rust-release.yml index 21794e7f6..36759f32c 100644 --- a/.github/workflows/rust-release.yml +++ b/.github/workflows/rust-release.yml @@ -13,9 +13,14 @@ # BEFORE the PR is merged, so a failed publish or failed smoke test # leaves the unmerged PR for cleanup. # -# Authenticates to crates.io with a long-lived API token issued under the -# Crypto Tools CI bot account, stored in the CARGO_REGISTRY_TOKEN repo -# secret and gated by the `crates-io-publish` GitHub environment. +# Authenticates to crates.io via Trusted Publishing (OIDC): the +# `rust-lang/crates-io-auth-action` step exchanges the workflow's GitHub +# OIDC token for a short-lived crates.io token (automatically revoked +# when the job ends), gated by the `crates-io-publish` GitHub +# environment. No long-lived crates.io API token is stored in the repo. +# crates.io must be configured with a Trusted Publisher for this crate +# pointing at this repo, the `rust-release.yml` workflow, and the +# `crates-io-publish` environment. name: Rust Release on: @@ -79,11 +84,15 @@ jobs: working-directory: releases/rust/db_esdk run: cargo publish --dry-run + - name: Authenticate to crates.io (Trusted Publishing / OIDC) + id: auth + uses: rust-lang/crates-io-auth-action@v1 + - name: Cargo publish shell: bash working-directory: releases/rust/db_esdk env: - CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} + CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }} run: cargo publish - name: Configure AWS Credentials for test_published.sh