test: harden integration tests against transient API blips (#47) #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish to crates.io | |
| on: | |
| push: | |
| tags: | |
| - 'v[0-9]*' | |
| concurrency: | |
| group: crates-publish-${{ github.ref_name }} | |
| cancel-in-progress: false | |
| permissions: | |
| contents: read | |
| # Required for the OIDC token exchange (Trusted Publishing). The job presents a | |
| # short-lived OIDC identity that crates.io trades for a ~30-minute API token, so | |
| # no long-lived CRATES_IO_TOKEN secret is stored anywhere. | |
| id-token: write | |
| jobs: | |
| publish: | |
| name: Publish to crates.io | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: crates-io | |
| url: https://crates.io/crates/hotdata | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable | |
| with: | |
| toolchain: stable | |
| - name: Verify tag matches Cargo.toml version | |
| run: | | |
| set -euo pipefail | |
| if [[ ! "$GITHUB_REF_NAME" =~ ^v[0-9] ]]; then | |
| echo "Release tag '$GITHUB_REF_NAME' must start with 'v' followed by a digit (e.g. v1.0.0)" >&2 | |
| exit 1 | |
| fi | |
| tag="${GITHUB_REF_NAME#v}" | |
| pkg_version=$(cargo metadata --no-deps --format-version 1 \ | |
| | jq -r '.packages[] | select(.name=="hotdata") | .version') | |
| if [ "$tag" != "$pkg_version" ]; then | |
| echo "Release tag ($tag) does not match Cargo.toml version ($pkg_version)" >&2 | |
| exit 1 | |
| fi | |
| # Dry-run with all features is the twine-check analog: it packages the | |
| # crate and verifies it builds in the published form (including the | |
| # optional arrow surface) before the real publish. | |
| - name: Verify package builds (dry run) | |
| run: cargo publish --dry-run --all-features | |
| # Exchange the job's OIDC identity for a short-lived crates.io token. The | |
| # crate's Trusted Publishing config (owner/repo/workflow/environment) must | |
| # match this job, or the exchange is rejected. | |
| - name: Authenticate to crates.io (Trusted Publishing) | |
| id: auth | |
| uses: rust-lang/crates-io-auth-action@bbd81622f20ce9e2dd9622e3218b975523e45bbe # v1.0.4 | |
| - name: Publish to crates.io | |
| env: | |
| CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }} | |
| # --all-features mirrors the dry-run so the pre-upload verify build | |
| # also compiles the optional arrow surface. | |
| run: cargo publish --all-features |