feat(release): make crates.io publish complete + fail-safe + manual (#220) - #226
Merged
Conversation
…220) Ready the publish path now that Trusted Publishing is mandatory-on for the wsc crates. Three fixes: - publish.rs: add wsc-verify-core to the publish set (leaf that wsc depends on — it was missing, so publishing wsc would fail on an unresolved dep). Order is verify-core, attestation, wsc, cli. component/crypto stay unpublished (not deps of any published crate). - publish.rs: FAIL-SAFE on already-published versions. The old skip-check used a bare curl (no User-Agent) → crates.io 403 → it silently missed and then hard- failed on re-publish. Now query the version endpoint with a User-Agent, and as belt-and-suspenders treat an "already exists" upload error as a skip. Validated against live crates.io: wsc-verify-core 0.10.0 (already up) skips; the other three publish. Makes re-runs idempotent. - workflow: pure OIDC Trusted Publishing (drop the ignored crates-io-token input), add workflow_dispatch for manual/backfill runs. Still gated by CRATES_PUBLISH_ENABLED. To publish v0.10.0: set vars.CRATES_PUBLISH_ENABLED=true, then run the workflow (dispatch from main, or the Actions button). Closes the pipeline half of #220 (REQ-22); registry backfill happens on the first armed run. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012aR3Md1h46K9wAUWMQiESH
This was referenced Aug 7, 2026
avrabe
added a commit
that referenced
this pull request
Aug 7, 2026
) crates.io backfilled to 0.10.0 (wsc, wsc-verify-core, wsc-attestation, wsc-cli) via the armed OIDC Trusted Publishing pipeline (#226 + workflow run 31197994842). Registry current for the first time since 0.9.0. Closes #220. Claude-Session: https://claude.ai/code/session_012aR3Md1h46K9wAUWMQiESH Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Readies the crates.io publish path now that Trusted Publishing is mandatory-on for the wsc crates (REQ-22 / #220).
Changes
publish.rs— addwsc-verify-coreto the publish set. It's a leaf thatwscdepends on and was missing from the list, so a CI publish ofwscwould fail on an unresolved dependency. Order:wsc-verify-core → wsc-attestation → wsc → wsc-cli.wsc-component/wsc-cryptostay unpublished (not deps of any published crate).publish.rs— fail-safe on already-published versions. The old check used a barecurl(noUser-Agent) → crates.io403→ it silently missed and then hard-failed on re-publish. Now it queries the version endpoint with aUser-Agent, and as belt-and-suspenders treats analready existsupload error as a skip. Validated against live crates.io:wsc-verify-core 0.10.0(already published) → skips; the other three → publish. Re-runs are idempotent.crates-io-tokeninput) +workflow_dispatchfor manual/backfill runs. Still gated byCRATES_PUBLISH_ENABLED.Context
wsc-verify-core 0.10.0is already on the registry (I claimed the new name via token — a fresh crate can't bootstrap Trusted Publishing). The other three are Trusted-Publishing-only and must go through this CI/OIDC flow.To publish v0.10.0 after merge
gh variable set CRATES_PUBLISH_ENABLED --body true --repo pulseengine/sigilmain, or the Actions button) — publisheswsc-attestation/wsc/wsc-cli0.10.0 via OIDC, skips the already-upwsc-verify-core.🤖 Generated with Claude Code