From d16131f28953b47cc095ca7271d6486d4ad0093b Mon Sep 17 00:00:00 2001 From: Tobias Bieniek Date: Mon, 17 Nov 2025 12:18:11 +0100 Subject: [PATCH] docs/trusted-publishing: Add GitLab CI/CD support Updates the Trusted Publishing documentation to include GitLab CI/CD support alongside GitHub Actions. GitLab support is marked as public beta. --- app/templates/docs/trusted-publishing.gjs | 128 +++++++++++++++++----- 1 file changed, 102 insertions(+), 26 deletions(-) diff --git a/app/templates/docs/trusted-publishing.gjs b/app/templates/docs/trusted-publishing.gjs index dfb59612986..2cc0454f59a 100644 --- a/app/templates/docs/trusted-publishing.gjs +++ b/app/templates/docs/trusted-publishing.gjs @@ -8,20 +8,19 @@ import highlightSyntax from 'crates-io/modifiers/highlight-syntax';

What is Trusted Publishing?

- Trusted Publishing is a secure way to publish your Rust crates from GitHub Actions without manually managing API - tokens. It uses OpenID Connect (OIDC) to verify that your workflow is running from your repository, then provides - a short-lived token for publishing. + Trusted Publishing is a secure way to publish your Rust crates from CI/CD platforms like GitHub Actions and GitLab + CI/CD without manually managing API tokens. It uses OpenID Connect (OIDC) to verify that your workflow is running + from your repository, then provides a short-lived token for publishing.

- Instead of storing long-lived API tokens in your repository secrets, Trusted Publishing allows GitHub Actions to - authenticate directly with crates.io using cryptographically signed tokens that prove the workflow's identity. + Instead of storing long-lived API tokens in your repository secrets, Trusted Publishing allows your CI/CD platform + to authenticate directly with crates.io using cryptographically signed tokens that prove the workflow's identity.

Note: - crates.io currently only supports GitHub Actions, but we are planning to support other CI/CD platforms like GitLab - CI/CD in the future. + GitLab CI/CD support is currently in public beta.

Security Benefits

@@ -29,8 +28,8 @@ import highlightSyntax from 'crates-io/modifiers/highlight-syntax';
  • No long-lived API tokens to manage or rotate
  • Tokens automatically expire after 30 minutes
  • Repository and workflow verification prevents unauthorized publishing
    • -
  • OIDC-based cryptographic verification with GitHub's public JWKS
    • -
  • Optional GitHub Actions environments for additional access controls
    • +
  • OIDC-based cryptographic verification with your platform's public JWKS
    • +
  • Optional environments for additional access controls

    • Quick Start

    @@ -38,8 +37,8 @@ import highlightSyntax from 'crates-io/modifiers/highlight-syntax';
    1. Configure your crate for Trusted Publishing in the crates.io settings
      2. -
    2. Set up your GitHub Actions workflow - with the required permissions and authentication action
      3. +
    3. Set up your CI/CD workflow + with the required permissions and authentication
    4. Publish your crate using the automated workflow
    @@ -47,7 +46,7 @@ import highlightSyntax from 'crates-io/modifiers/highlight-syntax';

    Configuring Trusted Publishing

    @@ -57,18 +56,28 @@ import highlightSyntax from 'crates-io/modifiers/highlight-syntax';
    1. Go to your crate's Settings → Trusted Publishing
      2. -
    2. Click the "Add" button and fill in: -
        -
      • Repository owner: Your GitHub username or organization
        • -
      • Repository name: The name of your repository
        • -
      • Workflow filename: - The filename of your GitHub Actions workflow (e.g., "release.yml")
        • -
      • Environment: Optional environment name if you're using GitHub environments
        • -
      -
      3. -
    3. Save the configuration
      4. +
    4. Click the "Add" button and select your platform (GitHub or GitLab)
      5. +
    5. Fill in the platform-specific fields and save the configuration
    +

    GitHub Configuration

    + + +

    GitLab Configuration

    + +

    GitHub Actions Setup

    Create a workflow file at @@ -103,10 +112,69 @@ jobs: protection rules like required reviewers or deployment branches.

    +

    GitLab CI/CD Setup (Public Beta)

    +

    + Create a workflow file at + .gitlab-ci.yml. This example workflow will automatically publish your crate each time you push a + version tag (like + v1.0.0): +

    + + {{! template-lint-disable no-whitespace-for-layout }} + {{! prettier-ignore }} + 
    publish:
+  image: rust:1.91.0-alpine
+  environment: release
+  only:
+    - tags  # Only run on tag pushes
+  id_tokens:
+    CRATES_IO_ID_TOKEN:
+      aud: crates.io
+  before_script:
+    - apk add --no-cache bash curl jq
+  script:
+    # Exchange OIDC token for publish token
+    - CARGO_REGISTRY_TOKEN=$(bash exchange-token.sh)
+    # Publish to crates.io
+    - CARGO_REGISTRY_TOKEN="$CARGO_REGISTRY_TOKEN" cargo publish
    + +

    + Create a helper script at + exchange-token.sh + in your repository root: +

    + + {{! template-lint-disable no-whitespace-for-layout }} + {{! prettier-ignore }} + 
    #!/bin/bash
+set -e
+
+# Exchange JWT token
+echo "Exchanging OIDC token..." >&2
+RESPONSE=$(curl -s -X POST https://crates.io/api/v1/trusted_publishing/tokens \
+  -H "Content-Type: application/json" \
+  -d "{\"jwt\": \"$CRATES_IO_ID_TOKEN\"}")
+
+# Extract publish token
+CRATES_IO_PUBLISH_TOKEN=$(echo "$RESPONSE" | jq -r '.token')
+
+if [ "$CRATES_IO_PUBLISH_TOKEN" = "null" ] || [ -z "$CRATES_IO_PUBLISH_TOKEN" ]; then
+  echo "Failed to get upload token" >&2
+  echo "$RESPONSE" >&2
+  exit 1
+fi
+
+echo "$CRATES_IO_PUBLISH_TOKEN"
    +

    + Optional: + For enhanced security, create a GitLab CI/CD environment named "release" in your repository settings with + protection rules like required reviewers or deployment branches. +

    +

    Security & Best Practices