Publication is an act, not a consequence: the workflow answers to a tag and
leaves merges to main alone. Two guards stand before cargo publish, because a
published version is immutable and a wrong number cannot be withdrawn — the tag
must equal the manifest version, and publish must name a shelf rather than being
false or absent.

The registry comes from the manifest's allow-list, so no --registry flag is
passed anywhere and the shelf cannot drift away from what the source declares.
The gate runs with a read-only token; the writing one is scoped to the publish
step alone.

ci(publish): name the writing secret CRATES_WRITE_TOKEN

rust-publish.yml / ci(publish): name the writing secret CRATES_WRITE_TOKEN (push) Failing after 0s

Details

rust-publish.yml / ci(publish): name the writing secret CRATES_WRITE_TOKEN (pull_request) Failing after 0s

Details

smoke / smoke (push) Successful in 27s

Details

8fc4df287b

Pairs with CRATES_READ_TOKEN and echoes the Forgejo scopes it carries,
read:package and write:package, instead of inventing a third word for the
same idea.

iuriishikov added 1 commit

2026-08-19 21:32:24 +00:00

fix(publish): keep the workflow_call block empty

smoke / smoke (push) Successful in 25s

Details

449b8e0e6f

Forgejo's event detection has no notion of workflow_call, so a non-empty block
produced an event that a plain push matched — the workflow ran on every push to
this repository and failed four times. rust-ci.yml, whose block is empty, never
did. Secrets lose nothing by going undeclared: a called workflow resolves
organisation secrets from the caller's context, exactly as it already resolves
the organisation variable vars.REGISTRY.

iuriishikov merged commit 02ca18970c into main

2026-08-19 21:35:55 +00:00

iuriishikov deleted branch chore/publish-workflow

2026-08-19 21:35:55 +00:00

iuriishikov referenced this pull request from a commit

2026-08-19 21:35:55 +00:00

chore/publish-workflow (#3)