ci: setup trusted publishing #1124
Conversation
WalkthroughUpdates release workflow to use crates.io OIDC auth and checkout v5, adds a User-Agent to release.sh curl, and bumps workspace crate versions and inter-dependencies from 2.8.2 to 2.8.3. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant GH as GitHub Actions
participant Repo as Repo
participant Crates as crates.io
participant Auth as crates-io-auth-action
GH->>Repo: actions/checkout@v5
Note over GH,Repo: permissions: id-token: write
GH->>Auth: Authenticate (OIDC)
Auth-->>GH: outputs.token
GH->>Crates: cargo publish (CARGO_REGISTRY_TOKEN=outputs.token)
Crates-->>GH: Publish result
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (9)
.github/workflows/release.yml(2 hunks)debugger/Cargo.toml(2 hunks)derive/Cargo.toml(2 hunks)generator/Cargo.toml(2 hunks)grammars/Cargo.toml(2 hunks)meta/Cargo.toml(2 hunks)pest/Cargo.toml(1 hunks)release.sh(1 hunks)vm/Cargo.toml(2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (8)
- GitHub Check: check for no_std compatibility
- GitHub Check: cargo hack check --feature-powerset
- GitHub Check: Test Coverage
- GitHub Check: check for semver compatibility
- GitHub Check: Minimal Versions Testing
- GitHub Check: Documentation check
- GitHub Check: Unit, Style, and Lint Testing
- GitHub Check: Fuzzing
| permissions: | ||
| id-token: write # Required for OIDC token exchange | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v3 | ||
| uses: actions/checkout@v5 | ||
| - name: Install jq |
There was a problem hiding this comment.
Restore contents: read for checkout to succeed.
Adding the permissions block with only id-token: write removes the default contents: read. actions/checkout@v5 then fails with “Resource not accessible by integration”. Please add contents: read alongside id-token: write.
- permissions:
- id-token: write # Required for OIDC token exchange
+ permissions:
+ contents: read # Required for actions/checkout
+ id-token: write # Required for OIDC token exchange📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| permissions: | |
| id-token: write # Required for OIDC token exchange | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v3 | |
| uses: actions/checkout@v5 | |
| - name: Install jq | |
| permissions: | |
| contents: read # Required for actions/checkout | |
| id-token: write # Required for OIDC token exchange | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v5 | |
| - name: Install jq |
🤖 Prompt for AI Agents
In .github/workflows/release.yml around lines 12 to 17, the permissions block
currently sets only id-token: write which removes the default contents: read and
causes actions/checkout@v5 to fail; update the permissions block to include
contents: read alongside id-token: write so the checkout action has read access
(e.g., add "contents: read" at the same indentation level as "id-token: write").
There was a problem hiding this comment.
The sample action here: https://crates.io/docs/trusted-publishing doesn't have that, we'll see
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
crates.io trusted publishing GitHub Actions sample workflow permissions
💡 Result:
Short answer — request only the id-token write permission (plus read access for repo contents if you need checkout). Example GitHub Actions job for crates.io Trusted Publishing:
name: Publish to crates.io
on:
push:
tags: ['v*']
jobs:
publish:
runs-on: ubuntu-latest
environment: release
permissions:
id-token: write
contents: read
steps:
- uses: actions/checkout@v4
- uses: rust-lang/crates-io-auth-action@v1
id: auth
- run: cargo publish
env:
CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
Source: crates.io Trusted Publishing RFC (example workflow + required permissions). [1]
Also see the crates.io development blog announcing Trusted Publishing with the same permissions example. [2]
Sources
[1] RFC: Security Improvements for CI Publishing to crates.io (trusted publishing).
[2] crates.io: development update — Trusted Publishing example workflow.
@tomtau, I checked the official crates.io Trusted Publishing documentation, and the sample workflow does include contents: read alongside id-token: write:
permissions:
id-token: write
contents: readThis is necessary because when you explicitly set a permissions block, GitHub Actions removes all default permissions. Since actions/checkout@v5 needs read access to the repository contents, you must explicitly grant contents: read.
Without it, the checkout step will fail with "Resource not accessible by integration" error, preventing the workflow from running. The recommendation to add both permissions aligns with the official example and will ensure the workflow succeeds.
1 participant
https://crates.io/docs/trusted-publishing
Summary by CodeRabbit