Publish as barbacane-waf + depend on barbacane-libinjection from crates.io

.github/workflows/ci.yml

@@ -25,8 +25,8 @@ jobs:
       - run: cargo test --workspace
       # The serde feature is how a host seals a validated rule set into its
       # own artifact, so it is part of the public surface and gets checked.
-      - run: cargo clippy -p parapet --features serde --all-targets -- -D warnings
-      - run: cargo test -p parapet --features serde
+      - run: cargo clippy -p barbacane-waf --features serde --all-targets -- -D warnings
+      - run: cargo test -p barbacane-waf --features serde
 
   # Line coverage of the library, source-based instrumentation via
   # cargo-llvm-cov. COVERAGE_FLOOR is enforced: raise it when the real number
@@ -47,7 +47,7 @@ jobs:
       - name: Measure coverage
         # Run the instrumented tests once, then format the same data three ways.
         run: |
-          cargo llvm-cov --no-report -p parapet --all-features --lib
+          cargo llvm-cov --no-report -p barbacane-waf --all-features --lib
           cargo llvm-cov report --summary-only | tee coverage.txt
           cargo llvm-cov report --lcov --output-path lcov.info
       - name: Publish summary

.github/workflows/release.yml

@@ -0,0 +1,36 @@
+name: Release
+
+# Publishes barbacane-waf to crates.io when a version tag is pushed. The tag
+# must match the version in crates/parapet/Cargo.toml. Requires a
+# CARGO_REGISTRY_TOKEN secret (org-level, or set on this repo).
+
+on:
+  push:
+    tags: ['v*']
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    name: Publish to crates.io
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Check tag matches crate version
+        run: |
+          TAG="${GITHUB_REF#refs/tags/v}"
+          VER="$(sed -n 's/^version = "\([^"]*\)".*/\1/p' crates/parapet/Cargo.toml | head -1)"
+          if [ "$TAG" != "$VER" ]; then
+            echo "::error::tag v$TAG does not match crate version $VER"
+            exit 1
+          fi
+          echo "Publishing version $VER"
+
+      - name: Publish
+        run: cargo publish -p barbacane-waf --token "${{ secrets.CARGO_REGISTRY_TOKEN }}"

Cargo.toml

@@ -10,7 +10,7 @@ repository = "https://github.com/barbacane-dev/parapet"
 authors = ["Parapet contributors"]
 
 [workspace.dependencies]
-libinjectionrs = { git = "https://github.com/barbacane-dev/libinjectionrs", rev = "7f35f8097e9dd06005334a0c8f50661ce544a8df" }
+libinjectionrs = { package = "barbacane-libinjection", version = "0.1.1" }
 quick-xml = "0.42"
 regex = "1.12"
 regex-syntax = "0.8"

crates/parapet-conformance/Cargo.toml

@@ -10,7 +10,7 @@ repository.workspace = true
 authors.workspace = true
 
 [dependencies]
-parapet = { path = "../parapet", features = ["serde"] }
+parapet = { path = "../parapet", package = "barbacane-waf", features = ["serde"] }
 regex.workspace = true
 serde.workspace = true
 serde_json.workspace = true

crates/parapet/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
-name = "parapet"
-version = "0.0.0"
+name = "barbacane-waf"
+version = "0.1.0"
 description = "A SecLang rule engine in pure Rust, compatible with the OWASP Core Rule Set"
 keywords = ["waf", "seclang", "modsecurity", "security", "firewall"]
 categories = ["network-programming", "web-programming"]
@@ -11,6 +11,11 @@ license.workspace = true
 repository.workspace = true
 authors.workspace = true
 
+# The published package is barbacane-waf; the library target keeps the name
+# parapet, so code using `parapet::` is unchanged.
+[lib]
+name = "parapet"
+
 [dependencies]
 aho-corasick.workspace = true
 libinjectionrs.workspace = true