ci(release): dispatch crates.io publish from release.yml, not just tag push#539
Merged
Conversation
…g push
The crates-io-publish OIDC job was gated only on `push: tags: v*`, but
the release tag is created by release.yml via softprops/action-gh-release
using GITHUB_TOKEN — and GitHub's anti-loop policy means a GITHUB_TOKEN
tag does NOT trigger `push: tags`. So the automated release path
(release-auto-trigger → release.yml) never fired the crates publish; only
a manual `just release-tag` (real credential) would have.
Fix by mirroring the submit-winget pattern:
* release-plz.yml: add a `publish_tag` workflow_dispatch input; the
crates-io-publish job now also runs on workflow_dispatch when
publish_tag is set, and checks out that tag to publish the exact
released version. release-pr / release jobs stay off for such
dispatches (inputs.publish_tag == ''). The OIDC trusted-publisher
registration (workflow release-plz.yml + environment crates.io-publish)
is unchanged.
* release.yml: add a submit-crates job that dispatches release-plz.yml
with publish_tag=<tag> after the release lands — exactly like
submit-winget dispatches winget-publish.yml.
Now every release publishes uffs-time/uffs-text via trusted publishing,
no long-lived token. actionlint clean.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The
crates-io-publishOIDC job inrelease-plz.ymlwas gated only onpush: tags: v*. But the release tag is created byrelease.ymlviasoftprops/action-gh-releaseusing GITHUB_TOKEN, and GitHub's anti-loop policy means a GITHUB_TOKEN tag does not triggerpush: tags. So the automated release path (release-auto-trigger→release.yml) never fires the crates publish — as seen on v0.6.24, which released binaries + winget but did not publishuffs-time/uffs-text.Fix (mirrors the existing
submit-wingetpattern)release-plz.yml: add apublish_tagworkflow_dispatch input;crates-io-publishalso runs onworkflow_dispatchwhenpublish_tagis set, and checks out that tag to publish the exact released version.release-pr/releasestay off for such dispatches. OIDC trusted-publisher registration (workflowrelease-plz.yml+ environmentcrates.io-publish) unchanged.release.yml: add asubmit-cratesjob that dispatchesrelease-plz.ymlwithpublish_tag=<tag>after the release lands — exactly likesubmit-wingetdispatcheswinget-publish.yml.Recovery for v0.6.24
No new version needed. Once this is on
mainand thev0.6.24tag exists, a one-offgh workflow run release-plz.yml --ref main -f publish_tag=v0.6.24publishesuffs-time/uffs-text0.6.24 (with the README). All future releases publish automatically.🤖 Generated with Claude Code