Skip to content

Set up crates.io trusted publishing and pass zizmor#195

Merged
lopopolo merged 1 commit intotrunkfrom
chore/trusted-publishing-zizmor
Feb 22, 2026
Merged

Set up crates.io trusted publishing and pass zizmor#195
lopopolo merged 1 commit intotrunkfrom
chore/trusted-publishing-zizmor

Conversation

@lopopolo
Copy link
Member

Summary

  • add a new publish workflow that uses GitHub OIDC + rust-lang/crates-io-auth-action for crates.io trusted publishing
  • harden all existing workflows with pinned actions, explicit least-privilege permissions, and persist-credentials=false checkouts
  • replace archived artichoke/setup-rust usage with dtolnay/rust-toolchain
  • add a zizmor job to the audit workflow

Validation

  • zizmor .github/workflows/*.yaml
  • npx prettier --check .github/workflows/*.yaml

Repo setup

  • created GitHub environment crates-io-publish via gh api on 2026-02-22

@lopopolo lopopolo force-pushed the chore/trusted-publishing-zizmor branch from 0e2f41b to eb4e98c Compare February 22, 2026 19:08
@lopopolo lopopolo merged commit 8ca2a49 into trunk Feb 22, 2026
16 checks passed
@lopopolo lopopolo deleted the chore/trusted-publishing-zizmor branch February 22, 2026 19:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

1 participant