feat (publish): deprecate --token option with warning

Author: omskscream

src/bin/cargo/commands/publish.rs

@@ -1,14 +1,19 @@
 use crate::command_prelude::*;
 
 use cargo::ops::{self, PublishOpts};
+use cargo_credential::Secret;
 
 pub fn cli() -> Command {
     subcommand("publish")
         .about("Upload a package to the registry")
         .arg_dry_run("Perform all checks without uploading")
         .arg_index("Registry index URL to upload the package to")
         .arg_registry("Registry to upload the package to")
-        .arg(opt("token", "Token to use when uploading").value_name("TOKEN"))
+        .arg(
+            opt("token", "Token to use when uploading")
+                .value_name("TOKEN")
+                .hide(true),
+        )
         .arg(flag(
             "no-verify",
             "Don't verify the contents by building them",
@@ -45,13 +50,16 @@ pub fn exec(gctx: &mut GlobalContext, args: &ArgMatches) -> CliResult {
         .into());
     }
 
+    let token = args.get_one::<String>("token").cloned().map(Secret::from);
+    if token.is_some() {
+        let _ = gctx.shell().warn("`cargo publish --token` is deprecated in favor of using `cargo login` and environment variables");
+    }
+
     ops::publish(
         &ws,
         &PublishOpts {
             gctx,
-            token: args
-                .get_one::<String>("token")
-                .map(|s| s.to_string().into()),
+            token,
             reg_or_index,
             verify: !args.flag("no-verify"),
             allow_dirty: args.flag("allow-dirty"),

tests/testsuite/alt_registry.rs

@@ -306,6 +306,7 @@ Caused by:
         .arg(crates_io.index_url().as_str())
         .with_status(101)
         .with_stderr_data(str![[r#"
+[WARNING] `cargo publish --token` is deprecated in favor of using `cargo login` and environment variables
 [UPDATING] crates.io index
 [ERROR] failed to verify manifest at `[ROOT]/foo/Cargo.toml`
 

tests/testsuite/cargo_publish/help/stdout.term.svg

@@ -207,6 +207,7 @@ fn simple_publish_with_http() {
 
     p.cargo("publish --no-verify --token sekrit --registry dummy-registry")
         .with_stderr_data(str![[r#"
+[WARNING] `cargo publish --token` is deprecated in favor of using `cargo login` and environment variables
 [UPDATING] `dummy-registry` index
 [WARNING] manifest has no documentation, homepage or repository.
 See https://doc.rust-lang.org/cargo/reference/manifest.html#package-metadata for more info.
@@ -351,6 +352,7 @@ fn simple_with_index() {
         .arg("--index")
         .arg(registry.index_url().as_str())
         .with_stderr_data(str![[r#"
+[WARNING] `cargo publish --token` is deprecated in favor of using `cargo login` and environment variables
 [UPDATING] `[ROOT]/registry` index
 [WARNING] manifest has no documentation, homepage or repository.
 See https://doc.rust-lang.org/cargo/reference/manifest.html#package-metadata for more info.