Skip to content

Adding trusted publishing, SLSA provenance, and GitHub App for rust publishing flow #26

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nbelenkov wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Adding trusted publishing, SLSA provenance, and GitHub App for rust publishing flow #26

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1b7fc94
adding trusted publishing + SLSA provenance
nbelenkov Mar 25, 2026
d18308c
adding github app for release flow to replace person linked PAT token
nbelenkov Mar 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 27 additions & 11 deletions .github/workflows/publish-rust.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,14 +135,25 @@ jobs:
publish:
name: Publish Rust Crate
runs-on: ubuntu-latest
environment: prod
needs: [test, semver]
permissions:
contents: write
id-token: write
attestations: write
artifact-metadata: write
steps:
- uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
id: app-token
with:
app-id: ${{ vars.APP_ID }}
private-key: ${{ secrets.PRIVATE_KEY }}

- name: Git Checkout
uses: actions/checkout@v6
with:
token: ${{ secrets.ANZA_TEAM_PAT }}
token: ${{ steps.app-token.outputs.token }}
persist-credentials: false
fetch-depth: 0 # get the whole history for git-cliff

- name: Setup Environment
Expand All @@ -157,24 +168,21 @@ jobs:
with:
tool: toml-cli,cargo-release@0.25.18

- name: Ensure CARGO_REGISTRY_TOKEN variable is set
env:
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
if: ${{ env.CARGO_REGISTRY_TOKEN == '' }}
run: |
echo "The CARGO_REGISTRY_TOKEN secret variable is not set"
echo "Go to \"Settings\" -> \"Secrets and variables\" -> \"Actions\" -> \"New repository secret\"."
exit 1

- name: Set Git Author
env:
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
run: |
git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
git config --global user.name "github-actions[bot]"
git config --global url."https://x-access-token:${GITHUB_TOKEN}@github.com/".insteadOf https://github.com/

- uses: rust-lang/crates-io-auth-action@bbd81622f20ce9e2dd9622e3218b975523e45bbe # v1.0.4
id: auth

- name: Publish Crate
id: publish
env:
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
run: |
if [ "${{ inputs.level }}" == "version" ]; then
LEVEL=${{ inputs.version }}
Expand All @@ -192,6 +200,14 @@ jobs:
LEVEL=${LEVEL} make publish-rust-${OPTIONS}${{ inputs.target }}
echo "new_git_tag=$(make git-tag-rust-${{ inputs.target }})" >> "${GITHUB_OUTPUT}"

- name: Generate SLSA provenance
if: ${{ inputs.dry-run == false }}
uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
env:
NODE_OPTIONS: "--max-http-header-size=32768"
with:
subject-path: target/package/*.crate

- name: Generate a changelog
if: github.event.inputs.create-release == 'true'
uses: orhun/git-cliff-action@v4
Expand Down