From 34501f4d7f7b07346038bad25fe2fdc636b4e18a Mon Sep 17 00:00:00 2001 From: Daniel Carl Jones Date: Fri, 5 Jun 2026 15:52:11 +0100 Subject: [PATCH 1/2] chore(ci): migrate to trusted publishing --- .github/workflows/publish.yml | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index fea824ccc2..a836ffb03c 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -26,13 +26,13 @@ on: - "v[0-9]+.[0-9]+.[0-9]+-rc.[0-9]+" workflow_dispatch: -permissions: - contents: read - jobs: publish: runs-on: ubuntu-latest environment: publish + permissions: + contents: read + id-token: write # Required for crates.io trusted publishing steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: @@ -47,13 +47,16 @@ jobs: with: rust-version: ${{ steps.get-msrv.outputs.msrv }} + - uses: rust-lang/crates-io-auth-action@b7e9a28eded4986ec6b1fa40eeee8f8f165559ec # v1 + id: auth + - name: Publish crates # Only publish if it's a tag and the tag is not a pre-release if: ${{ startsWith(github.ref, 'refs/tags/') && !contains(github.ref, '-') }} - run: cargo publish --workspace --all-features # zizmor: ignore[use-trusted-publishing] -- https://github.com/apache/iceberg-rust/issues/1539 + run: cargo publish --workspace --all-features shell: bash env: - CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} + CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }} # Trigger Python release after crate publishing completes. # Only runs for tag pushes; for manual Python releases, use workflow_dispatch on release_python.yml directly. From 8628d99a8efe688f62016c31225a0f66badd5b72 Mon Sep 17 00:00:00 2001 From: Daniel Carl Jones Date: Mon, 15 Jun 2026 10:23:00 +0100 Subject: [PATCH 2/2] Restore default content:read permission on publish workflow --- .github/workflows/publish.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index a836ffb03c..972cadede8 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -26,6 +26,9 @@ on: - "v[0-9]+.[0-9]+.[0-9]+-rc.[0-9]+" workflow_dispatch: +permissions: + contents: read + jobs: publish: runs-on: ubuntu-latest