Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[CHORE] Swap in rust-crate-publish-action

Aperta
  • Qualcosa non va?
#120 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
45/100
Tipo di issue
Refactoring
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
github-actions, rust
Ambito
ci-cd, devops

Direzione di ricerca

Read .github/actions/publish-crate-to-crates-io and its test workflow, then compare their inputs and outputs with lfreleng-actions/rust-crate-publish-action. Update the listed workflows in this repository and osm-pbf-parquet, checking the Cargo lockfiles, toolchain files, credentials, and publish flow as described. Verify the pull-request dry run, release publishing and tag check, and safe rerun behavior; update the referenced docs and remove the old action and test workflow.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Background

OvertureMaps/workflows carries a custom composite action, .github/actions/publish-crate-to-crates-io, that dry-run publishes a crate, checks the .crate size against the crates.io 10MB cap, verifies the version against a release tag, and publishes with caller-supplied Trusted Publishing credentials.

lfreleng-actions/rust-crate-publish-action covers the same ground: "Packages a Rust crate, checks its size against the crates.io upload cap, verifies its version against a release tag, and publishes it to crates.io." It also leaves authentication to the caller. Switching means we stop maintaining our own publish scripts.

Upstream adds a few things ours lacks:

  • Skips the upload when an identical archive is already on crates.io, so re-runs are safe.
  • Supports a two-job verify/publish split, where expected_sha256 makes the credentialed job refuse any archive the credential-free job didn't check.
  • Pins the rustup toolchain, and runs everything except packaging from an empty directory so repo config can't steer a credentialed Cargo run.

Proposed change

Replace our action with the upstream one in every consumer, then remove .github/actions/publish-crate-to-crates-io and its test workflow.

Consumers found so far:

  • OvertureMaps/workflows: .github/workflows/test-publish-crate-to-crates-io.yml
  • OvertureMaps/osm-pbf-parquet: .github/workflows/publish_crates.yml (real publish, matrix of osmpbf-async and osm-pbf-parquet)
  • OvertureMaps/osm-pbf-parquet: .github/workflows/build_test.yaml (dry runs)

Input mapping (upstream uses underscores):

Ours Upstream
manifest-path manifest_path (defaults to Cargo.toml, relative to path_prefix)
release-tag release_tag
max-crate-size-bytes max_crate_size_bytes
dry-run-only dry_run
CARGO_REGISTRY_TOKEN env on the step registry_token input (an empty value falls back to the caller's Cargo credentials)

Outputs are renamed the same way (crate-name to crate_name, crate-version to crate_version, crate-size-bytes to crate_size_bytes). Upstream adds crate_sha256, publish_status and published.

Things to check while swapping:

  • Upstream expects a clean git checkout and a committed Cargo.lock for crates with dependencies, since every Cargo stage runs with --locked.
  • Upstream refuses a path-based rustup toolchain. Confirm neither crate's rust-toolchain file uses one.
  • Runners need egress to index.crates.io, static.crates.io and crates.io.
  • Upstream's latest release is v0.0.1, so pin the full commit SHA (the consumers already carry zizmor: ignore[unpinned-uses] for our own action, which can go).
  • Decide whether the osm-pbf-parquet publish should adopt the two-job verify/publish pattern. Upstream notes the multi-crate in-order case can't, because a dependent crate can't be packaged until its dependency is on crates.io.
  • The describe-trusted-publisher.sh step summary in our action has no upstream equivalent. Confirm the upstream job summary table is enough.
  • Update docs that reference the old action, including docs/package-repositories/crates-io.md in OvertureMaps/ops-team.

Acceptance criteria

  • No workflow in the OvertureMaps org references OvertureMaps/workflows/.github/actions/publish-crate-to-crates-io.
  • A dry run on a pull request in OvertureMaps/osm-pbf-parquet passes through the upstream action.
  • A release publishes both crates to crates.io through the upstream action, using Trusted Publishing, with the release tag check still enforced.
  • Re-running a publish for an already-published version exits cleanly with publish_status of skipped.
  • The custom action directory and its test workflow are deleted from OvertureMaps/workflows.
Lingua principale
Nessun dato sulla lingua
Stelle
2
Fork
1
Merge medio
2h 56m
PR unite (30g)
13

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di OvertureMaps/workflows

Tutte le issue di OvertureMaps/workflows

Issue simili

Altre issue su DevOps

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.