ci: automate crates.io publishing via trusted publishing by nh13 · Pull Request #14 · fg-labs/fg-sra

nh13 · 2026-04-09T07:49:04Z

Summary

Upgrades publish.yml to actually publish all workspace crates to crates.io on each release, rather than only creating a GitHub release.
Adds id-token: write on the publish job and authenticates via rust-lang/crates-io-auth-action (pinned to v1.0.4) using the Trusted Publishing config already set up on crates.io for fg-sra-vdb-sys, fg-sra-vdb, and fg-sra. No long-lived CARGO_REGISTRY_TOKEN secret is needed.
Verifies lockstep workspace versioning, then publishes the three crates in dependency order: fg-sra-vdb-sys → fg-sra-vdb → fg-sra. Each publish is idempotent (skipped if the version already exists on crates.io) so re-running on the same main commit is safe.
Mirrors the pattern used by other fg-labs crates (see refget-rs publish.yml).

Known limitation: `--no-verify`

All three cargo publish calls use --no-verify. This is a temporary workaround, tracked in #15, and is not the intended long-term shape of the workflow.

Short version: the vendored ncbi-vdb submodule lives at the workspace root, so it is not included in the fg-sra-vdb-sys tarball, so cargo's verification build (and downstream cargo install) cannot find the source. v0.1.0 was manually published with --no-verify purely to park the three crate names. See #15 for root causes and the options under consideration (relocate the submodule, copy-to-OUT_DIR in build.rs, drop the vendored feature, etc.).

Once #15 is resolved, --no-verify should be removed from this workflow as part of that change.

Test plan

CI (Check and Test) passes on this PR
After merge, the next release (e.g. the release-plz v0.1.1 PR) triggers publish.yml and successfully publishes v0.1.1 of all three crates to crates.io via trusted publishing
GitHub release tag and release are also created by the idempotent tail of the publish job

Summary by CodeRabbit

Chores
- Enhanced release automation to automatically publish Rust workspace crates to the package registry during releases, with dependency-aware sequencing and version management to ensure consistent package deployment.

Upgrades publish.yml to actually publish all workspace crates to crates.io on each release, rather than only creating a GitHub release. Changes: - Adds `id-token: write` permission to the publish job so crates.io trusted publishing can mint a short-lived API token via OIDC. - Authenticates via `rust-lang/crates-io-auth-action` (pinned by SHA to v1.0.4), relying on the trusted publisher configuration set up on crates.io for `fg-sra-vdb-sys`, `fg-sra-vdb`, and `fg-sra`. No long-lived `CARGO_REGISTRY_TOKEN` secret is required. - Verifies all workspace crates are at the same version (lockstep) before publishing, matching the refget-rs pattern. - Publishes the three crates in dependency order: fg-sra-vdb-sys -> fg-sra-vdb -> fg-sra. Each publish is idempotent (skipped if the version already exists on crates.io), so re-runs on the same main commit are safe. - Uses `--no-verify` on all publishes as a temporary workaround: the vendored ncbi-vdb submodule lives at the workspace root rather than inside the fg-sra-vdb-sys crate directory, so cargo's verification build cannot find its source. A follow-up will either relocate the submodule, switch to dynamic linking against a system ncbi-vdb, or drop the `vendored` feature from the published crates. The release-pr job is unchanged.

coderabbitai · 2026-04-09T07:49:13Z

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: efad761d-a6d3-404c-b4a8-d3fcf1c3d0cc

📥 Commits

Reviewing files that changed from the base of the PR and between 1aeefa1 and 79510d1.

📒 Files selected for processing (1)

.github/workflows/publish.yml

📝 Walkthrough

Walkthrough

The publish.yml GitHub Actions workflow has been enhanced to automatically publish Rust workspace crates to crates.io in dependency order. It adds authentication to crates.io, verifies version lockstep across fg-sra* crates, conditionally skips publishing if versions are already released, and gates GitHub release creation on successful crate publishing.

Changes

Cohort / File(s)	Summary
Crates.io Publishing Automation `.github/workflows/publish.yml`	Added multi-step publishing workflow with crates.io authentication, version verification across workspace crates, conditional publish logic based on existing versions on crates.io, and ordered publishing of `fg-sra-vdb-sys` → `fg-sra-vdb` → `fg-sra`. GitHub release creation now gates on publish step completion. Includes explicit job permissions and verification that all `fg-sra*` crates maintain lockstep versioning.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related issues

Fix vendored ncbi-vdb publishing so crates.io installs work without --no-verify #15: The new publishing workflow currently uses --no-verify during crate publishing; this issue tracks the goal of eliminating that flag by properly packaging and building the vendored ncbi-vdb for crates.io.

Poem

🐰 With version checks and crates aligned,
We publish to the world with lockstep mind.
In dependency order, we gently ascend,
From vdb-sys to sra, a perfect blend.
Our workflow now handles the complex dance,
Releasing our Rust crates—the rabbit's romance! 🚀

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch nh/publish-trusted-publishing

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

codecov · 2026-04-09T07:50:45Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

nh13 temporarily deployed to github-actions April 9, 2026 07:49 — with GitHub Actions Inactive

nh13 mentioned this pull request Apr 9, 2026

Fix vendored ncbi-vdb publishing so crates.io installs work without --no-verify #15

Open

5 tasks

nh13 marked this pull request as ready for review April 9, 2026 07:56

nh13 merged commit 57ee831 into main Apr 9, 2026
5 of 6 checks passed

nh13 deleted the nh/publish-trusted-publishing branch April 9, 2026 07:56

nh13 mentioned this pull request Apr 9, 2026

docs(ci): link --no-verify workaround comment to #15 #16

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: automate crates.io publishing via trusted publishing#14

ci: automate crates.io publishing via trusted publishing#14
nh13 merged 1 commit intomainfrom
nh/publish-trusted-publishing

nh13 commented Apr 9, 2026 •

edited by coderabbitai bot

Loading

Uh oh!

coderabbitai bot commented Apr 9, 2026 •

edited

Loading

Review failed

Walkthrough

Changes

Estimated code review effort

Possibly related issues

Poem

Uh oh!

codecov bot commented Apr 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

nh13 commented Apr 9, 2026 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Known limitation: --no-verify

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai bot commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Walkthrough

Changes

Estimated code review effort

Possibly related issues

Poem

Uh oh!

codecov bot commented Apr 9, 2026

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

nh13 commented Apr 9, 2026 •

edited by coderabbitai bot

Loading

Known limitation: `--no-verify`

coderabbitai bot commented Apr 9, 2026 •

edited

Loading