Skip to content

fix(release): dispatch trusted crates publisher - #476

Merged
tcballard merged 1 commit into
mainfrom
fix/crates-trusted-publishing
Aug 30, 2026
Merged

fix(release): dispatch trusted crates publisher#476
tcballard merged 1 commit into
mainfrom
fix/crates-trusted-publishing

Conversation

@tcballard

Copy link
Copy Markdown
Collaborator

Summary

  • remove the unsupported workflow_run trigger from the crates.io trusted-publishing workflow
  • dispatch that top-level workflow with workflow_dispatch only after native evidence, signed images, and MCP Registry publication succeed
  • retain the exact tag validation, full native release battery, dry runs, idempotent crate checks, and crates.io environment gate

Why

The recovered v0.29.0 native release completed successfully, but its automatic crates follow-up failed before authentication because crates.io Trusted Publishing rejects OIDC tokens from the workflow_run event.

Failed automatic run: https://github.com/asdecided/core/actions/runs/33320762787

The existing workflow_dispatch path is accepted by crates.io. Its exact recovery run published all three v0.29.0 crates successfully:

https://github.com/asdecided/core/actions/runs/33321299297

Verification

  • both edited workflows parse as YAML
  • git diff --check
  • production recovery run passed the complete native battery and published asdecided-core, decided, and decided-mcp 0.29.0

This keeps crates publication in the filename registered with crates.io while restoring an automatic, fail-closed handoff for future releases.

Trigger the top-level crates workflow through workflow_dispatch after native and MCP publication gates succeed, because crates.io rejects workflow_run OIDC events.

Signed-off-by: Tom Ballard <tom@armytage.co>
@tcballard
tcballard merged commit d44a4d7 into main Aug 30, 2026
8 checks passed
@tcballard
tcballard deleted the fix/crates-trusted-publishing branch August 30, 2026 17:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant