Commit `6f853541d4`

6f853541d48be3675d1e8358d56c6eb704f9c800

parent: 8d5e263d21

Verified · cmc

cmc <hello@cleberg.net> · 2026-08-21 20:15 UTC

Describe the release CI actually runs

Step 5 still said to run `cargo publish` by hand and step 6 still described the
draft release as the only thing a tag push produces. Publishing has come from CI
since the OIDC workflow landed, so following the old step now just fails on a
version crates.io already has — which is how the 0.22.0 release found it.

The `cargo login` in the first-publish section went with it: there is no token
to store on a machine any more.

Layout: unified · split

RELEASING.org +14 −11

		@@ -3,10 +3,9 @@
3	3	Read the content below for the release process.
4	4
5	5	** Before the first publish
6		#+begin_src sh
7		cargo login # a crates.io token, once per machine
8		cargo publish --dry-run
9		#+end_src
	6	Nothing to install and no token to store. The release workflow mints a short-lived
	7	crates.io token with OIDC, configured on crates.io against this repository, the
	8	=release.yml= workflow file and the =crates-io= environment that job runs in.
10	9
11	10	=repository= and =homepage= in =Cargo.toml= point at GitHub and at the documentation site
12	11	on Pages.
		@@ -32,16 +31,20 @@ on Pages.
32	31	git push && git push --tags
33	32	#+end_src
34	33
35		5. Publish the crate.
	34	5. The tag push is the release. It builds binaries for macOS (arm64 and x86_64) and
	35	Linux (gnu and musl), opens a /draft/ GitHub release with them attached, and runs
	36	=cargo publish --locked= — there is nothing to publish by hand, and running
	37	=cargo publish= locally now only fails on a version crates.io already has.
36	38
37		#+begin_src sh
38		cargo publish
39		#+end_src
	39	Publishing is the one step that cannot be undone: a version can be yanked but never
	40	replaced. The publish job runs in the =crates-io= environment so it can be held —
	41	add a required reviewer to that environment in the repository settings and a tag
	42	push waits for a human before it reaches crates.io.
40	43
41		This is irreversible: a published version can be yanked but never replaced.
	44	A release that fails halfway is re-run from the Actions tab: the workflow takes the
	45	tag to build as an input, so it does not need a second tag.
42	46
43		6. Finish the GitHub release. Pushing the tag builds binaries for macOS (arm64 and
44		x86_64) and Linux (gnu and musl) and opens a /draft/ release with them attached.
	47	6. Write the release notes and publish the draft.
45	48
46	49	** If a release goes wrong
47	50	Yank rather than delete, and ship a fix as a new version:

Commit 6f853541d4

Commit `6f853541d4`