Setup crates.io account for Arch Linux organization
We want to be the owner of some crates on crates.io, hence setup an account for Arch Linux organization and store access tokens in the vault.
Crates:
- alpm, alpm-sys and almp-utils
- alpm-types (archlinux/alpm/alpm-types!26 (merged))
- arch-audit (https://gitlab.archlinux.org/archlinux/arch-audit/-/commit/6b074ec4a378b81a4f379be29f66d2e2bd09eb22and https://gitlab.archlinux.org/archlinux/arch-audit/-/jobs/249258)
- arch-repro-status (arch-repro-status@b0df09ed)
Activity
assigned to @anthraxx
Woo great. Finally we can publish arch-repro-status on crates.io
It is a bit unfortunate that token scopes isn't implemented yet. I'm not sure how to implement this in sane and safe way? (assuming we want to release with CI pipelines)
-
I saw that there is now a crates.io user for Arch Linux projects.
I would like to release arch-repro-status on crates.io as well. Are there defined steps for doing that?
-
Token scopes are stabilized now: https://github.com/rust-lang/crates.io/pull/6573
Edited by Orhun Parmaksız -
@orhun I have created a scoped token for arch-repro-status like so:
The token has been added as a protected variable (
CARGO_REGISTRY_TOKEN) to the arch-repro-status project. Protected means it is only available to pipelines running on protected branches or protected tags.I have configured a wildcard (
*) for said project, so all tags are protected and I would suggest setting up job which publish the crate to crates.io when a new tag is created. Perhaps you can take some inspiration from the way @dvzrv publishes repod to PyPI.Please note that the publishing must happen from a secure runner (by specifying
tags: [secure]).Edited by Kristian Klausen -
Successfully published on crates.io: https://crates.io/crates/arch-repro-status
Thank you!
-
@morganamilo can you help getting this sorted for alpm.rs? DevOps can add the
CARGO_REGISTRY_TOKENsecret to the github project but some CI logic is needed. -
I can set that up. Could I also get the name of the crates.io account to add as owner to these crates?
https://crates.io/users/archlinux-github is the relevant user and it is already owner. The ambition is that it should be the sole owner, and all crates should be released with a pipeline of some sort.
CARGO_REGISTRY_TOKENwas added as a "repository secret" a few months ago with access toalpm,alpm-sys andalpm-utils` crate.Also the gitlab currently mirrors the GitHub. Could some one flip that around for me?
Sure, we can migrate the project to gitlab. I don't see
alpm.rsmirrored currently, do you have a link?
mentioned in issue signstar#55 (closed)
