Publish workspace crates through trusted publishing

.github/workflows/main.yaml

@@ -14,15 +14,16 @@ jobs:
     # Work around jdx/mise-action not caching ~/.rustup alongside
     # ~/.local/share/mise, which causes Rust components (e.g. clippy) to go
     # missing on cache hits.  See: https://github.com/jdx/mise-action/issues/215
-    - uses: actions/cache@v5
+    - &cache-rustup
+      uses: actions/cache@v5
       with:
         path: ~/.rustup/toolchains
         key: rustup-v1-${{ runner.os }}-${{ hashFiles('mise.toml') }}
-    - uses: jdx/mise-action@v4
+    - &setup-mise
+      uses: jdx/mise-action@v4
     - run: mise run check
 
-  cross-platform:
-    name: cargo test (${{ matrix.os }})
+  test:
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -33,5 +34,48 @@ jobs:
         - windows-latest
     steps:
     - uses: actions/checkout@v6
-    - uses: dtolnay/rust-toolchain@stable
-    - run: cargo test --workspace
+    - *cache-rustup
+    - *setup-mise
+    - run: mise run test
+
+  publish:
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    needs:
+    - check
+    - test
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
+    - *cache-rustup
+    - *setup-mise
+    - shell: bash
+      run: |
+        set -euo pipefail
+
+        workspace_version="$(nu -c 'open Cargo.toml | get workspace.package.version')"
+        if [[ "$GITHUB_REF_TYPE" == "tag" ]]; then
+          if [[ "$GITHUB_REF_NAME" != "$workspace_version" ]]; then
+            echo "::error::Tag $GITHUB_REF_NAME does not match workspace package version $workspace_version"
+            exit 1
+          fi
+          publish_version="$workspace_version"
+        else
+          short_sha="$(git rev-parse --short "$GITHUB_SHA")"
+          publish_version="${workspace_version}-dev.${GITHUB_RUN_NUMBER}+${short_sha}"
+        fi
+
+        if [[ "$publish_version" == "$workspace_version" ]]; then
+          exit 0
+        fi
+
+        mise run publish-version "$publish_version"
+    - id: auth
+      uses: rust-lang/crates-io-auth-action@v1
+    - run: cargo publish --workspace --allow-dirty
+      env:
+        CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}

Cargo.toml

@@ -9,9 +9,17 @@ resolver = "3"
 [workspace.package]
 version = "0.1.0"
 edition = "2024"
+authors = ["Jiwon Kwon <work@kwonjiwon.org>"]
 license = "AGPL-3.0-only"
+homepage = "https://feder.rs/"
+repository = "https://github.com/fedify-dev/feder"
 
 [workspace.dependencies]
+# Keep workspace crate versions in sync with [workspace.package].version.
+# Use `mise run bump-execute <version>` instead of editing these by hand.
+feder-core = { version = "0.1.0", path = "crates/feder-core" }
+feder-runtime-server = { version = "0.1.0", path = "crates/feder-runtime-server" }
+feder-vocab = { version = "0.1.0", path = "crates/feder-vocab" }
 iri-string = { version = "0.7.12", default-features = false, features = ["alloc", "serde"] }
 serde = { version = "1.0.219", default-features = false, features = ["alloc", "derive"] }
 serde_json = "1.0.140"

crates/feder-core/Cargo.toml

@@ -1,11 +1,15 @@
 [package]
 name = "feder-core"
+description = "Portable ActivityPub core logic for Feder."
 version.workspace = true
 edition.workspace = true
+authors.workspace = true
 license.workspace = true
+homepage.workspace = true
+repository.workspace = true
 
 [dependencies]
-feder-vocab = { path = "../feder-vocab" }
+feder-vocab.workspace = true
 
 [lints]
 workspace = true

crates/feder-runtime-server/Cargo.toml

@@ -1,12 +1,16 @@
 [package]
 name = "feder-runtime-server"
+description = "Runnable server runtime for Feder on standard operating systems."
 version.workspace = true
 edition.workspace = true
+authors.workspace = true
 license.workspace = true
+homepage.workspace = true
+repository.workspace = true
 
 [dependencies]
-feder-core = { path = "../feder-core" }
-feder-vocab = { path = "../feder-vocab" }
+feder-core.workspace = true
+feder-vocab.workspace = true
 axum = "0.8"
 thiserror = "2"
 tokio = { version = "1", features = ["macros", "net", "rt-multi-thread"] }

crates/feder-vocab/Cargo.toml

@@ -1,8 +1,12 @@
 [package]
 name = "feder-vocab"
+description = "Minimal ActivityPub and Activity Streams 2.0 vocabulary types for Feder."
 version.workspace = true
 edition.workspace = true
+authors.workspace = true
 license.workspace = true
+homepage.workspace = true
+repository.workspace = true
 
 [dependencies]
 iri-string.workspace = true

mise.toml

@@ -1,10 +1,14 @@
+[tools]
+"github:crate-ci/cargo-release" = "1.1.2"
+"aqua:nushell/nushell" = "0.113.0"
+
 [tools.rust]
 version = "1.95.0"
 profile = "default"
 components = "rust-analyzer,rustfmt,clippy"
 
 [tools."github:dahlia/hongdown"]
-version = "0.3.11"
+version = "0.5.1"
 
 [tools."github:dahlia/hongdown".platforms]
 linux-x64 = "hongdown-*-x86_64-unknown-linux-musl.tar.bz2"
@@ -26,4 +30,41 @@ run = ["cargo fmt", "hongdown --write", "mise fmt"]
 
 [tasks.test]
 description = "Run the Rust tests"
-run = "cargo test"
+run = "cargo test --workspace"
+
+[tasks.bump]
+description = "Preview a workspace version bump"
+usage = 'arg "<version>" help="Target release version, e.g. 1.2.5"'
+run = 'cargo release --workspace --no-publish --no-tag --no-push "$usage_version"'
+
+[tasks.bump-execute]
+description = "Create one commit bumping the workspace version"
+usage = 'arg "<version>" help="Target release version, e.g. 1.2.5"'
+run = 'cargo release --workspace --no-publish --no-tag --no-push --execute --no-confirm "$usage_version"'
+
+[tasks.publish-version]
+description = "Restamp Cargo manifests for a CI publish version"
+usage = 'arg "<version>" help="Exact package version to publish"'
+shell = "nu -c"
+run = """
+let publish_version = $env.usage_version
+let dependency_version = ($publish_version | split row "+" | first)
+let crate_names = (
+  cargo metadata --no-deps --format-version 1
+  | from json
+  | get packages.name
+)
+
+let manifest = (
+  open Cargo.toml
+  | upsert workspace.package.version $publish_version
+)
+let manifest = (
+  $crate_names
+  | reduce --fold $manifest {|crate, acc|
+      $acc | upsert (["workspace" "dependencies" $crate "version"] | into cell-path) $dependency_version
+    }
+)
+
+($manifest | to toml) + "\n" | save --force Cargo.toml
+"""