Rust (crates.io)

The Rust target is experimental.

The Rust target publishes to crates.io. The crate name is the target's packageName. See the Rust configuration for options.

Releases authenticate with OIDC trusted publishing by default. crates.io can only register a trusted publisher on a crate that already exists and is owned by you, so a brand-new crate publishes its first version with a crates.io API token, then switches to OIDC.

Either way, the publishing account needs a verified email address in its account settings: crates.io rejects a publish from an account without one.

Enable publishing

{
  "targets": {
    "rust": {
      "packageName": "acme",
      "publish": { "cargo": true }
    }
  }
}

First release

Skip this section if the crate is already on crates.io. Follow Publishing with a crates.io token below for the first version, then come back and set up trusted publishing.

Trusted publishing (OIDC)

Recommended once the crate exists. The release workflow uses rust-lang/crates-io-auth-action to exchange the workflow's identity token for a short-lived crates.io token, so no secret is stored.

Add a trusted publisher on crates.io

On crates.io, open the crate's Settings → Trusted Publishing (https://crates.io/crates/<crate>/settings) and add a GitHub publisher:

Repository owner and name: your linked repository
Workflow filename: release-please.yml
Environment: publish.cargo.releaseEnvironment, or blank when none is set

The automated publish runs as the publish job inside release-please.yml, so that is the workflow crates.io sees. If you also dispatch sdk-release.yml to re-publish a tag by hand, add it as a second publisher.

Use the default config

Remove the authMethod override if you published the first version with a token, then revoke that token.

{ "targets": { "rust": { "publish": { "cargo": true } } } }

Publishing with a crates.io token

Create a crates.io token

On crates.io, go to Account Settings → API Tokens → New Token. Grant it the publish-new scope for the crate's first release, and publish-update for later ones.

Add it to the repository

Add the token as a repository secret named CARGO_REGISTRY_TOKEN. See Adding repository secrets. When publish.cargo.releaseEnvironment is set, an environment secret of the same name overrides the repository one.

Switch the target to token auth

{
  "targets": {
    "rust": {
      "publish": { "cargo": { "authMethod": "access-token" } }
    }
  }
}

Notes

Before cargo publish, the workflow queries the crates.io API for the version and skips it if it already exists, so re-merges are safe.

Java and Kotlin

The API company.