From ad9fcb19de9967ac2dcb3ce333ab343eb591d488 Mon Sep 17 00:00:00 2001 From: Jens Geyer Date: Mon, 8 Jun 2026 22:12:31 +0200 Subject: [PATCH 1/3] THRIFT-6068: Auto-publish Rust crate on GitHub Release Client: rs Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/release_rust.yml | 23 ++++++++++++++--------- lib/rs/Cargo.toml | 2 +- 2 files changed, 15 insertions(+), 10 deletions(-) diff --git a/.github/workflows/release_rust.yml b/.github/workflows/release_rust.yml index bf7ebf83a17..ed86f87ca8b 100644 --- a/.github/workflows/release_rust.yml +++ b/.github/workflows/release_rust.yml @@ -20,9 +20,8 @@ name: Release Rust Packages on: - push: - tags: - - "*" + release: + types: [published] pull_request: branches: - master @@ -33,7 +32,7 @@ on: jobs: publish: runs-on: ubuntu-latest - if: false # currently broken and no maintainers around -> see THRIFT-5917 + environment: release permissions: contents: read id-token: write @@ -41,20 +40,26 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - name: Dryrun + + - name: Dry run working-directory: lib/rs + # Use stable toolchain: the repo-pinned 1.83 predates edition2024 support + # required by transitive dependencies (getrandom >= 0.4). run: cargo publish --dry-run + env: + RUSTUP_TOOLCHAIN: stable - name: Authenticate to crates.io - # Only publish if it's a tag and the tag is not a pre-release - if: ${{ startsWith(github.ref, 'refs/tags/') && !contains(github.ref, '-') }} + # Only publish on a non-prerelease GitHub Release event + if: ${{ github.event_name == 'release' && !github.event.release.prerelease }} id: crates-io-auth uses: rust-lang/crates-io-auth-action@bbd81622f20ce9e2dd9622e3218b975523e45bbe # v1.0.4 - name: Publish + # Only publish on a non-prerelease GitHub Release event + if: ${{ github.event_name == 'release' && !github.event.release.prerelease }} working-directory: lib/rs - # Only publish if it's a tag and the tag is not a pre-release - if: ${{ startsWith(github.ref, 'refs/tags/') && !contains(github.ref, '-') }} run: cargo publish env: + RUSTUP_TOOLCHAIN: stable CARGO_REGISTRY_TOKEN: ${{ steps.crates-io-auth.outputs.token }} diff --git a/lib/rs/Cargo.toml b/lib/rs/Cargo.toml index 566dfc78bbc..7147dd55b38 100644 --- a/lib/rs/Cargo.toml +++ b/lib/rs/Cargo.toml @@ -25,4 +25,4 @@ default = ["server"] server = ["threadpool", "log"] [dev-dependencies] -uuid = { version = "*", features = ["v4"] } +uuid = { version = "1", features = ["v4"] } From f6a7ec2ec5522040a8a6a55bb6c13fcb7a6b6107 Mon Sep 17 00:00:00 2001 From: Jens Geyer Date: Mon, 8 Jun 2026 23:13:18 +0200 Subject: [PATCH 2/3] Address review feedback on release_rust.yml Client: rs - Split single job into dry-run (no env/OIDC) + publish (release only) - Pin RUSTUP_TOOLCHAIN to 1.85 instead of floating stable - Add version consistency check between Cargo.toml and release tag Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/release_rust.yml | 45 ++++++++++++++++++++++-------- 1 file changed, 34 insertions(+), 11 deletions(-) diff --git a/.github/workflows/release_rust.yml b/.github/workflows/release_rust.yml index ed86f87ca8b..d469a5f1cfc 100644 --- a/.github/workflows/release_rust.yml +++ b/.github/workflows/release_rust.yml @@ -30,36 +30,59 @@ on: workflow_dispatch: jobs: - publish: + dry-run: runs-on: ubuntu-latest - environment: release permissions: contents: read - id-token: write steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false + - name: Install Rust 1.85 + # The repo-pinned toolchain (rust-toolchain: 1.83) predates edition2024 support + # required by transitive dependencies (getrandom >= 0.4); 1.85 is the minimum + # that passes. Pin explicitly for reproducibility. + run: rustup toolchain install 1.85 --profile minimal + - name: Dry run working-directory: lib/rs - # Use stable toolchain: the repo-pinned 1.83 predates edition2024 support - # required by transitive dependencies (getrandom >= 0.4). run: cargo publish --dry-run env: - RUSTUP_TOOLCHAIN: stable + RUSTUP_TOOLCHAIN: "1.85" + + publish: + runs-on: ubuntu-latest + if: ${{ github.event_name == 'release' && !github.event.release.prerelease }} + environment: release + permissions: + contents: read + id-token: write + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Verify crate version matches release tag + run: | + CRATE_VERSION=$(awk -F'"' '/^version/{print $2; exit}' lib/rs/Cargo.toml) + TAG_VERSION=$(echo "${{ github.event.release.tag_name }}" | sed 's/^v//') + if [ "$CRATE_VERSION" != "$TAG_VERSION" ]; then + echo "Version mismatch: Cargo.toml=$CRATE_VERSION, tag=$TAG_VERSION" + exit 1 + fi + echo "Version check passed: $CRATE_VERSION" + + - name: Install Rust 1.85 + run: rustup toolchain install 1.85 --profile minimal - name: Authenticate to crates.io - # Only publish on a non-prerelease GitHub Release event - if: ${{ github.event_name == 'release' && !github.event.release.prerelease }} id: crates-io-auth uses: rust-lang/crates-io-auth-action@bbd81622f20ce9e2dd9622e3218b975523e45bbe # v1.0.4 - name: Publish - # Only publish on a non-prerelease GitHub Release event - if: ${{ github.event_name == 'release' && !github.event.release.prerelease }} working-directory: lib/rs run: cargo publish env: - RUSTUP_TOOLCHAIN: stable + RUSTUP_TOOLCHAIN: "1.85" CARGO_REGISTRY_TOKEN: ${{ steps.crates-io-auth.outputs.token }} From 437e63e566ee540bd28900aaf86ec8562a6f4c9d Mon Sep 17 00:00:00 2001 From: Jens Geyer Date: Mon, 8 Jun 2026 23:15:56 +0200 Subject: [PATCH 3/3] Fix zizmor code-injection finding in release_rust.yml Client: rs Pass release tag name via env var instead of direct template expansion in the run block to prevent shell injection. Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/release_rust.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release_rust.yml b/.github/workflows/release_rust.yml index d469a5f1cfc..0b200b4610b 100644 --- a/.github/workflows/release_rust.yml +++ b/.github/workflows/release_rust.yml @@ -64,9 +64,11 @@ jobs: persist-credentials: false - name: Verify crate version matches release tag + env: + RELEASE_TAG: ${{ github.event.release.tag_name }} run: | CRATE_VERSION=$(awk -F'"' '/^version/{print $2; exit}' lib/rs/Cargo.toml) - TAG_VERSION=$(echo "${{ github.event.release.tag_name }}" | sed 's/^v//') + TAG_VERSION=$(echo "$RELEASE_TAG" | sed 's/^v//') if [ "$CRATE_VERSION" != "$TAG_VERSION" ]; then echo "Version mismatch: Cargo.toml=$CRATE_VERSION, tag=$TAG_VERSION" exit 1