feat(release): release on merge to stable, App credentials from the release environment

.github/workflows/crates.yml

@@ -9,11 +9,9 @@ on:
         description: Repository script run before cargo publish. It may append to $GITHUB_ENV.
         type: string
         default: ""
-      environment:
+      version:
+        description: version output of release-check.yml
         type: string
-        default: release
-    secrets:
-      CARGO_REGISTRY_TOKEN:
         required: true
 
 permissions:
@@ -22,7 +20,10 @@ permissions:
 jobs:
   crates:
     runs-on: ubuntu-24.04
-    environment: ${{ inputs.environment }}
+    environment: release
+    permissions:
+      contents: read
+      id-token: write
     defaults:
       run:
         working-directory: ${{ inputs.working-directory }}
@@ -31,10 +32,23 @@ jobs:
         with:
           persist-credentials: false
       - run: rustup show active-toolchain || rustup toolchain install
-      - if: inputs.setup-script != ''
+      - id: published
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          crate=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[0].name')
+          if curl -sf -o /dev/null -H "User-Agent: $GITHUB_REPOSITORY" "https://crates.io/api/v1/crates/$crate/$VERSION"; then
+            echo "::notice::$crate $VERSION is already on crates.io"
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          fi
+      - if: steps.published.outputs.skip != 'true' && inputs.setup-script != ''
         env:
           SCRIPT: ${{ inputs.setup-script }}
         run: '"./$SCRIPT"'
-      - env:
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+      - if: steps.published.outputs.skip != 'true'
+        id: auth
+        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
+      - if: steps.published.outputs.skip != 'true'
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
         run: cargo publish --locked

.github/workflows/docker.yml

@@ -10,9 +10,6 @@ on:
         description: version output of release-check.yml
         type: string
         required: true
-      prerelease:
-        type: string
-        required: true
       major:
         type: string
         required: true
@@ -23,6 +20,15 @@ on:
         description: Push README.md to the Docker Hub repository description
         type: boolean
         default: false
+    # Read from the caller repository's release environment; callers pass nothing (and never
+    # secrets: inherit, which would hand this workflow every repository-level secret too).
+    secrets:
+      DOCKER_USERNAME:
+        description: Never passed by a caller. The release environment's secret of this name.
+        required: false
+      DOCKER_TOKEN:
+        description: Never passed by a caller. The release environment's secret of this name.
+        required: false
     outputs:
       images:
         description: JSON list of pushed version references, for publish.yml images
@@ -57,11 +63,10 @@ jobs:
   build:
     needs: plan
     runs-on: ubuntu-24.04
+    environment: release
     strategy:
       matrix:
         build: ${{ fromJSON(needs.plan.outputs.builds) }}
-    env:
-      RELEASE: ${{ inputs.prerelease == 'false' }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -80,11 +85,10 @@ jobs:
             suffix=${{ matrix.build.suffix }}
           tags: |
             type=raw,value=${{ inputs.version }}
-            type=raw,value=dev,enable=${{ env.RELEASE == 'false' }}
-            type=raw,value=latest,enable=${{ env.RELEASE }}
-            type=raw,value=stable,enable=${{ env.RELEASE }}
-            type=raw,value=${{ inputs.major }}.${{ inputs.minor }},enable=${{ env.RELEASE }}
-            type=raw,value=${{ inputs.major }},enable=${{ env.RELEASE }}
+            type=raw,value=latest
+            type=raw,value=stable
+            type=raw,value=${{ inputs.major }}.${{ inputs.minor }}
+            type=raw,value=${{ inputs.major }}
       - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
@@ -99,6 +103,7 @@ jobs:
     if: inputs.description
     needs: build
     runs-on: ubuntu-24.04
+    environment: release
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/publish.yml

@@ -6,8 +6,8 @@ on:
         description: version output of release-check.yml, which the caller runs first
         type: string
         required: true
-      prerelease:
-        description: prerelease output of release-check.yml
+      tag:
+        description: tag output of release-check.yml. Created here, on the commit being released, after every artifact is published.
         type: string
         required: true
       images:
@@ -38,16 +38,29 @@ on:
       registry-token:
         description: Token for pulling private images; omit for public images
         required: false
+      # The release App's ID and key are read from the caller repository's release environment
+      # (vars.BLS_RELEASE_APP_ID, secrets.BLS_RELEASE_PRIVATE_KEY). Callers never pass them; the
+      # key is held nowhere else. Declared here only so the environment's secret can be read.
+      BLS_RELEASE_PRIVATE_KEY:
+        description: Never passed by a caller. The release environment's secret of this name.
+        required: false
 
 permissions:
   contents: read
 
 jobs:
   release:
     runs-on: ubuntu-24.04
+    environment: release
     permissions:
-      contents: write
+      contents: read
     steps:
+      - id: app
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          app-id: ${{ vars.BLS_RELEASE_APP_ID }}
+          private-key: ${{ secrets.BLS_RELEASE_PRIVATE_KEY }}
+          permission-contents: write
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
@@ -67,26 +80,24 @@ jobs:
         with:
           path: .
           format: spdx-json
-          output-file: sbom/${{ github.event.repository.name }}-${{ github.ref_name }}.spdx.json
+          output-file: sbom/${{ github.event.repository.name }}-${{ inputs.tag }}.spdx.json
           upload-artifact: false
           upload-release-assets: false
       - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
       - env:
-          GH_TOKEN: ${{ github.token }}
-          TAG: ${{ github.ref_name }}
+          GH_TOKEN: ${{ steps.app.outputs.token }}
+          TAG: ${{ inputs.tag }}
           VERSION: ${{ inputs.version }}
-          PRERELEASE: ${{ inputs.prerelease }}
           CHANGELOG: ${{ inputs.changelog }}
           ASSETS: ${{ inputs.assets }}
         run: |
-          flags=(--verify-tag)
+          flags=(--target "$GITHUB_SHA")
           if [ -n "$CHANGELOG" ]; then
             uv run --no-project --with packaging --with pyyaml python .shared/scripts/manifest.py notes "$CHANGELOG" "$VERSION" > "$RUNNER_TEMP/notes.md"
             flags+=(--notes-file "$RUNNER_TEMP/notes.md")
           else
             flags+=(--generate-notes)
           fi
-          [ "$PRERELEASE" = true ] && flags+=(--prerelease)
           gh release view "$TAG" -R "$GITHUB_REPOSITORY" >/dev/null 2>&1 || gh release create "$TAG" -R "$GITHUB_REPOSITORY" "${flags[@]}"
           shopt -s globstar nullglob
           files=(sbom/*.spdx.json)
@@ -97,16 +108,24 @@ jobs:
     if: inputs.images != '[]'
     needs: release
     runs-on: ubuntu-24.04
+    environment: release
     permissions:
-      contents: write
+      contents: read
     strategy:
       matrix:
         image: ${{ fromJSON(inputs.images) }}
     steps:
       - id: name
         env:
           IMAGE: ${{ matrix.image }}
-        run: echo "file=$(tr '/:@' '___' <<<"$IMAGE")-${GITHUB_REF_NAME}.spdx.json" >> "$GITHUB_OUTPUT"
+          TAG: ${{ inputs.tag }}
+        run: echo "file=$(tr '/:@' '___' <<<"$IMAGE")-${TAG}.spdx.json" >> "$GITHUB_OUTPUT"
+      - id: app
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          app-id: ${{ vars.BLS_RELEASE_APP_ID }}
+          private-key: ${{ secrets.BLS_RELEASE_PRIVATE_KEY }}
+          permission-contents: write
       - id: auth
         env:
           TOKEN: ${{ secrets.registry-token }}
@@ -125,7 +144,7 @@ jobs:
           upload-artifact: false
           upload-release-assets: false
       - env:
-          GH_TOKEN: ${{ github.token }}
-          TAG: ${{ github.ref_name }}
+          GH_TOKEN: ${{ steps.app.outputs.token }}
+          TAG: ${{ inputs.tag }}
           FILE: ${{ steps.name.outputs.file }}
         run: gh release upload "$TAG" -R "$GITHUB_REPOSITORY" --clobber "$FILE"