Goal: Every publish is tag-triggered + keyless OIDC. no more manual cargo publish / dotnet nuget push. There's still a checklist and review wrt changelog and review cutting but this removes one step and lets us start to publish all of our packages around the same time, especially now that we've got a number of foreign language targets
Scope & state:
Per-registry one-time setup (package owner does once, in the registry UI): create a trusted-publisher policy with Repo Owner = payjoin, Repo = rust-payjoin, Workflow File = .yml, Environment = -release. The matching GitHub -release environment gates publication with a required-reviewer approval.
Work split:
Goal: Every publish is tag-triggered + keyless OIDC. no more manual cargo publish / dotnet nuget push. There's still a checklist and review wrt changelog and review cutting but this removes one step and lets us start to publish all of our packages around the same time, especially now that we've got a number of foreign language targets
Scope & state:
payjoin-v*/payjoin-cli-v*tags (rust-lang/crates-io-auth-action → cargo publish). Not started.Per-registry one-time setup (package owner does once, in the registry UI): create a trusted-publisher policy with Repo Owner = payjoin, Repo = rust-payjoin, Workflow File = .yml, Environment = -release. The matching GitHub -release environment gates publication with a required-reviewer approval.
Work split: