From 9d96fbfe6b21b59d0f1d669c338559b91f0bb902 Mon Sep 17 00:00:00 2001 From: mp0rta <3p0rta26@gmail.com> Date: Wed, 7 Oct 2026 03:33:22 +0900 Subject: [PATCH 1/3] docs: document h3wire v0.1 installation --- README.md | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 9e1a84e..24017cf 100644 --- a/README.md +++ b/README.md @@ -6,7 +6,7 @@ The core (HTTP/3, RFC 9114, and QPACK, RFC 9204) consumes stream bytes and reset from your QUIC transport and returns events for the application and actions for the transport, with no I/O, no async runtime and no dependencies beyond `std` (`#![forbid(unsafe_code)]`, MSRV 1.85). -Status: v0.1 in development. It covers RFC 9114 request/response streams, control +Status: v0.1 core. It covers RFC 9114 request/response streams, control and QPACK streams, GOAWAY and stream termination, QPACK with the static table only (no dynamic table), Extended CONNECT (RFC 9220), the HTTP/3 part of HTTP Datagrams (RFC 9297) and extension points for frame, stream and setting types. There is no @@ -14,14 +14,13 @@ async layer or QUIC adapter yet. ## Installation -The first crates.io release is being prepared. For now, add the library from Git: +Add the library with Cargo: ```sh -cargo add h3wire --git https://github.com/mp0rta/h3wire +cargo add h3wire ``` -Once v0.1.0 is published, use `cargo add h3wire` or add -`h3wire = "0.1"` under `[dependencies]` in your `Cargo.toml`. +Or add `h3wire = "0.1"` under `[dependencies]`. Licensed under either of [Apache License, Version 2.0](LICENSE-APACHE) or [MIT license](LICENSE-MIT) at your option. From d22655fa6e7cc9be9af627a983b613eb65de3926 Mon Sep 17 00:00:00 2001 From: mp0rta <3p0rta26@gmail.com> Date: Wed, 7 Oct 2026 03:43:01 +0900 Subject: [PATCH 2/3] ci: publish h3wire with trusted publishing --- .github/workflows/publish.yml | 61 +++++++++++++++++++++++++++++++++++ docs/PUBLISHING.md | 55 +++++++++++++++++++++++++++++++ 2 files changed, 116 insertions(+) create mode 100644 .github/workflows/publish.yml create mode 100644 docs/PUBLISHING.md diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml new file mode 100644 index 0000000..d210438 --- /dev/null +++ b/.github/workflows/publish.yml @@ -0,0 +1,61 @@ +name: Publish to crates.io + +on: + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: crates-io-publish + cancel-in-progress: false + +jobs: + verify: + if: github.ref == 'refs/heads/main' && github.repository == 'mp0rta/h3wire' + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 + with: + ref: ${{ github.sha }} + persist-credentials: false + - uses: dtolnay/rust-toolchain@89b12181fb390509a0842a86cc55eeb8eb928c1d # stable + with: + toolchain: stable + components: rustfmt, clippy + - run: cargo fmt --all --check + - run: cargo clippy --workspace --all-targets --locked -- -D warnings + - run: cargo test --workspace --locked + - run: cargo doc --workspace --no-deps --locked + env: + RUSTDOCFLAGS: -D warnings + - uses: dtolnay/rust-toolchain@89b12181fb390509a0842a86cc55eeb8eb928c1d # stable + with: + toolchain: '1.85' + - run: cargo +1.85 build -p h3wire --locked + - run: cargo +stable package -p h3wire --locked + - run: cargo +stable test --manifest-path target/package/h3wire-*/Cargo.toml --locked + - run: cargo +stable publish -p h3wire --locked --dry-run + + publish: + needs: verify + if: github.ref == 'refs/heads/main' && github.repository == 'mp0rta/h3wire' + runs-on: ubuntu-latest + environment: release + permissions: + contents: read + id-token: write + steps: + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 + with: + ref: ${{ github.sha }} + persist-credentials: false + - uses: dtolnay/rust-toolchain@89b12181fb390509a0842a86cc55eeb8eb928c1d # stable + with: + toolchain: stable + - name: Authenticate to crates.io + id: auth + uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5 + - run: cargo publish -p h3wire --locked + env: + CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }} diff --git a/docs/PUBLISHING.md b/docs/PUBLISHING.md new file mode 100644 index 0000000..a509016 --- /dev/null +++ b/docs/PUBLISHING.md @@ -0,0 +1,55 @@ +# Publishing h3wire + +Publishing is manual. Merge the release commit into `main` before publishing; +this workflow never uploads from another branch or repository and never creates +a tag. The maintainer creates and merges the PR and configures external settings. + +## One-time setup + +1. In `mp0rta/h3wire` GitHub settings, create the **release** Environment. + Configure required reviewers and select **main** as its only deployment + branch. A sole maintainer must allow self-review to avoid blocking releases. + Confirm these protection rules are available for the repository's GitHub plan. +2. Publish the initial version locally: crates.io Trusted Publishing currently + requires the crate to exist first. Create an API token with only the + **publish-new** scope and the exact crate name pattern **h3wire**; + **publish-update** is not needed for this first upload. Choose the shortest + suitable expiry (the 7-day preset or a custom expiry), run `cargo login` + locally, then run + `cargo publish -p h3wire --locked` from the reviewed release commit after all + verification gates below pass. Never put the token in chat or GitHub secrets. +3. On the crate's crates.io settings page, register this Trusted Publisher: + + | Field | Value | + | --- | --- | + | GitHub owner | `mp0rta` | + | Repository | `h3wire` | + | Workflow filename | `publish.yml` | + | GitHub Environment | `release` | + +4. Enable **Trusted Publishing Only** after registration. Revoke the bootstrap + API token specifically and run `cargo logout` locally to remove its saved + credential. Future releases use temporary OIDC credentials. + +See the official [Trusted Publishing documentation](https://crates.io/docs/trusted-publishing) +and [authentication action](https://github.com/rust-lang/crates-io-auth-action). + +## Each release + +1. Update the crate version and lockfile as needed, review the release diff, and + merge the release commit into `main`. +2. In GitHub Actions, select **Publish to crates.io**, choose **main**, and run + the workflow. Review the run's exact commit SHA before approving the + **release** Environment deployment. +3. The verification job checks formatting, Clippy, workspace tests, warning-free + docs, the Rust 1.85 build, packaging, extracted-package tests, and a publish + dry run. It has no OIDC permission. The publish job checks out the same SHA, + authenticates immediately before upload, and exposes the temporary registry + token only to `cargo publish`. The authentication action revokes it at job end. +4. After success, confirm the expected version on crates.io and docs.rs, and + build/test a fresh consumer using the published registry version. Only then + create the version tag on the exact commit SHA from the successful run. + +Tags do not trigger publication. Do not retry a completed upload with the same +version; crates.io versions are immutable. Review and update the pinned Action +SHAs when upgrading Actions. From 514c25bb7ec60424b9c0aa23fdf49c351765a932 Mon Sep 17 00:00:00 2001 From: mp0rta <3p0rta26@gmail.com> Date: Wed, 7 Oct 2026 03:49:11 +0900 Subject: [PATCH 3/3] docs: keep publication instructions outside repository --- docs/PUBLISHING.md | 55 ---------------------------------------------- 1 file changed, 55 deletions(-) delete mode 100644 docs/PUBLISHING.md diff --git a/docs/PUBLISHING.md b/docs/PUBLISHING.md deleted file mode 100644 index a509016..0000000 --- a/docs/PUBLISHING.md +++ /dev/null @@ -1,55 +0,0 @@ -# Publishing h3wire - -Publishing is manual. Merge the release commit into `main` before publishing; -this workflow never uploads from another branch or repository and never creates -a tag. The maintainer creates and merges the PR and configures external settings. - -## One-time setup - -1. In `mp0rta/h3wire` GitHub settings, create the **release** Environment. - Configure required reviewers and select **main** as its only deployment - branch. A sole maintainer must allow self-review to avoid blocking releases. - Confirm these protection rules are available for the repository's GitHub plan. -2. Publish the initial version locally: crates.io Trusted Publishing currently - requires the crate to exist first. Create an API token with only the - **publish-new** scope and the exact crate name pattern **h3wire**; - **publish-update** is not needed for this first upload. Choose the shortest - suitable expiry (the 7-day preset or a custom expiry), run `cargo login` - locally, then run - `cargo publish -p h3wire --locked` from the reviewed release commit after all - verification gates below pass. Never put the token in chat or GitHub secrets. -3. On the crate's crates.io settings page, register this Trusted Publisher: - - | Field | Value | - | --- | --- | - | GitHub owner | `mp0rta` | - | Repository | `h3wire` | - | Workflow filename | `publish.yml` | - | GitHub Environment | `release` | - -4. Enable **Trusted Publishing Only** after registration. Revoke the bootstrap - API token specifically and run `cargo logout` locally to remove its saved - credential. Future releases use temporary OIDC credentials. - -See the official [Trusted Publishing documentation](https://crates.io/docs/trusted-publishing) -and [authentication action](https://github.com/rust-lang/crates-io-auth-action). - -## Each release - -1. Update the crate version and lockfile as needed, review the release diff, and - merge the release commit into `main`. -2. In GitHub Actions, select **Publish to crates.io**, choose **main**, and run - the workflow. Review the run's exact commit SHA before approving the - **release** Environment deployment. -3. The verification job checks formatting, Clippy, workspace tests, warning-free - docs, the Rust 1.85 build, packaging, extracted-package tests, and a publish - dry run. It has no OIDC permission. The publish job checks out the same SHA, - authenticates immediately before upload, and exposes the temporary registry - token only to `cargo publish`. The authentication action revokes it at job end. -4. After success, confirm the expected version on crates.io and docs.rs, and - build/test a fresh consumer using the published registry version. Only then - create the version tag on the exact commit SHA from the successful run. - -Tags do not trigger publication. Do not retry a completed upload with the same -version; crates.io versions are immutable. Review and update the pinned Action -SHAs when upgrading Actions.