From 42e70f67f5b4990a84ae9a3c7824f0b6fb040e99 Mon Sep 17 00:00:00 2001
From: Acture <acturea@gmail.com>
Date: Thu, 8 Oct 2026 01:32:42 +0800
Subject: [PATCH 1/2] ci: exchange the OIDC token for crates.io and build every
 release platform

The v0.2.0 release failed at "no token found": the switch to Trusted
Publishing granted `id-token: write` but never exchanged that token for a
crates.io one. `rust-lang/crates-io-auth-action` now does, and passes it to
`cargo publish --workspace`.

CI also builds on macOS and Windows, which releases ship but CI never
compiled. It reads the repository with a read-only token, cancels superseded
pull request runs, installs clippy and rustfmt explicitly rather than relying
on the runner image, and moves the actions to their Node 24 majors.
---
 .github/workflows/ci.yml      | 26 +++++++++++++++++++++++++-
 .github/workflows/release.yml | 21 +++++++++++++++------
 2 files changed, 40 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6ee930b..7226e21 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,13 +6,37 @@ on:
   pull_request:
     branches: [master]
 
+permissions:
+  contents: read
+
+# A newer push to the same pull request makes the older run moot.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy, rustfmt
       - uses: Swatinem/rust-cache@v2
       - run: cargo fmt --all --check
       - run: cargo clippy --workspace --all-targets -- -D warnings
       - run: cargo test --workspace
+
+  # Releases ship macOS and Windows binaries; build them on every change, not first at tag time.
+  build:
+    name: build (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo build --workspace
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b947ceb..d9819d2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -34,7 +34,7 @@ jobs:
             artifact: scriptmark.exe
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: ${{ matrix.target }}
@@ -52,7 +52,7 @@ jobs:
         run: cargo build --release -p scriptmark --target ${{ matrix.target }}
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: scriptmark-${{ matrix.target }}
           path: target/${{ matrix.target }}/release/${{ matrix.artifact }}
@@ -67,7 +67,7 @@ jobs:
 
     steps:
       - name: Download binaries
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: artifacts
           pattern: scriptmark-*
@@ -83,7 +83,7 @@ jobs:
           chmod +x release/scriptmark-*
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           generate_release_notes: true
           files: release/*
@@ -99,8 +99,17 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
 
-      - name: Publish crate
+      # Trusted Publishing: exchange this job's OIDC token for a short-lived crates.io token.
+      # Each crate must be configured on crates.io (Settings → Trusted Publishing: repository
+      # Acture/scriptmark, workflow release.yml, environment release), and a crate's first
+      # version must be published by hand with an API token.
+      - uses: rust-lang/crates-io-auth-action@v1
+        id: auth
+
+      - name: Publish crates
         run: cargo publish --workspace
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}

From 4a9e84271f9c4d9bcb649172fdedd48d39ca602d Mon Sep 17 00:00:00 2001
From: Acture <acturea@gmail.com>
Date: Thu, 8 Oct 2026 01:53:00 +0800
Subject: [PATCH 2/2] ci: do not persist the checkout token for cargo jobs
 (OSS-351)

None of these jobs needs authenticated Git access afterwards, and build
scripts of dependencies run in the same job.
---
 .github/workflows/ci.yml      | 4 ++++
 .github/workflows/release.yml | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7226e21..3a2f45a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,6 +19,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy, rustfmt
@@ -37,6 +39,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - run: cargo build --workspace
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d9819d2..cbcb199 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,6 +35,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: ${{ matrix.target }}
@@ -100,6 +102,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
 
       # Trusted Publishing: exchange this job's OIDC token for a short-lived crates.io token.