Conversation
Renames the package on crates.io to runner-run (the bare `runner` name is
already taken). Pin [lib] name = "runner" so existing src/{main,bin}.rs
references to the library crate keep working unchanged.
Adds .github/workflows/crates-release.yml mirroring npm-release.yml: runs
on successful tag-triggered release.yml or manual dispatch, verifies the
tag matches Cargo.toml version, dry-runs publish, then uploads with
CARGO_REGISTRY_TOKEN under the crates-io environment.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
CodeQL flagged the previous workflow_run + checkout-of-tag pattern as "untrusted code in a privileged context" (security/code-scanning #7-9): workflow_run runs with secrets, and `cargo publish` executes build.rs from the tag-controlled checkout, which would let a malicious tag exfiltrate CARGO_REGISTRY_TOKEN. Switch the trigger to `release: types: [published]`. release.yml still creates the release as a draft — a maintainer must review and click publish, which becomes the human gate. The `crates-io` environment's required reviewers are the second gate. workflow_dispatch is preserved for manual republishes.
📝 Walkthrough
Preserves existing library import stability, enables secure tag-driven and manual publishes to crates.io, and improves CI safety and publish error messaging. WalkthroughPackage renamed from ChangesCrate Publication and Release Automation
sequenceDiagram
autonumber
participant Release as GitHub Release
participant GH as GitHub Actions Runner
participant Repo as Repository (git)
participant Cargo as Cargo / Rust toolchain
participant Crates as crates.io
Release->>GH: release.published or workflow_dispatch
GH->>Repo: checkout tag RELEASE_TAG
GH->>Cargo: install stable toolchain & enable cache
GH->>Cargo: cargo metadata + jq -> read `runner-run` version
Cargo-->>GH: package version
GH->>GH: compare tag vs Cargo.toml version
alt versions match
GH->>Cargo: cargo publish --locked --dry-run
Cargo-->>GH: dry-run result
alt INPUT_DRY_RUN != 'true'
GH->>Crates: cargo publish --locked (with CARGO_REGISTRY_TOKEN)
Crates-->>GH: publish result
end
else mismatch
GH-->>Release: fail workflow (version mismatch)
end
🚥 Pre-merge checks | ✅ 7 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (7 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches✨ Simplify code
Comment |
kjanat
changed the title
kjanat
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Two CodeRabbit findings on the crates-release workflow: - actions/checkout resolves bare refs to a branch first, then a tag, so a branch sharing a tag's name would silently checkout the wrong commit on workflow_dispatch input. Pin the ref to refs/tags/<tag> explicitly. - cargo publish would die with an opaque auth error if CARGO_REGISTRY_TOKEN isn't wired up. Compute HAS_CARGO_REGISTRY_TOKEN at job-level (so the secret value never lands in a step env) and fail fast with a clear message before the publish step runs.
️✅ There are no secrets present in this pull request anymore.If these secrets were true positive and are still valid, we highly recommend you to revoke them. 🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request. |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
runner | 8a785e0 | Commit Preview URL Branch Preview URL |
May 08 2026, 11:58 PM |
This comment was marked as low quality.
This comment was marked as low quality.
Sorry, something went wrong.
The package rename to runner-run isn't strictly breaking — runner-run has never been published to crates.io and the bare `runner` name on the registry belongs to someone else, so there's no prior consumer to break. But a lot of work has accumulated under [Unreleased] since v0.6.0 (composite action, cargo-aliases task source, landing page, templated site build, npm publish hardening, BSD packaging fixes, and now crates.io publishing), so cut a 0.7.0 section dated today and let this PR's tag carry all of it.
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
Cargo.toml (1)
2-3:⚠️ Potential issue | 🟠 Major | ⚡ Quick winArrr — bump this to a MAJOR release for the crate rename.
Line 2 changes the published crate identity (
runner→runner-run), which is a breaking change for consumers; Line 3 at0.7.0under-signals that break.Suggested patch
-version = "0.7.0" +version = "1.0.0"As per coding guidelines, “If the PR introduces breaking changes (removal or renaming of public APIs, changes to function signatures, deleted exported symbols, or incompatible config changes), MAJOR must increment.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@Cargo.toml` around lines 2 - 3, The crate rename in Cargo.toml changes the published package identity (name = "runner-run") which is a breaking change, so update the version string from "0.7.0" to a new MAJOR release (e.g., "1.0.0" or appropriate next major) to signal the breaking change; modify the version field in Cargo.toml to the new MAJOR version and ensure any related CI/release metadata that reads the version is updated to match.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CHANGELOG.md`:
- Around line 13-14: Update the `[Unreleased]` compare-link in the CHANGELOG
footer so it no longer points to `v0.6.0...HEAD`; replace the old tag portion
with the new release tag (e.g., `vX.Y.Z...HEAD`) so the `[Unreleased]` link
correctly compares the new tag to HEAD. Locate the `[Unreleased]` link in the
footer (the compare URL currently containing `v0.6.0...HEAD`) and update it to
`vX.Y.Z...HEAD`, ensuring the bracketed `[Unreleased]` text remains unchanged.
---
Duplicate comments:
In `@Cargo.toml`:
- Around line 2-3: The crate rename in Cargo.toml changes the published package
identity (name = "runner-run") which is a breaking change, so update the version
string from "0.7.0" to a new MAJOR release (e.g., "1.0.0" or appropriate next
major) to signal the breaking change; modify the version field in Cargo.toml to
the new MAJOR version and ensure any related CI/release metadata that reads the
version is updated to match.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: efcc71f0-539e-4ddb-a3e2-ff1c0099a799
⛔ Files ignored due to path filters (1)
Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (2)
CHANGELOG.mdCargo.toml
📜 Review details
⏰ Context from checks skipped due to timeout of 18000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (5)
- GitHub Check: verify
- GitHub Check: Workers Builds: runner
- GitHub Check: Analyze (actions)
- GitHub Check: Analyze (javascript-typescript)
- GitHub Check: Analyze (rust)
🧰 Additional context used
📓 Path-based instructions (2)
@(package.json|pyproject.toml|setup.py|Cargo.toml|go.mod|pom.xml|build.gradle|VERSION)
📄 CodeRabbit inference engine (Custom checks)
@(package.json|pyproject.toml|setup.py|Cargo.toml|go.mod|pom.xml|build.gradle|VERSION): If any source code files (excluding tests, docs, CI, markdown, or comments-only changes) are modified, then a version field MUST be updated in one of the following files if present in the repo: package.json, pyproject.toml, setup.py, Cargo.toml, go.mod, pom.xml, build.gradle, or a VERSION file.
The new version MUST follow SemVer (MAJOR.MINOR.PATCH). If the PR introduces breaking changes (removal or renaming of public APIs, changes to function signatures, deleted exported symbols, or incompatible config changes), MAJOR must increment. If it adds backward-compatible functionality, MINOR must increment. If it only fixes bugs without changing public APIs, PATCH must increment.
Files:
Cargo.toml
**/CHANGELOG.md
📄 CodeRabbit inference engine (Custom checks)
**/CHANGELOG.md: If any source code files (excluding tests, docs, CI, markdown, or comments-only changes) are modified, CHANGELOG.md MUST also be modified in the same PR.
If a version bump is detected, CHANGELOG.md MUST contain a new section header matching the exact new version number in the format: '## [X.Y.Z] - YYYY-MM-DD'.
If NO version bump is detected, the changes in the PR MUST be added under the existing '## [Unreleased]' section in CHANGELOG.md. The entry MUST describe the changes (e.g., Added, Changed, Fixed, Removed).
Files:
CHANGELOG.md
🧠 Learnings (1)
📚 Learning: 2026-03-26T16:14:15.754Z
Learnt from: kjanat
Repo: kjanat/runner PR: 1
File: src/tool/go_task.rs:64-81
Timestamp: 2026-03-26T16:14:15.754Z
Learning: If code uses let-chains (e.g., `if let Some(x) = foo && ... && let Some(y) = bar`), ensure the crate’s `Cargo.toml` sets `package.edition = "2024"`. Rust 2021/earlier should not be used with let-chains; require 2024 specifically for compilation.
Applied to files:
Cargo.toml
🔇 Additional comments (1)
Cargo.toml (1)
28-30: Good call:[lib] name = "runner"preserves import compatibility.Nice move — this keeps existing
runner::...paths stable while publishing underrunner-run.
3 participants
Summary
This PR adds support for publishing the
runnercrate to crates.io and renames the package torunner-runto avoid conflicts with existing crates.Key Changes
runnertorunner-runinCargo.tomlto comply with crates.io naming requirementsCargo.tomlto expose the crate as a library while maintaining the binary.github/workflows/crates-release.yml) that:Cargo.tomlversion before publishingImplementation Details
release.ymlworkflow run on version tags (starting with 'v') or via manualworkflow_dispatchCargo.tomlbefore any publish attemptCARGO_REGISTRY_TOKENsecret for actual crate publicationhttps://claude.ai/code/session_014R4NQ7rUaJVZ2s36Kxe4WT