From 2b93d25fddce424ced90dbede539db3d758dcf84 Mon Sep 17 00:00:00 2001
From: DanConwayDev <DanConwayDev@protonmail.com>
Date: Sat, 12 Sep 2026 06:41:52 +0000
Subject: [PATCH] ci: publish release tags to crates.io from Nostr CI

Crates.io publication is a manual release step even though Nostr CI already validates tagged commits. Publish after the existing lint, formatting and test steps succeed, using a repository-scoped CARGO_REGISTRY_TOKEN secret only in the publication step.

Require a push event on a v-prefixed tag and an exact manifest-version match. Use Cargo package verification and --locked against the explicit crates-io registry. Only ngit-grasp is selected; grasp-audit remains unpublished.

This assumes the coordinator has the scoped token configured and the tagged commit contains this workflow. It does not change archive/NIP-82 publication, stable promotion, documentation sync or registry versions; no live crate was uploaded during development.

Validated workflow syntax with actionlint, matching/mismatched tag and missing-secret cases with an intercepted publish command, Cargo packaging without upload, cargo fmt --all -- --check, and git diff --cached --check.
---
 .ngit/act/workflows/rust_ci.yaml | 13 +++++++++++++
 docs/how-to/publish-crate.md     | 21 +++++++++++++++++++++
 2 files changed, 34 insertions(+)
 create mode 100644 docs/how-to/publish-crate.md

diff --git a/.ngit/act/workflows/rust_ci.yaml b/.ngit/act/workflows/rust_ci.yaml
index dc9710c..78f0328 100644
--- a/.ngit/act/workflows/rust_ci.yaml
+++ b/.ngit/act/workflows/rust_ci.yaml
@@ -66,3 +66,16 @@ jobs:
       - run: nix develop --command cargo clippy --workspace --all-targets -- -D warnings
       - run: nix develop --command cargo test --locked
       - run: nix develop --command cargo test -p grasp-audit --locked
+      - name: Publish release tag to crates.io
+        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+        run: |
+          set -euo pipefail
+          version="$(nix eval --impure --raw --expr '(builtins.fromTOML (builtins.readFile ./Cargo.toml)).package.version')"
+          if [[ "$GITHUB_REF" != "refs/tags/v$version" ]]; then
+            echo "release tag must match Cargo.toml version v$version" >&2
+            exit 1
+          fi
+          : "${CARGO_REGISTRY_TOKEN:?Configure the repository CARGO_REGISTRY_TOKEN secret in ngit-ci}"
+          nix develop --command cargo publish --locked --registry crates-io --package ngit-grasp
diff --git a/docs/how-to/publish-crate.md b/docs/how-to/publish-crate.md
new file mode 100644
index 0000000..ca526a5
--- /dev/null
+++ b/docs/how-to/publish-crate.md
@@ -0,0 +1,21 @@
+# Publish ngit-grasp to crates.io
+
+Nostr CI publishes `ngit-grasp` after the existing formatting, lint and test
+steps pass for a `v*` tag push. The tag must exactly match `v` followed by the
+package version in `Cargo.toml`, including any prerelease suffix. Branch pushes
+and pull requests do not publish crates. The unpublished `grasp-audit` workspace
+member is not selected for publication.
+
+Configure the repository's `CARGO_REGISTRY_TOKEN` secret in ngit-ci with a
+crates.io token scoped to publishing `ngit-grasp`. The token is supplied only
+to the publication step; Cargo does not write a login credential file.
+
+The workflow runs `cargo publish --locked --registry crates-io --package
+ngit-grasp`, including Cargo's package verification. A missing token or an
+already-published version fails the step; the workflow does not overwrite or
+automatically bump releases.
+
+The workflow must be included in the tagged commit. Adding it does not
+backfill existing tags, and crate publication is independent of the existing
+archive, NIP-82 and container publication jobs. It requires no GitHub registry
+authentication.