Skip to content

Move metadata to 0xdoublesharp and publish the crate with trusted publishing - #3

Merged
doublesharp merged 3 commits into
mainfrom
chore/org-metadata
Nov 8, 2026
Merged

doublesharp merged 3 commits into
mainfrom
chore/org-metadata

Conversation

@doublesharp

Copy link
Copy Markdown
Collaborator

Change

The repository moved from doublesharp to the 0xdoublesharp organization.

  • Docs checker: scripts/check-docs.py recognized the repository's own GitHub blob links only under /doublesharp/bin-packing/. After the move it would have treated them as external links and skipped them, and it would have stopped re-pinning the binding READMEs to the release version. It now takes the owner and name from [workspace.package].repository, as release-note pinning already did. New tests cover both paths.
  • Publishing metadata: the workspace repository, plus repository.url in bindings/node and bindings/wasm. In the publish job, napi create-npm-dirs copies the Node package's repository into the six platform packages (confirmed in @napi-rs/cli 3.6.1's source), so they follow. npm provenance requires this URL to match the publishing repository.
  • Links: README images, the binding READMEs, the issue and pull request templates, CONTRIBUTING.md and the v0.6.0 release notes.
  • Publish job: CARGO_REGISTRY_TOKEN no longer comes from a secret in the job-level env. A rust-lang/crates-io-auth-action@v1 step runs before the first publish step (the job already has id-token: write), and its short-lived token goes only to cargo publish. If the crates.io trusted publisher is missing, the job stops before npm receives a partial release. docs/releasing.md is updated to match.

Before the next release, the bin-packing crate needs a crates.io trusted publisher for 0xdoublesharp/bin-packing and workflow ci.yml.

Verification

  • python3 -m unittest discover -s scripts/tests: 54 passed. The two new docs tests and the updated one fail against the old checker.
  • python3 -B scripts/check-docs.py: generated docs and local links passed, and the new-owner links are now checked as local files.
  • taplo fmt --check, typos and actionlint passed.
  • cargo metadata --no-deps --locked shows the new repository URL.
  • Not run locally: the full ./scripts/check-quality.sh (clippy, tests, doctests, Rust doc examples). No Rust sources changed, and CI's Quality gate runs the script on this PR.

Checklist

  • I followed AGENTS.md
    and CONTRIBUTING.md.
  • I ran ./scripts/check-quality.sh and recorded the result above. It runs in CI's Quality gate; see Verification.
  • I added regression coverage and ran relevant feature or binding checks,
    or explained why they do not apply.
  • I updated affected public docs, examples, and binding declarations,
    or explained why they do not apply.

🤖 Generated with Claude Code

doublesharp and others added 3 commits November 7, 2026 16:41
check-docs.py recognized this repository's GitHub blob links only under
/doublesharp/bin-packing/, so after a transfer it would skip them as
external links instead of checking them locally, and it would stop
re-pinning the binding READMEs to the release version. Both now take
the owner and name from [workspace.package].repository, as release-note
pinning already does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The repository moved from doublesharp to the 0xdoublesharp organization.
The workspace repository URL, both npm packages' repository URLs (napi
create-npm-dirs copies the Node one into the six platform packages), the
README images and links, the issue and pull request templates, the
contributing guide and the v0.6.0 release notes now use the new owner.
npm provenance requires repository.url to match the publishing repository.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The publish job read CARGO_REGISTRY_TOKEN from a secret for the whole
job. It now gets a short-lived token from rust-lang/crates-io-auth-action
(the job already has id-token: write) and passes it only to the cargo
publish step. Authentication runs before the first publish step, so a
missing crates.io trusted publisher stops the job before npm receives a
partial release. The crate needs a trusted publisher for
0xdoublesharp/bin-packing and ci.yml.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@doublesharp
doublesharp merged commit 6a9ffce into main Nov 8, 2026
5 checks passed
@doublesharp
doublesharp deleted the chore/org-metadata branch November 8, 2026 01:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant