trusted-publishing

Trusted Publishing for crates.io

Trusted Publishing uses OIDC (OpenID Connect) to authenticate GitHub Actions workflows to crates.io without long-lived API tokens. This eliminates the risk of token theft and credential leaks.

Threat Model

Attack Vector	API Token	Trusted Publishing
Token leaked in logs	Vulnerable	N/A (no token)
Token stolen from secrets	Vulnerable	N/A (no token)
Compromised maintainer account	Token can be exfiltrated	OIDC scoped to repo + workflow
Supply chain attack on CI	Token available in env	Token scoped to specific environment
Token rotation burden	Manual rotation needed	Automatic, ephemeral tokens

Prerequisites

1. Crate already published — You must have done at least one cargo publish with a traditional token. Trusted Publishing cannot be used for the initial publish.
2. GitHub environment created — Create a crates-io environment in repo Settings > Environments.
3. Owner access on crates.io — You must be an owner of the crate to configure publishing settings.

Step-by-Step Setup

Step 1: Create GitHub Environment

1. Go to repo Settings > Environments > New environment
2. Name it crates-io (must match the environment: in your workflow)
3. Optionally add protection rules (required reviewers, deployment branches)
4. No secrets needed — OIDC provides the token automatically

Step 2: Configure at crates.io

GOTCHA: This is configured at crates.io, not in your repository.

1. Go to https://crates.io/crates/YOUR_CRATE/settings
2. Under "Trusted Publishing", click "Add"
3. Fill in:
   • Repository owner: Your GitHub org or username
   • Repository name: Your repo name
   • Workflow filename: publish.yml (or whatever you named your publish workflow)
   • Environment: crates-io
4. Click "Add"

Step 3: Update Your Publish Workflow

The workflow needs two key pieces:

1. id-token: write permission on the publish job:

permissions:
  contents: read
  id-token: write