[chaliy]

What changed

Publish all four Rust crates with GitHub OIDC trusted publishing. Each upload job gets its own short-lived token after credential-free package verification, using the SHA-pinned official crates.io action. The action masks and revokes tokens; existing immutable source validation, dependency order and registry verification remain intact.

The JavaScript test-tool graph also requires patched glob/minimatch releases because the existing graph failed CI Audit with GHSA-3g3m-2fjr-6pw4 and GHSA-g3hv-75wg-m249. Published runtime dependencies are unchanged; the normal three-day dependency cooldown remains enforced.

Why

Remove stored crates.io tokens from automated publication and bind access to this repository's publish.yml workflow and release environment.

Before / After

Before: four upload steps used secrets.CARGO_REGISTRY_TOKEN.
After: all four use steps.auth.outputs.token; only those jobs have id-token: write. The new regression test fails on the original workflow and passes after migration.

Validation: just pre-pr passes (format, Clippy, complete default Rust workspace tests/doctests, Python tests, capability/knowledge/docs/workflow/changelog guards and cargo vet). Run on macOS with installed GNU coreutils on PATH and local socket/process access for the Bash oracle tests. The 205 Python script tests ran successfully (8 platform-specific skips), Actionlint passes, and the OKF checks pass. These checks cover immutable release source, main-based recovery, package verification before token exchange and credential scoping. After the audit repair: the exact CI scripts/audit-lockfiles.sh passes across all lockfiles, frozen pnpm installation and package formatting pass, the native JavaScript module and TypeScript wrappers build, and all 681 JavaScript tests pass. Release-security and audit-script regressions also pass. No real OIDC publication has been performed.

Risk

• Medium: the trusted publishers for bashkit-cpython-wasm, bashkit, bashkit-cli and bashkit-scripted-tool are configured and browser-verified. All bind GitHub repository everruns/bashkit, workflow publish.yml and environment release.
• The release environment is restricted to branch main and tags v*, verified through the GitHub API, preserving existing recovery. New crate names need initial publication with an owner token before trusted publishing is available.
• Security review: TM-INF-027, credential disclosure and supply chain. Actions remain SHA-pinned; package builds do not receive a registry token; token exchange is after verification and cleanup revokes it.

Follow-ups

All four trusted publishers and release environment restrictions are approved, configured and verified. All final PR CI checks pass; no actionable review comments remain. No implementation follow-ups. A first real OIDC publication remains separate evidence; existing credentials stay until that publication and consumer checks are complete.

Checklist

• Tests added or updated
• Backward compatibility considered

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	79c661b	Commit Preview URL Branch Preview URL	Oct 31 2026, 01:45 AM

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!