max / supernote-push

recipe: note why the crates.io token is not passed through Bento

Author: Max Johnson <me@maxj.phd> · 2026-07-19 21:26 UTC

Commit: 6c9bb0b53aaea1d714daff9ce3a227751dc6ee06

Parent: fa6a883

1 file changed, +4 insertions, -0 deletions

M dist/recipes/publish.rhai +4

			@@ -20,6 +20,10 @@ step("build");
20	20		sh_ok(h, "cd " + r + " && cargo test " + feature_flags());
21	21
22	22		step("verify");
	23	+	// Credentials are checked here too, and deliberately not passed through Bento:
	24	+	// the token stays in cargo's own 0600 store on the publishing host, where cargo
	25	+	// finds it. Handing it to a shell command would put it in the process list for
	26	+	// the length of the upload, and ops-exec renders env pairs into the shell line.
23	27		// Aborts the run with the specific problems if anything is wrong.
24	28		log(crate_preflight());
25	29		sh_ok(h, "cd " + r + " && cargo publish --dry-run " + feature_flags());