Assign copyright to ATRAPS LLC, release on tag, update dependencies - #1
Merged
Conversation
Record ATRAPS LLC as copyright holder. The Apache-2.0 appendix claimed 2025-2026, but every commit in this repository dates to 2026 — the 2025 was unsupported. Rename LICENSE-APACHE to LICENSE and repoint the README reference. The suffixed-only name is also why GitHub reported the licence as NOASSERTION rather than Apache-2.0. - LICENSE: appendix now reads "Copyright 2026 ATRAPS LLC" - NOTICE: added, per Apache-2.0 section 4(d) attribution channel - Cargo.toml: drop deprecated `authors`; point `repository` / `homepage` at the org - README: name the holder in the license section
Publishing was triggered by pushes to main: the workflow read the version out of Cargo.toml, created a release if that version had no tag yet, and published. A merge could therefore reach crates.io without an explicit decision to ship, and the release existed only as a side effect of the push. Drive it from `release: published` instead. Add a version job that holds the tag against Cargo.toml so a mistyped tag fails before anything ships, and gate publishing on the release commit being contained in main. The create-release job is gone, since the release is now the input rather than the output. Also replace the long-lived CARGO_REGISTRY_TOKEN secret with a short-lived OIDC token minted per run and revoked when the job ends.
0.2.3 is already published and its metadata is immutable, so the corrected copyright holder, dropped `authors` field, and organisation URLs only reach crates.io in a new version. Refreshes dependencies; thiserror moves to 2.0.20.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
chore: assign copyright to ATRAPS LLC2025-2026, but every commit in this repository dates to 2026 — the 2025 was unsupported. NowCopyright 2026 ATRAPS LLC.LICENSE-APACHEtoLICENSEand repointed the README reference. Carrying only the suffixed name is why GitHub reported this repository’s licence asNOASSERTIONrather thanApache-2.0.NOTICE; dropped the deprecatedauthorsfield; repointedrepository/homepage.ci: release on a tag, and publish via trusted publishingPublishing was triggered by pushes to
main: the workflow read the version out ofCargo.toml, created a release if that version had no tag yet, and published. A merge could therefore reach crates.io without an explicit decision to ship, and the release existed only as a side effect of the push.It is now driven by
release: published. A version job holds the release tag againstCargo.tomlso a mistyped tag fails before anything ships, and publishing is gated on the release commit being contained inmain. Thecreate-releasejob is removed, since the release is now the input rather than the output. The storedCARGO_REGISTRY_TOKENis replaced by a short-lived OIDC token minted per run and revoked when the job ends.chore: release 0.2.4— 0.2.3 is published and immutable, so the corrected metadata only reaches crates.io in a new version.thiserrormoves to 2.0.20.Verified locally with this repository’s CI commands —
cargo fmt --all -- --check,cargo clippy --all-targets -- -D warnings,cargo test --verbose,cargo doc --no-deps— all clean.cargo package --listnow includesLICENSEandNOTICE.