Migrate to ATRAPS LLC: copyright, fix dead repository URL, deps, trusted publishing - #2
Merged
Conversation
Record ATRAPS LLC as copyright holder following the executed IP assignment. The Apache-2.0 appendix named Johann Kempter personally and carried the wrong year: every commit in this repo dates to 2026, not 2025. `repository` also pointed at github.com/BinFlip/inno-rs, which does not exist — so all three published versions carry a dead repository link on crates.io. This crate has had three names in play at once: the directory is `inno/`, the git remote said `BinFlip/inno`, the manifest said `inno-rs`, and the actual repository is `innospect`. The manifest now names the real repository under the org. - LICENSE: appendix now reads "Copyright 2026 ATRAPS LLC" - NOTICE: added, per Apache-2.0 section 4(d) attribution channel - Cargo.toml: drop deprecated `authors`; fix `repository` - README: name the holder in the license section - src/lib.rs: repoint the pascalscript doc link at the org
Replace the long-lived CARGO_REGISTRY_TOKEN repo secret with a short-lived OIDC token minted per run by crates-io-auth-action and revoked when the job ends. Also gate the job on the release commit being contained in main: a release can be cut from any commit, including one that never landed on main, so the `release: published` trigger alone does not imply it.
`Container` is re-exported publicly from this crate, so pascalscript's public API is part of innospect's effective surface. 0.1.2 fixes backward-branch target resolution — `branch_target()` returned None for every backward conditional branch, losing the back edge of every loop — so a consumer resolving to 0.1.1 through innospect would still hit it. Cargo.lock is not tracked here, so the remaining `cargo update` movement (bitflags 2.13.1 and transitives) affects only local builds.
0.1.2 is already published and its metadata is immutable, so the corrected licence holder, dropped `authors` field, and — most importantly — the fixed `repository` URL only reach crates.io in a new version. Until then the registry keeps pointing at a repository that does not exist.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Migration of this crate to ATRAPS LLC ownership, per TRANSFER.md.
chore: assign copyright and fix the repository URLLICENSEappendix now readsCopyright 2026 ATRAPS LLC. It named Johann Kempter personally and said 2025, which no commit supports — this history is entirely 2026.repositorypointed atgithub.com/BinFlip/inno-rs, which does not exist. All three published versions carry a dead repository link on crates.io. This crate has had three names in play at once: directoryinno/, git remoteBinFlip/inno, manifestinno-rs, actual repoinnospect. The manifest now names the real repository under the org.NOTICEadded;authorsdropped; README names the holder;src/lib.rspascalscript doc link repointed at the org.ci:— trusted publishing replaces the storedCARGO_REGISTRY_TOKEN, and the job refuses to publish a release whose commit is not contained inmain.build: raise pascalscript minimum to 0.1.2—Containeris re-exported publicly, so pascalscript's API is part of this crate's effective surface. 0.1.2 fixes backward-branch target resolution, so a consumer resolving to 0.1.1 through innospect would still hit that bug.Cargo.lockis not tracked here, so the rest of thecargo updatemovement affects local builds only.chore: release 0.1.3— 0.1.2 is published and immutable, so the fixedrepositoryURL and corrected metadata only reach crates.io in a new version.Verified locally: 86 tests pass, clippy clean (
--all-targets), fmt clean,cargo packageshipsLICENSEandNOTICE.Note:
tests/samples/build/*.issstill containAppPublisher=BinFlip. Left deliberately — they are build inputs for generated sample fixtures, and editing them without regenerating would make script and committed fixture disagree.