Migrate to ATRAPS LLC: add LICENSE, copyright, dependencies, trusted publishing - #1
Merged
Conversation
Cargo.toml has declared `license = "Apache-2.0"` since the first release, but no LICENSE file ever existed in this repo — so all three published versions claim a licence whose text was never shipped, and nothing on record stated who owned the code. Add the Apache-2.0 text with the appendix filled in for ATRAPS LLC, following the executed IP assignment. - LICENSE: added, appendix reads "Copyright 2026 ATRAPS LLC" - NOTICE: added, per Apache-2.0 section 4(d) attribution channel - Cargo.toml: drop deprecated `authors`; point `repository` at the org - README: name the holder in the license section
Replace the long-lived CARGO_REGISTRY_TOKEN repo secret with a short-lived OIDC token minted per run by crates-io-auth-action and revoked when the job ends. The trust is bound to the repository and workflow rather than to a personal crates.io account. Also gate the job on the release commit being contained in main: a release can be cut from any commit, including one that never landed on main, so the `release: published` trigger alone does not imply it.
`cargo update` within existing constraints. No direct dependency changed version — goblin, memchr, and proptest were already at their latest releases. Transitive packages moved and `zmij` dropped out of the graph. Full suite passes: 131 tests across unit, integration, and doc targets.
0.3.0 is already published and its metadata is immutable, so the added LICENSE, corrected copyright holder, dropped `authors` field, and organisation repository URL only reach crates.io in a new version.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Migration of this crate to ATRAPS LLC ownership, per TRANSFER.md.
chore: add LICENSE and assign copyright— this repo had no LICENSE file at all, whileCargo.tomlhas declaredlicense = "Apache-2.0"since the first release. All three published versions therefore claim a licence whose text was never shipped, and nothing on record stated who owned the code. Per D4 this crate is Apache-2.0, same as the rest.LICENSEadded, appendix readsCopyright 2026 ATRAPS LLC.NOTICEadded (Apache-2.0 §4(d) attribution channel).Cargo.toml: dropped the deprecatedauthorsfield;repositoryrepointed at the org.README: names the holder in the license section.ci:— publishing moved to crates.io trusted publishing: a short-lived OIDC token bound to this repo and workflow replaces the storedCARGO_REGISTRY_TOKEN, and the job refuses to publish a release whose commit is not contained inmain.build: refresh transitive dependencies—cargo updatewithin existing constraints. No direct dependency changed version; goblin, memchr and proptest were already latest.chore: release 0.3.1— 0.3.0 is published and immutable, so the added LICENSE and corrected metadata only reach crates.io in a new version.Verified locally: 131 tests pass, clippy clean (
--all-targets), fmt clean,cargo packageshipsLICENSEandNOTICE.