feat(cargo): publish crates to public psa-systems registry #99

Merged

David merged 1 commit from feat/VA-98-publish-crates-public into main

2026-07-01 18:38:10 +02:00

David commented

2026-07-01 18:11:42 +02:00

Owner

What

Repoint the psa-systems-cargo cargo alias from the private psa-systems-private owner to the public psa-systems org so vervain-agent-mcp and vervain-agent-kvm publish where consumers can read them without authentication. Covers the two local code ACs of VA-98 (AC1 and the code half of AC2).

Changes

.cargo/config.toml: repoint [registries.psa-systems-cargo] index to sparse+https://dev.a8n.run/api/packages/psa-systems/cargo/. Rewrite the stale comment block that documented the private-owner / auth-required-on-read rationale to describe the public owner (reads need no auth; publish still needs write:package, so global-credential-providers = ["cargo:token"] stays). Correct the rustc pin comment 1.93.1 -> 1.94 to match rust-toolchain.toml.
.forgejo/workflows/publish-crates.yml: the "Print registry URLs" step now prints psa-systems instead of psa-systems-private. The publish step is unchanged because the alias name is repointed, not renamed.

Out of scope (post-merge, sequenced by the issue)

These are infra / separate-repo steps the issue itself orders after this config PR merges, not local engineering work:

AC2 publish run: dispatch fj actions dispatch publish-crates.yml main -I ref=v0.2.0 after merge (the existing v0.2.0 tag does not re-fire the push trigger).
AC3: confirm PSA_SYSTEMS_PRIVATE_PACKAGE_PAT has write:package on the psa-systems org (secret-scope verification, not checkable from the tree).
AC4 / AC5: packages appear publicly and a credential-less consumer builds (depend on the publish run).
AC6: desktop-mcp .cargo/config.toml repointed (separate repo / PR, tracked by the Depend link to DMCP-8).
AC7: remove the stale psa-systems-private cargo copies after migration is verified.

docs/agent-package-distribution.md references psa-systems-private but for the GENERIC binary package registry, not the cargo registry, so it is correctly left untouched.

Verification

just pre-commit green (docker build: fmt + clippy --deny warnings + build + test).

#VA-98

## What Repoint the `psa-systems-cargo` cargo alias from the private `psa-systems-private` owner to the public `psa-systems` org so `vervain-agent-mcp` and `vervain-agent-kvm` publish where consumers can read them without authentication. Covers the two local code ACs of VA-98 (AC1 and the code half of AC2). ## Changes - `.cargo/config.toml`: repoint `[registries.psa-systems-cargo]` index to `sparse+https://dev.a8n.run/api/packages/psa-systems/cargo/`. Rewrite the stale comment block that documented the private-owner / auth-required-on-read rationale to describe the public owner (reads need no auth; publish still needs `write:package`, so `global-credential-providers = ["cargo:token"]` stays). Correct the rustc pin comment 1.93.1 -> 1.94 to match `rust-toolchain.toml`. - `.forgejo/workflows/publish-crates.yml`: the "Print registry URLs" step now prints `psa-systems` instead of `psa-systems-private`. The publish step is unchanged because the alias name is repointed, not renamed. ## Out of scope (post-merge, sequenced by the issue) These are infra / separate-repo steps the issue itself orders after this config PR merges, not local engineering work: - AC2 publish run: dispatch `fj actions dispatch publish-crates.yml main -I ref=v0.2.0` after merge (the existing `v0.2.0` tag does not re-fire the push trigger). - AC3: confirm `PSA_SYSTEMS_PRIVATE_PACKAGE_PAT` has `write:package` on the `psa-systems` org (secret-scope verification, not checkable from the tree). - AC4 / AC5: packages appear publicly and a credential-less consumer builds (depend on the publish run). - AC6: `desktop-mcp` `.cargo/config.toml` repointed (separate repo / PR, tracked by the Depend link to DMCP-8). - AC7: remove the stale `psa-systems-private` cargo copies after migration is verified. `docs/agent-package-distribution.md` references `psa-systems-private` but for the GENERIC binary package registry, not the cargo registry, so it is correctly left untouched. ## Verification `just pre-commit` green (docker build: fmt + clippy --deny warnings + build + test). #VA-98

David added 1 commit

2026-07-01 18:11:42 +02:00

feat(cargo): publish crates to public psa-systems registry

Check / fmt + clippy + tests (pull_request) Successful in 4m45s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

d303c91459

Repoint the `psa-systems-cargo` alias index from the private `psa-systems-private` owner to the public `psa-systems` org (`sparse+https://dev.a8n.run/api/packages/psa-systems/cargo/`). Forgejo package read access follows owner visibility, so a public owner serves the index and crate reads with `auth-required: false`, letting consumers resolve and download the crates with no credentials. The alias name is unchanged, so the per-crate `publish = ["psa-systems-cargo"]` fields and the publish workflow need no rename.

Rewrite the now-stale comment block in `.cargo/config.toml`: it described the private-owner / auth-required-on-read rationale, which no longer applies. Publishing still needs `write:package` auth for the upload, so `global-credential-providers = ["cargo:token"]` stays; only read-auth goes away on the public owner. Also correct the rustc pin comment (1.93.1 -> 1.94, matching `rust-toolchain.toml`).

Update the `publish-crates.yml` "Print registry URLs" step to print `psa-systems` instead of `psa-systems-private` URLs.

Post-merge infra steps (dispatch the publish run against v0.2.0, confirm the PAT's `write:package` scope on `psa-systems`, verify credential-less consumer builds, repoint desktop-mcp, and remove the stale `psa-systems-private` cargo copies) are sequenced after this config PR merges per the issue and are out of scope for this code change.

#VA-98

David scheduled this pull request to auto merge when all checks succeed

2026-07-01 18:14:00 +02:00