rust-crate-release

Guides publishing Rust crates and binary releases with SemVer, MSRV, signing, and recovery checks.

2|1|Updated Aug 19, 2026
One-click install
npx skills add https://github.com/po4yka/rust-skills --skill rust-crate-release-po4yka
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: rust-crate-release
Source: https://github.com/po4yka/rust-skills/tree/main/skills/rust-crate-release
Command: npx skills add https://github.com/po4yka/rust-skills --skill rust-crate-release-po4yka

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Publishing a Rust crate or binary release involves irreversible external writes, SemVer and MSRV decisions, packaging pitfalls, and supply-chain signing requirements, and a single mistake can leak tokens or ship broken artifacts. ## Core Features & Use Cases - Release gating workflow: Walks through SemVer classification with cargo-semver-checks, MSRV and feature-matrix verification, manifest metadata checks, and cargo package inspection before any publish. - Binary distribution and signing: Covers reproducible builds, checksum manifests, SBOMs, SLSA provenance, cosign blob signing, and consumer-side verification of uploaded assets. - Recovery and workspace ordering: Provides yank, crate deletion, owner-change, and RustSec advisory procedures plus ordered multi-package workspace publishing. - Use Case: You are about to publish version 2.1.0 of a crate from a workspace. The skill has you diff against the previous tag, run the API and MSRV checks, dry-run the whole package set, request explicit authorization, publish once, then verify the registry and tag the exact commit. ## Quick Start Ask the agent to prepare and publish version 1.4.0 of your crate to crates.io following the rust-crate-release checklist, starting with the read-only release checks.

Frequently Asked Questions about rust-crate-release

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I publish a Rust crate to crates.io safely?▼

Run cargo package and cargo publish --dry-run first, verify the version is free with cargo info --registry, then run the approved cargo publish --locked -p <package> --registry <registry> once. Never use --allow-dirty or --no-verify, and never reuse a version after a timed-out publish.

How do I decide a SemVer bump for a Rust crate release?▼

Diff the previous release tag against the candidate and classify changes with the Cargo SemVer guide: patch for compatible fixes, minor for compatible additions, major for incompatible changes. Run cargo semver-checks --baseline-version to catch API breaks automatically.

What is crates.io trusted publishing and how do I set it up?▼

Trusted publishing lets a GitHub Actions job exchange its OIDC identity for a short-lived crates.io token, removing stored registry secrets. Configure the repository, workflow file, and environment in the crate settings, then use rust-lang/crates-io-auth-action with id-token: write on the publish job.

When should I yank a crate version on crates.io?▼

Yank only for exceptional defects such as an accidental publish, unintended SemVer break, or seriously broken version, and only after explicit authorization. Publish a compatible fixed version first when possible, since a yank does not break existing lockfiles or remove leaked secrets.

Why do packaged crate tests fail with E0432 or E0433 after publish?▼

Cargo removes path-only dev-dependencies without a version field from the published manifest, so tests using them pass in the workspace but fail from the archive. Give the helper crate a published version or exclude those tests from the archive.

How do I sign Rust release binaries with cosign?▼

Sign the final checksum manifest with cosign sign-blob SHA256SUMS --bundle, then verify with cosign verify-blob pinning the expected certificate identity and OIDC issuer. Test verification once with a wrong identity to confirm the check actually fails.