[setoelkahfi]

This is a semver-minor release of sigit-si-api (1.2.0). Everything is additive, and Client::new and with_token behave as before, so the si CLI is unchanged.

What changes

• Client::builder(environment) takes an injected reqwest::Client, a user agent, an explicit base URL, a client name and a token. An explicit base URL replaces the environment default, so SIGIT_HOST has no effect on it.
• .client_name(..) sends the new CLIENT_HEADER (x-sigit-client) on every request.
• A default client feature gates reqwest, Client, ApiError and the endpoint modules. With default-features = false only the wire types remain (models, ErrorResponse, error::codes, Environment, CLIENT_HEADER) and cargo tree shows no reqwest.
• The TLS backend is a feature: rustls-tls-native-roots (default), rustls-tls-webpki-roots or native-tls. With none enabled and no injected client, HTTPS requests fail. This is documented in the crate docs.
• ErrorResponse, AccountStatus, BillingUrl and GitCredential now implement Serialize.
• New endpoints: sign_up, resend_confirmation and delete_account.
• The workspace reqwest no longer enables a TLS feature. The CLI adds rustls-tls-native-roots itself.
• New release-crates.yml workflow publishes a chosen crate with crates.io Trusted Publishing (dispatch only, with a dry run option). Both crates have a trusted publisher entry for it.

Checks

• cargo test --workspace, cargo clippy --workspace --all-targets -- -D warnings
• cargo check -p sigit-si-api with default features, --no-default-features, --no-default-features --features client and --no-default-features --features native-tls
• cargo build -p sigit-si-cli

I did not run the si auth login and si repo list smoke test.

Before publishing

GitHub can only dispatch a workflow that exists on the default branch, so release-crates.yml has to reach main before the first trusted publish. Publish sigit-si-api first; the CLI depends on it. server.json still says 1.1.0 and should move with the CLI release.

[sigit-code-review]

This change introduces a builder pattern for the sigit-si-api Client, allowing for injection of a custom reqwest::Client, user agent, explicit base URL, client name, and token. The new builder enables more flexible configuration, including support for disabling all TLS features and requiring an injected client for HTTPS. The default features and TLS backend selection are now explicit in Cargo.toml, and the API crate can be built without the HTTP client for proxy/server use cases. New account endpoints (sign_up, resend_confirmation, delete_account) are added. Several wire types now implement Serialize. The workspace and CLI dependencies are updated to match the new API version and TLS handling. A new GitHub workflow for trusted publishing is included. The README and crate docs are updated to reflect these changes. All previous findings appear addressed, and the new code is covered by unit tests for builder behavior and header injection.

---

Automated review by siGit Code Review · commit 6907b93 · see the review dashboard

[sigit-code-review]

Looks good to me, thanks for working through the comments.