Automate updating/publishing

[aDotInTheVoid]

Part 1: Automatically generate changes with GHA

• Detect changes in src/rustdoc-json-types
• Decide if this is a major or minor version (FORMAT_VERSION should be a decent proxy, but may not be true if JSON format doesn't change but rust does)
• Run ./update.sh
• Update Cargo.toml
• Update CHANGELOG.md
• Create PR.

Part 2: Automaticly publish to Crates.io

• Detect new version has been merged
• Publish to crates.io
• Do this in a way giving a way with minimal perms.

Overall, I don't think I wan't to automaticly publish on upstream changes, but it would be nice for it to be more automated

[aDotInTheVoid]

https://github.com/matklad/always-assert/blob/master/xtask/src/main.rs does auto-publish on CI, and could be used as a starting point.

[Enselic]

FWIW, here is the release action I use for rustdoc-json: https://github.com/Enselic/cargo-public-api/blob/main/.github/workflows/Release-rustdoc-json.yml. It also pushes a git tag after cargo publish.

Good to know: If you add a GitHub org as crates.io crate owner, its members are allowed to publish crates but not remove other crates.io owners. That is a good safety mechanism in in case the crates.io token leaks. A regular crates.io token allows to remove the original crate owner if it leaks. More info on GitHub org owners: https://doc.rust-lang.org/cargo/reference/publishing.html

[aDotInTheVoid]

Further evidence this is worth doing: rust-lang/rust#109410 merged 4 days ago, but 933c7f0 was only released today. Historically this hasn't happened because I've been on top of things, but if rust has taught us anything, "just always be on top of things" is never a viable strategy in the long run.

[aDotInTheVoid]

And in regards to token security, the new crates.io scoped token system makes this much less of a problem

[aDotInTheVoid]

Further thoughts, given the axios phishing atack, I think automating publishing via OIDC Trusted Publishing would be worthwhile.

Under this model, the update/release notes would still be done manaully, but instead of running cargo publish locally, that happens on a GitHub runner.

(Otoh, if I get phished, an adversary could use my ssh keys to push malitious code with a tag and publish that way)