菜单
Operate the socket-release crates.io flow - the cargo staged model (dry-run default), trusted publishing via OIDC under the cargo-publish environment, index-propagation waits, and yank-as-rollback. Use when publishing a Rust crate in a repo carrying scripts/socket-release/.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/SocketDev/sauce --skill cargo-publish命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Act on `xport.json` lock-step drift: auto-bump `version-pin` rows; the other row kinds (file-fork, feature-parity, spec-conformance, lang-parity) are advisory only.
Fix dependency security issues - either scan and fix everything (requires /socket-scan), or target a single named package. Orchestrates /socket-dep-cleanup, /socket-dep-replace, /socket-dep-patch, and /socket-dep-upgrade as subskills.
Apply Socket's binary-level security patches without changing dependency versions. Uses socket-patch apply to fix vulnerabilities in-place, then verifies automated patching is configured so patches persist across installs.
基于 SOC 职业分类
正在显示 SKILL.md
| name | cargo-publish |
| description | Operate the socket-release crates.io flow - the cargo staged model (dry-run default), trusted publishing via OIDC under the cargo-publish environment, index-propagation waits, and yank-as-rollback. Use when publishing a Rust crate in a repo carrying scripts/socket-release/. |
crates.io publishes are PERMANENT (yank-only, no unpublish), so the kit's
cargo flow is dry-run by default everywhere and the real publish runs only
under the cargo-publish GitHub environment through crates.io Trusted
Publishing (OIDC - no long-lived token anywhere).
The same bootstrap stands up the cargo-publish environment
(branch-restricted) and installs cargo-publish.yml:
node scripts/socket-release/bootstrap.mts github-env staged-config --apply
crates.io's trusted-publisher config (crate ↔ repo ↔ workflow ↔ environment) is set on crates.io's settings page by the crate owner - a human step; render it as a gate with the crate's settings URL, do not improvise a browser drive.
Bump: Cargo.toml version + CHANGELOG, commit
chore: bump version to <version>, push.
Dry-run locally:
node scripts/socket-release/cargo-publish.mts --staged --dry-run
Publish from CI: the operator dispatches the cargo publish workflow
from the Actions UI with publish: true (gh workflow run is
guard-blocked for agents - the human clicks). The workflow runs
--direct under the cargo-publish environment with the OIDC-minted
token; a dry-run dispatch runs --staged --dry-run ungated.
Index propagation: the publish is not "done" until the version appears
in the crates.io index - the engine's registry gate polls
https://index.crates.io/<path> and the tag/release cut waits for it
(ORDER RULE: the GitHub release follows index resolvability, never
precedes it). Do not retry a publish that is merely propagating.
The tag + immutable release cut follows automatically; a gap heals with
node scripts/socket-release/github-release.mts --tag vX.Y.Z --release.
node scripts/socket-release/cargo-publish.mts --direct publishes from the
operator's machine with their own cargo login token - 2FA/auth is theirs
to provide (gate, never scripted). --approve promotes a staged cargo
entry where the staged lane is available; --package <name> disambiguates
a workspace (multi-crate ordering is deferred - the tool refuses ambiguity
rather than guessing).
cargo yank --version X.Y.Z # from the crate root, operator auth
cargo yank --version X.Y.Z --undo
Yank never deletes bytes - existing lockfiles keep resolving; new resolutions skip the version. Ship the fixed version immediately after, and deprecate nothing (crates.io has no deprecate).