start-command 0.37.2 → 0.37.3

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # start-command
 
+## 0.37.3
+
+### Patch Changes
+
+- CI/CD: publish start-command to crates.io through trusted publishing (OIDC, `rust-lang/crates-io-auth-action`) instead of the long-lived `CARGO_TOKEN` / `CARGO_REGISTRY_TOKEN` secrets.
+
+  CI/CD: pass the crates.io token through CARGO_REGISTRY_TOKEN instead of the deprecated `cargo publish --token` flag, and pin GitHub runner images (ubuntu-24.04, macos-15, windows-2025).
+
 ## 0.37.2
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "start-command",
-  "version": "0.37.2",
+  "version": "0.37.3",
   "description": "Gamification of coding, execute any command with ability to auto-report issues on GitHub",
   "main": "src/bin/cli.js",
   "exports": {

package/test/publish-to-crates.mjs

@@ -34,6 +34,7 @@ function createFakeCargoBin(tempDir) {
     `
 const fs = require('node:fs');
 fs.writeFileSync(process.env.FAKE_CARGO_ARGS_PATH, JSON.stringify(process.argv.slice(2)));
+fs.writeFileSync(process.env.FAKE_CARGO_ARGS_PATH + '.token', process.env.CARGO_REGISTRY_TOKEN || '');
 process.exit(Number(process.env.FAKE_CARGO_EXIT || 0));
 `
   );
@@ -183,9 +184,12 @@ describe('publish-to-crates script', () => {
           '--allow-dirty',
           '--manifest-path',
           join(packageDir, 'Cargo.toml'),
-          '--token',
-          'test-token',
         ]);
+        // The deprecated `cargo publish --token` flag must not be used;
+        // the token is passed through Cargo's native environment variable.
+        expect(readFileSync(`${cargoArgsPath}.token`, 'utf8')).toBe(
+          'test-token'
+        );
       } finally {
         rmSync(tempDir, { force: true, recursive: true });
       }