Migrate to ATRAPS LLC: copyright, CI lint scope, trusted publishing - #1
Merged
Conversation
Record ATRAPS LLC as copyright holder following the executed IP assignment. The Apache-2.0 appendix was never filled in — it still carried the literal "[yyyy] [name of copyright owner]" placeholder, so nothing in this repo stated who owned it. - LICENSE: appendix now reads "Copyright 2026 ATRAPS LLC" - NOTICE: added, per Apache-2.0 section 4(d) attribution channel - Cargo.toml: drop deprecated `authors`; point `repository` at the org - README: name the holder in the license section
`cargo clippy -- -D warnings` lints the lib target only, so lint failures anywhere else — examples, benches, integration tests — are never gated. Lint `--all-targets --all-features` instead. This crate is already clean under the wider invocation; the change is to keep it that way.
Replace the long-lived CARGO_REGISTRY_TOKEN repo secret with a short-lived OIDC token minted per run by crates-io-auth-action and revoked when the job ends. Also gate the job on the release commit being contained in main: a release can be cut from any commit, including one that never landed on main, so the `release: published` trigger alone does not imply it.
`cargo update` within existing constraints. No direct dependency changed version — goblin, tracing, and proptest were already at their latest releases. Several transitive packages moved and a number dropped out of the graph entirely.
0.3.0 is already published and its metadata is immutable, so the filled copyright appendix, dropped `authors` field, and organisation repository URL only reach crates.io in a new version. Also repoints the CHANGELOG compare links at the org and refreshes the [Unreleased] link, which still compared against v0.2.1.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Migration of this crate to ATRAPS LLC ownership, per TRANSFER.md. Last of the baseline-shaped repos.
chore: assign copyright— the Apache-2.0 appendix was never filled in; it still carried the literal[yyyy] [name of copyright owner]placeholder, so nothing in this repo stated who owned it. NowCopyright 2026 ATRAPS LLC.NOTICEadded;authorsdropped;repositoryrepointed at the org; README names the holder.ci: lint all targets—cargo clippy -- -D warningslints the lib target only, so lint failures anywhere else are never gated. Now--all-targets --all-features. This crate is already clean under the wider invocation; the change keeps it that way.ci: trusted publishing— a short-lived OIDC token bound to this repo and workflow replaces the storedCARGO_REGISTRY_TOKEN, and the job refuses to publish a release whose commit is not contained inmain.build:—cargo update; no direct dependency changed version. Several transitive packages moved and a number dropped out of the graph.chore: release 0.3.1— 0.3.0 is published and immutable, so the filled appendix and corrected metadata only reach crates.io in a new version. Also repoints the CHANGELOG compare links at the org and refreshes the[Unreleased]link, which still compared against v0.2.1.Verified locally: tests pass, clippy clean under
--all-targets --all-features, rustdoc clean under-D warnings, fmt clean,cargo packageshipsLICENSE,NOTICE,CHANGELOG.md. No lint suppressions in library code.Also deleted a stale local
masterbranch, fully contained inmain.