From 2813c3e9e8801a59c87ed51497d077169315b00e Mon Sep 17 00:00:00 2001
From: lovasoa <contact@ophir.dev>
Date: Mon, 28 Sep 2026 00:56:54 +0200
Subject: [PATCH] ci: keep publish dry runs independent of registry secrets

---
 .github/workflows/publish.yml | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index d2f66582c9..270f269757 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -13,6 +13,9 @@ on:
       - "**/Cargo.toml"
       - ".github/workflows/publish.yml"
 
+permissions:
+  contents: read
+
 jobs:
   publish:
     runs-on: ubuntu-latest
@@ -22,11 +25,11 @@ jobs:
         with:
           toolchain: stable
       - uses: Swatinem/rust-cache@65012b490220f477f20ab979e35ae732e6de4e68
+      - name: Verify workspace packaging
+        if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
+        run: cargo publish --dry-run --workspace --no-default-features --features rustls
       - name: Publish workspace
-        run: |
-          cargo publish \
-          ${{ startsWith(github.ref, 'refs/tags/v') && '--verbose' || '--dry-run' }} \
-           --workspace \
-           --token ${{ secrets.CRATES_TOKEN }} \
-           --no-default-features \
-           --features rustls
+        if: ${{ startsWith(github.ref, 'refs/tags/v') && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CRATES_TOKEN }}
+        run: cargo publish --verbose --workspace --no-default-features --features rustls