Reusable GitHub Actions workflows shared across the manic-systems organization. This lets us reuse the same workflow code with optional parameters to fine-grain their behaviour.

The caller always owns the matrix in plain YAML as GitHub forbids array inputs to reusable workflows. Callers invoke these once per matrix leg.

Runs nix flake check by default; toggle test / clippy / fmt for repos that want additional cargo-driven checks. Rust toolchain is installed only when any cargo step is enabled.

name: Build and Test with Cargo # rust-release.yml gates on this name

on:
    push:
        branches: [main]
    pull_request:

jobs:
    checks:
        strategy:
            fail-fast: false
            matrix:
                os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest]
        uses: manic-systems/workflows/.github/workflows/rust-checks.yml@main
        with:
            os: ${{ matrix.os }}
            # flake-check is on by default; opt in to cargo checks as needed:
            # test: true
            # clippy: true
            # fmt: true

Builds a project with Nix on one runner. Dual-use: upload: false (default) is the release-build CI check; upload: true attests provenance and uploads the binary as a release asset.

rust-build.yml declares no permissions of its own, so it inherits the caller's token. upload: true requires the caller to grant contents / id-token / attestations write; the CI usage above needs none.

The tag/create-release and notes/checksums bookkeeping, selected by a stage input and invoked twice around the build matrix (a reusable workflow is a single invocation — it can't straddle the caller's matrix). The caller wires prepare → build → finalize:

name: Tag and Release

on:
    workflow_dispatch:
    workflow_run:
        workflows: [Build and Test with Cargo] # the CI workflow above
        types: [completed]
        branches: [main]

permissions:
    contents: write # create the release / push the tag
    id-token: write # build provenance attestations
    attestations: write # build provenance attestations

jobs:
    prepare:
        if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}
        uses: manic-systems/workflows/.github/workflows/rust-release.yml@main
        with:
            stage: prepare

    build:
        needs: prepare
        if: ${{ needs.prepare.result == 'success' && needs.prepare.outputs.skip != 'true' }}
        strategy:
            fail-fast: false
            matrix:
                include:
                    - { os: ubuntu-latest, suffix: linux-amd64 }
                    - { os: ubuntu-24.04-arm, suffix: linux-arm64 }
                    - { os: macos-latest, suffix: macos-arm64 }
        uses: manic-systems/workflows/.github/workflows/rust-build.yml@main
        with:
            upload: true
            version: ${{ needs.prepare.outputs.version }}
            os: ${{ matrix.os }}
            suffix: ${{ matrix.suffix }}

    finalize:
        needs: [prepare, build]
        if: ${{ needs.prepare.outputs.skip != 'true' && needs.build.result == 'success' }}
        uses: manic-systems/workflows/.github/workflows/rust-release.yml@main
        with:
            stage: finalize
            version: ${{ needs.prepare.outputs.version }}

See examples/ for both caller files with overrides annotated. Pin to a tag (e.g. @v1) once this repo is tagged for reproducible releases.

Outputs (prepare stage): version (the tag), skip (true when the version is unchanged).

The publish stage ships the crate to crates.io using Trusted Publishing. Under this setup, GitHub's OIDC identity is exchanged for a short-lived registry token via rust-lang/crates-io-auth-action, so no CARGO_REGISTRY_TOKEN secret is stored.

One-time setup (per crate):

1. Publish the crate manually once (cargo publish). https://crates.io only lets you add a Trusted Publisher to an existing crate.
2. On crates.io go to the crate's Settings -> Trusted Publishing and add a GitHub publisher: owner, repository, the release workflow filename (e.g. release.yml), and optionally an environment name. If you set one, pass the same value as publish-environment.

The publish job declares id-token: write itself, but a reusable workflow can't grant a permission the caller withheld. The caller's release workflow must also grant id-token: write (the example already does). Wire it after finalize:

publish:
    needs: [prepare, finalize]
    if: ${{ needs.prepare.outputs.skip != 'true' && needs.finalize.result == 'success' }}
    uses: manic-systems/workflows/.github/workflows/rust-release.yml@main
    with:
        stage: publish
        version: ${{ needs.prepare.outputs.version }}
        # publish-environment: release   # set if the Trusted Publisher config uses one
        # publish-command: cargo publish -p my-crate   # e.g. a specific workspace member

• build-command, version-command, and the *-command inputs are run verbatim in the consuming repo's job. Treat them as trusted. Only set them from workflows you control.
• stage is validated. A value other than prepare, finalize, or publish fails rather than succeeding with every release job skipped.
• Build provenance attestations are free for public repositories. Verify an asset with gh attestation verify <file> --repo <owner>/<repo>.
• cachix/install-nix-action is pinned to a floating major tag (@v31) so consumers pinning this repo to @v1 don't float on the action's master.
• crates.io Trusted Publishing currently supports GitHub Actions only, and the publish job runs on ubuntu-latest. Publishing is host-independent.
• If you override binary-name/asset-prefix, set them on both build and finalize so the checksum step finds the right assets.
• Builds are native per runner. There is no cross-compilation. linux-arm64 uses GitHub's native ubuntu-24.04-arm runner.
• finalize only runs when every build leg succeeds (fail-fast: false lets the others finish, but a failed target blocks notes/checksums).