mirror of
https://github.com/coralogix/cx-cli.git
synced 2026-09-14 16:15:45 +08:00
hayaa
f04d7677cb
## Context The crates.io publish job currently authenticates with a long-lived `CARGO_REGISTRY_TOKEN` GitHub secret. That token can expire or leak, and it is the only thing blocking `cargo publish` on tagged releases. This change switches the release workflow to crates.io trusted publishing (OIDC), so CI mints a short-lived publish token instead of storing a permanent API key. ## Linked Issues N/A — follow-up to rotating/replacing an expired crates.io API token; no Linear ticket. ## Design On a tagged release, `publish-crate` still runs after the GitHub Release job. Before `cargo publish`, it calls `rust-lang/crates-io-auth-action`, which exchanges the GitHub Actions OIDC identity for a ~30-minute crates.io token. `cargo publish` continues to read `CARGO_REGISTRY_TOKEN`; the value now comes from the action output. crates.io already allowlists this repo + `release.yml` as a trusted publisher, so only that workflow can mint a token. ## Key Decisions - Keep publishing in the existing `release.yml` job rather than a new workflow, because the trusted-publisher config is bound to this filename. - Pin `crates-io-auth-action` to a commit SHA (v1.0.5), matching other actions in this file. - Leave the top-level `id-token: write` permission in place (cosign still needs it) and also set job-level `id-token: write` + `contents: read` on `publish-crate` so the OIDC exchange is explicit. - Do not enable “trusted publishing only” or delete the GitHub secret in this PR; those happen after one successful publish. ## Changes - `publish-crate` authenticates via GitHub OIDC instead of `secrets.CARGO_REGISTRY_TOKEN`. - GitHub Releases, binary artifacts, Homebrew, and the install script are unchanged. ## Testing - Workflow YAML was reviewed against the crates.io trusted-publishing docs and the current `release.yml` job shape. - No `cargo test` / clippy run: this PR only changes GitHub Actions YAML; publish cannot be exercised until the next `v*` tag (or a manual Release workflow dispatch). ## Risks & Rollout - If the crates.io trusted-publisher fields do not match (`coralogix` / `cx-cli` / `release.yml`, empty environment), the **Publish to crates.io** job will fail. GitHub Release binaries still succeed because that job runs first. - Rollback: revert this PR (or restore `CARGO_REGISTRY_TOKEN` on the job) before the next tag. Keep the GitHub secret until a trusted-publish run succeeds. ## Out of Scope / Follow-ups - Delete the `CARGO_REGISTRY_TOKEN` repo secret after the next successful crates.io publish. - Revoke the old crates.io API token on crates.io. - Optionally add a GitHub Environment with required reviewers; that would also require updating the trusted-publisher Environment field. Made with [Cursor](https://cursor.com)
CX - Coralogix CLI
The observability backbone for AI agents and engineering teams.
Connect your agents to live logs, traces, metrics, dashboards, and alerts so they can investigate incidents, explain what changed, and reason about production with real operational context.
What you can do
- Query any signal-logs, metrics, spans, and RUM data-with DataPrime or PromQL, and render results as tables, raw JSON, or a token-efficient format for AI agents.
- Manage the full Coralogix stack from one binary: 33 commands across 11 domains, covering alerts, cases, notifications, IAM, SLOs, dashboards, data pipeline rules, TCO policies, and more.
- Set everything up in one command-
cx initconfigures a profile and installs the agent skills in a single guided run, so there is no way to end up with a CLI your agent can't use. - Run the same command across multiple profiles or regions in a single invocation with multi-profile fan-out.
- Give your AI agent a single entry point to production observability:
cx schemadumps the entire command tree as JSON so agents can self-discover capabilities without manual documentation. - Hand agents results instead of a flooded context window: the
toonoutput format is token-efficient JSON that auto-spills to a temp file once the payload exceeds 100 KiB, returning a path. - Find the right log or span field by describing it in natural language.
- Browse the DataPrime language reference offline.
- Plug Coralogix into your AI coding agent with bundled skills for Claude Code, Cursor, Codex, and 40+ more agents.
Ready to get started? Use the Quick start guide for instant installation.
Further reading
- Quick start
- Advanced configuration
- Agent skills
- Multi-profile fan-out
- TOON output format
- Time syntax
- Architecture
- Development guide
Contributing
We welcome contributions! See CONTRIBUTING.md for the ownership model, PR review process, and step-by-step guides for adding commands and skills.
License
Apache-2.0