feat(xtask): Make release pickup Cargo creds. (#164)

Previously, `cargo-release` being run in the sub-shell wasn't picking
up Cargo's authentication information, even if you'd previously run
'cargo login' to authenticate with the Crates.io registry. This commit
is intended to fix that by manually extracting the saved token from
Cargo's credentials file and passing it into the subshell using an
environment variable.

With how `xshell` works, this environment variable won't be logged
anywhere, so it's safe to pass the authentication token this way.

Signed-off-by: Andrew Lilley Brinker <alilleybrinker@gmail.com>

Author: alilleybrinker

xtask/Cargo.toml

@@ -17,5 +17,7 @@ env_logger = "0.11.2"
 log = "0.4.20"
 pathbuf = "1.0.0"
 semver = "1.0.22"
+serde = { version = "1.0.197", features = ["derive"] }
+toml = "0.8.10"
 which = "6.0.0"
 xshell = "0.2.5"

xtask/src/release.rs

@@ -10,7 +10,9 @@ use cargo_metadata::{Metadata, MetadataCommand, Package};
 use clap::ArgMatches;
 use pathbuf::pathbuf;
 use semver::Version;
-use std::{ops::Not as _, path::PathBuf};
+use serde::Deserialize;
+use std::{env::var as env_var, ops::Not as _, path::PathBuf};
+use toml::from_str as from_toml_str;
 use xshell::{cmd, Shell};
 
 /// Run the release command.
@@ -346,8 +348,19 @@ impl Step for ReleaseCrate {
         let krate = self.krate.name();
         let bump = self.bump.to_string();
 
-        let possible_args = ["--execute", "--no-confirm"];
-        let execute = self.execute.then_some(&possible_args[..]).unwrap_or(&[]);
+        let execute = if self.execute {
+            &["--execute", "--no-confirm"][..]
+        } else {
+            &[]
+        };
+
+        // Set the Cargo registry auth token in the shell environment.
+        let _env = {
+            let creds_path = pathbuf![&env_var("CARGO_HOME")?, "credentials.toml"];
+            let raw_creds = sh.read_file(creds_path)?;
+            let creds = from_toml_str::<Credentials>(&raw_creds)?;
+            sh.push_env("CARGO_REGISTRY_TOKEN", &creds.registry.token)
+        };
 
         cmd!(
             sh,
@@ -362,3 +375,14 @@ impl Step for ReleaseCrate {
     // is enabled, then it'll run, _and_ we won't need to force-rollback at the end
     // because that requires `execute == false`. So either way, no undo is required.
 }
+
+/// Simple struct representing the Cargo credentials file.
+#[derive(Debug, Deserialize)]
+struct Credentials {
+    registry: CredentialsRegistry,
+}
+
+#[derive(Debug, Deserialize)]
+struct CredentialsRegistry {
+    token: String,
+}