feat(stack-kms): ZeroKMS as a vitaminc key provider (CIP-3965)

.github/workflows/tests-crates.yml

@@ -153,8 +153,36 @@ jobs:
       # `--allow-dirty` tolerates files earlier steps leave in the tree. Once a
       # version is on crates.io, cargo warns rather than fails on a dry run of
       # it.
+      #
+      # A crate with a git dependency outside its dev-dependencies cannot be
+      # published: cargo refuses to package it, and with a `version` beside the
+      # `git` it would build against crates.io's crate of that name, not the
+      # pinned rev. stack-kms pins vitaminc-kms to a git rev until vitaminc
+      # releases its key-provider traits (cipherstash/vitaminc#352). Such a
+      # crate is skipped here with a WARNING, as `test-eql.yml` does for a
+      # stack-encrypt not yet on crates.io: the PR cannot ship it, and
+      # release-crates fails loudly if a version bump tries. Every other crate
+      # in the list is still verified.
       - name: Verify the stack-* crates package cleanly for crates.io
-        run: cargo publish --locked --dry-run --allow-dirty -p stack-profile -p stack-auth -p stack-kms -p stack-encrypt-derive -p stack-encrypt
+        run: |
+          crates=(stack-profile stack-auth stack-kms stack-encrypt-derive stack-encrypt)
+          git_pinned=$(cargo metadata --locked --no-deps --format-version 1 | jq -r '
+            .packages[]
+            | select(any(.dependencies[]; .kind != "dev" and ((.source // "") | startswith("git+"))))
+            | .name')
+          args=()
+          for crate in "${crates[@]}"; do
+            if grep -qx "$crate" <<<"$git_pinned"; then
+              echo "::warning title=${crate} cannot be published::${crate} has a git dependency, so cargo cannot package it. The dry run skips it until that dependency is on crates.io."
+            else
+              args+=(-p "$crate")
+            fi
+          done
+          if [ "${#args[@]}" -eq 0 ]; then
+            echo "Every crate in the list has a git dependency; nothing to verify."
+            exit 0
+          fi
+          cargo publish --locked --dry-run --allow-dirty "${args[@]}"
 
   node-bindings:
     name: node bindings, napi typings, stack-auth-wasm