feat(publish): read token from stdin

src/bin/cargo/commands/publish.rs

@@ -1,6 +1,8 @@
 use crate::command_prelude::*;
+use std::ops::Not;
 
 use cargo::ops::{self, PublishOpts};
+use cargo_credential::Secret;
 
 pub fn cli() -> Command {
     subcommand("publish")
@@ -9,6 +11,7 @@ pub fn cli() -> Command {
         .arg_index("Registry index URL to upload the package to")
         .arg_registry("Registry to upload the package to")
         .arg(opt("token", "Token to use when uploading").value_name("TOKEN"))
+        .arg(flag("token-stdin", "Read token from stdin (unstable)").conflicts_with("token"))
         .arg(flag(
             "no-verify",
             "Don't verify the contents by building them",
@@ -45,13 +48,30 @@ pub fn exec(gctx: &mut GlobalContext, args: &ArgMatches) -> CliResult {
         .into());
     }
 
+    let token_from_cmd = args.get_one::<String>("token");
+    let should_read_token_stdin = args.flag("token-stdin");
+    if should_read_token_stdin {
+        gctx.cli_unstable().fail_if_stable_opt("--token-stdin", 0)?;
+    }
+    let token = token_from_cmd
+        .cloned()
+        .or_else(|| {
+            if should_read_token_stdin
+                && let token_from_stdin = cargo_credential::read_line().unwrap_or_default()
+                && token_from_stdin.is_empty().not()
+            {
+                Some(token_from_stdin)
+            } else {
+                None
+            }
+        })
+        .map(Secret::from);
+
     ops::publish(
         &ws,
         &PublishOpts {
             gctx,
-            token: args
-                .get_one::<String>("token")
-                .map(|s| s.to_string().into()),
+            token,
             reg_or_index,
             verify: !args.flag("no-verify"),
             allow_dirty: args.flag("allow-dirty"),

src/doc/man/cargo-publish.md

@@ -30,6 +30,7 @@ following steps:
 
 This command requires you to be authenticated with either the `--token` option
 or using {{man "cargo-login" 1}}.
+Alternatively, you can set `--token-stdin` flag and pipe the _token_ value to stdin.
 
 See [the reference](../reference/publishing.html) for more details about
 packaging and publishing.
@@ -46,6 +47,10 @@ Perform all checks without uploading.
 
 {{> options-token }}
 
+{{#option "`--token-stdin`" }}
+Read token from stdin (unstable).
+{{/option}}
+
 {{#option "`--no-verify`" }}
 Don't verify the contents by building them.
 {{/option}}

src/doc/man/generated_txt/cargo-publish.txt

@@ -26,7 +26,8 @@ DESCRIPTION
           manually. This timeout does not affect the upload.
 
        This command requires you to be authenticated with either the --token
-       option or using cargo-login(1).
+       option or using cargo-login(1). Alternatively, you can set --token-stdin
+       flag and pipe the token value to stdin.
 
        See the reference
        <https://doc.rust-lang.org/cargo/reference/publishing.html> for more
@@ -49,6 +50,9 @@ OPTIONS
            CARGO_REGISTRIES_NAME_TOKEN where NAME is the name of the registry
            in all capital letters.
 
+       --token-stdin
+           Read token from stdin (unstable).
+
        --no-verify
            Don’t verify the contents by building them.
 

src/doc/src/commands/cargo-publish.md

@@ -26,6 +26,7 @@ following steps:
 
 This command requires you to be authenticated with either the `--token` option
 or using [cargo-login(1)](cargo-login.html).
+Alternatively, you can set `--token-stdin` flag and pipe the _token_ value to stdin.
 
 See [the reference](../reference/publishing.html) for more details about
 packaging and publishing.
@@ -51,6 +52,10 @@ variables of the form <code>CARGO_REGISTRIES_NAME_TOKEN</code> where <code>NAME<
 of the registry in all capital letters.</dd>
 
 
+<dt class="option-term" id="option-cargo-publish---token-stdin"><a class="option-anchor" href="#option-cargo-publish---token-stdin"></a><code>--token-stdin</code></dt>
+<dd class="option-desc">Read token from stdin (unstable).</dd>
+
+
 <dt class="option-term" id="option-cargo-publish---no-verify"><a class="option-anchor" href="#option-cargo-publish---no-verify"></a><code>--no-verify</code></dt>
 <dd class="option-desc">Don’t verify the contents by building them.</dd>
 

src/etc/man/cargo-publish.1

@@ -39,6 +39,7 @@ manually. This timeout does not affect the upload.
 .sp
 This command requires you to be authenticated with either the \fB\-\-token\fR option
 or using \fBcargo\-login\fR(1).
+Alternatively, you can set \fB\-\-token\-stdin\fR flag and pipe the \fItoken\fR value to stdin.
 .sp
 See \fIthe reference\fR <https://doc.rust\-lang.org/cargo/reference/publishing.html> for more details about
 packaging and publishing.
@@ -63,6 +64,11 @@ variables of the form \fBCARGO_REGISTRIES_NAME_TOKEN\fR where \fBNAME\fR is the
 of the registry in all capital letters.
 .RE
 .sp
+\fB\-\-token\-stdin\fR
+.RS 4
+Read token from stdin (unstable).
+.RE
+.sp
 \fB\-\-no\-verify\fR
 .RS 4
 Don\[cq]t verify the contents by building them.