Skip to content

publish-dry-run: per-crate tags, dependency-liveness gate, contents listing - #54

Merged
gronke merged 1 commit into
mainfrom
publish-dry-run/per-crate-gates
Aug 23, 2026
Merged

publish-dry-run: per-crate tags, dependency-liveness gate, contents listing#54
gronke merged 1 commit into
mainfrom
publish-dry-run/per-crate-gates

Conversation

@gronke

@gronke gronke commented Aug 23, 2026

Copy link
Copy Markdown
Owner

Enables per-crate release gating for multi-crate workspaces (one workflow run per crate, tagged <package>-vX.Y.Z).

What changes

  • Tag derivation: the expected version also derives from <package>-vX.Y.Z tags (checked before the bare v* form), so a workspace's release workflow stops hand-pinning versions per crate.
  • require-deps-published input (default off): probes every workspace path dependency of the selected package on crates.io at the version the manifest requires, and fails with a named error ('release first, then re-tag ') when it is not live.
    The packaging resolution still gates when the probe is inconclusive.
  • Registry warm-up for the sealed verify: prep now builds the .crate (cargo package --no-verify) and fetches against its packaged lockfile.
    The workspace fetch resolves path members from the tree, so a co-developed dependency's registry copy was never in the cache and the sealed --offline verify-build failed even for a correctly ordered release; the scratch copy gets an empty [workspace] table so cargo does not walk up into the real workspace.
  • Contents listing: the sealed step runs cargo package --list before the verify-build, so the exact shipped file set is visible in the log.

…isting

Multi-crate workspaces release one crate per tag: the expected version now also derives from <package>-vX.Y.Z tags, so callers stop hand-pinning versions in their workflows.
The new require-deps-published input probes every workspace path dependency of the selected package on crates.io and fails with a named error when the required version is not live, so an out-of-order tag reads as 'release <dep> first' instead of a resolution failure.
Prep now builds the .crate itself (no verify build) and fetches against its packaged lockfile: the workspace fetch resolves path members from the tree, so the registry copy a sealed --offline verify must resolve was never in the cache, and the verify-build failed even for a correctly ordered release.
The sealed step lists the package contents (cargo package --list) before building, so the exact shipped file set is in the log.
@gronke
gronke merged commit d7a0c75 into main Aug 23, 2026
20 checks passed
@gronke
gronke deleted the publish-dry-run/per-crate-gates branch August 23, 2026 10:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant