From 77b15df9907123359b98d0c9e0b313d8a236bc52 Mon Sep 17 00:00:00 2001 From: Ralf Anton Beier Date: Mon, 25 May 2026 07:45:18 +0200 Subject: [PATCH] fix(release): drop chicken-and-egg verify step from publish workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The 'Verify all crates can publish' step runs `cargo publish --dry-run -p ` for every workspace crate before any have been published. cargo's dry-run resolves dependencies through the public crates.io index — so the moment a dependent workspace crate is asked to dry-run, it requires every synth-* dep to already exist on crates.io at the new version. For v0.7.0 (or any first publish of a new version), that's impossible: synth-opt needs synth-cfg ^0.7.0, synth-frontend needs synth-core ^0.7.0, etc., and the registry has none of them at the new version yet. This blocked publish-to-crates-io.yml on v0.7.0 entirely — verify failed, the actual publish step never ran. The `./publish publish` helper already has a 10-attempt retry loop with 40s sleeps specifically to ride out crates.io index propagation as each leaf publishes, so the verify step is functionally redundant. `cargo publish` (without --dry-run) also performs the full metadata validation before uploading, so we don't lose the safety check by removing the pre-flight. After this lands, re-run publish-to-crates-io.yml via workflow_dispatch on the v0.7.0 tag to publish the workspace to crates.io. Recoverable variant: change `./publish verify` to use `cargo package -p` (which uses path deps and doesn't hit the registry) if a fail-fast metadata check is wanted. Tracked as a follow-up but not blocking v0.7.0. --- .github/workflows/publish-to-crates-io.yml | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/.github/workflows/publish-to-crates-io.yml b/.github/workflows/publish-to-crates-io.yml index 8a51aca..fcba757 100644 --- a/.github/workflows/publish-to-crates-io.yml +++ b/.github/workflows/publish-to-crates-io.yml @@ -82,11 +82,17 @@ jobs: - name: Build publish helper run: rustc --edition 2024 scripts/publish.rs -o publish - - name: Verify all crates can publish - run: ./publish verify - env: - CARGO_REGISTRY_TOKEN: ${{ secrets.CRATES_IO_TOKEN }} - + # NOTE: the historical `./publish verify` step was removed in v0.7.0 + # because `cargo publish --dry-run -p ` resolves dependencies + # through the public crates.io index — so dependent workspace crates + # always fail until their synth-* deps are already on the registry + # at the new version (chicken-and-egg for any first publish of a new + # version). The actual `cargo publish` performs the same metadata + # validation before upload, and `./publish publish` has a 10-attempt + # retry loop with a 40s sleep that rides out registry index + # propagation. The verify step is recoverable as `cargo package` + # (which uses path deps) if a fail-fast metadata check is needed — + # tracked as a follow-up. - name: Publish workspace to crates.io run: ./publish publish env: