From e7bed56ada39cabfdc557bd01e443318dc6d7d89 Mon Sep 17 00:00:00 2001 From: Justin Kovacich Date: Mon, 29 Jun 2026 18:08:22 -0400 Subject: [PATCH 1/5] build(release): migrate from release-plz to cargo-release Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/release-plz.yml | 41 --------------------------- .github/workflows/release.yml | 42 ++++++++++++++++++++++++++++ release-plz.toml | 11 -------- release.toml | 8 ++++++ simple-someip-embassy-net/Cargo.toml | 1 + 5 files changed, 51 insertions(+), 52 deletions(-) delete mode 100644 .github/workflows/release-plz.yml create mode 100644 .github/workflows/release.yml delete mode 100644 release-plz.toml create mode 100644 release.toml diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml deleted file mode 100644 index bd237de1..00000000 --- a/.github/workflows/release-plz.yml +++ /dev/null @@ -1,41 +0,0 @@ -name: Release-plz - -on: - push: - branches: - - main - -jobs: - release-plz-pr: - name: Release PR - runs-on: ubuntu-latest - permissions: - contents: write - pull-requests: write - steps: - - uses: actions/checkout@v6 - with: - fetch-depth: 0 - - uses: dtolnay/rust-toolchain@stable - - uses: MarcoIeni/release-plz-action@v0.5 - with: - command: release-pr - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - release-plz-release: - name: Release - runs-on: ubuntu-latest - permissions: - contents: write - steps: - - uses: actions/checkout@v6 - with: - fetch-depth: 0 - - uses: dtolnay/rust-toolchain@stable - - uses: MarcoIeni/release-plz-action@v0.5 - with: - command: release - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 00000000..3f3e66ec --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,42 @@ +name: Release + +on: + push: + tags: ["v*"] + pull_request: + types: [opened, synchronize, reopened] + +permissions: + contents: write + +jobs: + semver-checks: + name: Semver Checks + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v6 + with: + fetch-depth: 0 + - uses: dtolnay/rust-toolchain@stable + - uses: Swatinem/rust-cache@v2 + - uses: obi1kenobi/cargo-semver-checks-action@v2 + with: + package: simple-someip + + publish: + name: Publish to crates.io + needs: semver-checks + # GATED: enable by setting repo variable SIMPLE_SOMEIP_PUBLISH_ENABLED=true + # once the publish proxy is live and CARGO_REGISTRY_TOKEN exists in secrets. + if: github.event_name == 'push' && vars.SIMPLE_SOMEIP_PUBLISH_ENABLED == 'true' + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v6 + with: + fetch-depth: 0 + - uses: dtolnay/rust-toolchain@stable + - uses: Swatinem/rust-cache@v2 + - run: cargo install cargo-release --version '^0.25' --locked + - run: cargo release publish --workspace --no-confirm --execute + env: + CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} diff --git a/release-plz.toml b/release-plz.toml deleted file mode 100644 index 6c3b022e..00000000 --- a/release-plz.toml +++ /dev/null @@ -1,11 +0,0 @@ -[workspace] -changelog_update = true -git_tag_name = "v{{ version }}" -git_release_enable = true -publish = true -pr_draft = true - -[[package]] -name = "discovery_client" -release = false -publish = false diff --git a/release.toml b/release.toml new file mode 100644 index 00000000..cbd44afe --- /dev/null +++ b/release.toml @@ -0,0 +1,8 @@ +shared-version = false +publish = false +registry = "crates-io" +tag-name = "v{{version}}" +tag-message = "simple-someip v{{version}}" +pre-release-commit-message = "chore(release): v{{version}}" +allow-branch = ["main"] +pre-release-hook = ["cargo", "test", "--workspace", "--locked"] diff --git a/simple-someip-embassy-net/Cargo.toml b/simple-someip-embassy-net/Cargo.toml index 6d9fb8a6..73f771bc 100644 --- a/simple-someip-embassy-net/Cargo.toml +++ b/simple-someip-embassy-net/Cargo.toml @@ -6,6 +6,7 @@ license = "MIT OR Apache-2.0" description = "embassy-net `TransportFactory` / `TransportSocket` adapter for the simple-someip crate" repository = "https://github.com/luminartech/simple_someip" readme = "README.md" +publish = false # This crate is the reference no_std backend for `simple-someip`'s # trait surface. It depends on `simple-someip` with From 2b39669e7da28ed9dea2b81d9216ba236eaf83be Mon Sep 17 00:00:00 2001 From: Justin Kovacich Date: Tue, 30 Jun 2026 04:32:50 -0400 Subject: [PATCH 2/5] ci: allow publish from detached HEAD on tag push (--allow-branch '*') --- .github/workflows/release.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3f3e66ec..0dd19ca4 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -37,6 +37,9 @@ jobs: - uses: dtolnay/rust-toolchain@stable - uses: Swatinem/rust-cache@v2 - run: cargo install cargo-release --version '^0.25' --locked - - run: cargo release publish --workspace --no-confirm --execute + # --allow-branch '*': a tag-push CI run is in detached-HEAD state, which + # cargo-release's branch check would otherwise reject. Publishing is + # already gated by the job `if:` above; this only relaxes the ref check. + - run: cargo release publish --workspace --allow-branch '*' --no-confirm --execute env: CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} From 02b892e45945f47a1795bad4e312c0a96942a527 Mon Sep 17 00:00:00 2001 From: Justin Kovacich Date: Tue, 30 Jun 2026 14:05:33 -0400 Subject: [PATCH 3/5] ci(release): scope semver to host features + publish only simple-someip MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two fixes to the new Release workflow: 1. Semver Checks failed because the action's default `all-features` group unions `bare-metal-runtime` (no-alloc, nightly) with the alloc features, tripping the mutual-exclusion `compile_error!` in lib.rs so rustdoc — and thus the whole check — aborts. Mirror ci.yml's SemVer Check: pin `feature-group: only-explicit-features` to the host/alloc feature set. 2. `cargo release publish --workspace` does NOT honor the `publish = false` manifest flags on the examples / embassy-net member (verified via dry-run: it plans to publish all 7 members); `cargo publish` then rejects the non-publishable ones. Scope to `--package simple-someip`. Also document in release.toml that only simple-someip is released, which makes the single `v{version}` tag/message unambiguous under `shared-version = false`. Addresses both Copilot review threads on #141. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/release.yml | 15 ++++++++++++++- release.toml | 7 +++++++ 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0dd19ca4..44d73202 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,9 +19,17 @@ jobs: fetch-depth: 0 - uses: dtolnay/rust-toolchain@stable - uses: Swatinem/rust-cache@v2 + # Scope to the alloc/host feature set, matching ci.yml's SemVer Check. + # The action's default `all-features` group unions `bare-metal-runtime` + # (no-alloc, nightly) with the alloc features, which trips the + # mutual-exclusion `compile_error!` in lib.rs — rustdoc fails to build + # and the whole check aborts. The host API is what we semver-gate; the + # bare-metal lane is nightly-only and checked elsewhere. - uses: obi1kenobi/cargo-semver-checks-action@v2 with: package: simple-someip + feature-group: only-explicit-features + features: std,tracing,client,client-tokio,server,server-tokio,bare_metal,embassy_channels publish: name: Publish to crates.io @@ -37,9 +45,14 @@ jobs: - uses: dtolnay/rust-toolchain@stable - uses: Swatinem/rust-cache@v2 - run: cargo install cargo-release --version '^0.25' --locked + # --package simple-someip (NOT --workspace): `cargo release publish` is + # the explicit publish subcommand and does NOT honor the `publish = false` + # manifest flags on the examples / embassy-net member — `--workspace` + # makes it attempt to publish all 7 members and `cargo publish` then + # rejects the non-publishable ones. Only `simple-someip` is published. # --allow-branch '*': a tag-push CI run is in detached-HEAD state, which # cargo-release's branch check would otherwise reject. Publishing is # already gated by the job `if:` above; this only relaxes the ref check. - - run: cargo release publish --workspace --allow-branch '*' --no-confirm --execute + - run: cargo release publish --package simple-someip --allow-branch '*' --no-confirm --execute env: CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} diff --git a/release.toml b/release.toml index cbd44afe..c11b4e28 100644 --- a/release.toml +++ b/release.toml @@ -1,4 +1,11 @@ +# Only `simple-someip` is ever released from this workspace. The examples and +# `simple-someip-embassy-net` carry `publish = false` in their own manifests, +# and CI publishes with `cargo release publish --package simple-someip` (see +# .github/workflows/release.yml) — so `tag-name`/`tag-message` are unambiguous +# and `shared-version = false` is safe (no second crate to collide tags with). shared-version = false +# Disables auto-publish in the `cargo release ` bump+tag flow; the +# actual publish is the deliberate, gated `cargo release publish` step in CI. publish = false registry = "crates-io" tag-name = "v{{version}}" From aaf660a1d92653c75661c62f30027dfce682911f Mon Sep 17 00:00:00 2001 From: Justin Kovacich Date: Tue, 30 Jun 2026 14:44:00 -0400 Subject: [PATCH 4/5] ci(release): tag-push-only trigger + least-privilege token - Drop the `pull_request` trigger: the PR-time semver gate duplicates `CI / SemVer Check` (ci.yml) with the same action and feature set. This workflow's semver-checks job is the publish gate, so it only needs to run on release-tag pushes. - Narrow `permissions` to `contents: read`: no job creates tags/releases or pushes; publish uses CARGO_REGISTRY_TOKEN, not the GITHUB_TOKEN. Addresses the two Copilot review threads on #141. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/release.yml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 44d73202..7af698bc 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,13 +1,17 @@ name: Release +# Tag-push only. Semver gating on PRs is already covered by +# `CI / SemVer Check` in ci.yml (same action + feature set); this workflow's +# job is the publish gate, so it only needs to run when a release tag lands. on: push: tags: ["v*"] - pull_request: - types: [opened, synchronize, reopened] +# Read-only: no job creates tags/releases or pushes to the repo. semver-checks +# only reads the tree; publish pushes to crates.io via CARGO_REGISTRY_TOKEN, +# not the GITHUB_TOKEN. permissions: - contents: write + contents: read jobs: semver-checks: From b005bf86455aa337b284e72c4113460ca73570e0 Mon Sep 17 00:00:00 2001 From: Justin Kovacich Date: Mon, 13 Jul 2026 10:44:30 -0400 Subject: [PATCH 5/5] docs(release): refresh publish-gate comment Drop the stale "once the publish proxy is live" precondition. Publishing to crates.io needs only CARGO_REGISTRY_TOKEN + crates.io reachability; the Kellnr crates.io proxy fronts crates.io for dft-side consumption of the published crate, a separate concern. The real gate is the token + the decision to cut a first version. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/release.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7af698bc..013bdd21 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -39,7 +39,10 @@ jobs: name: Publish to crates.io needs: semver-checks # GATED: enable by setting repo variable SIMPLE_SOMEIP_PUBLISH_ENABLED=true - # once the publish proxy is live and CARGO_REGISTRY_TOKEN exists in secrets. + # once CARGO_REGISTRY_TOKEN exists in secrets and the team decides to cut a + # first version. Publishing goes to crates.io and needs only the token + + # crates.io reachability — not the Kellnr proxy (that fronts crates.io for + # dft-side consumption of the published crate, a separate concern). if: github.event_name == 'push' && vars.SIMPLE_SOMEIP_PUBLISH_ENABLED == 'true' runs-on: ubuntu-latest steps: