Skip to content

Harden crates.io release publishing #49

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pproenca merged 1 commit into from
Jul 8, 2026
Merged

Harden crates.io release publishing #49

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 21 additions & 10 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -586,19 +586,30 @@ jobs:
"$@"
}

for crate in \
agent-tui-common \
agent-tui-domain \
agent-tui-usecases \
agent-tui-adapters \
agent-tui-infra \
agent-tui-app \
crates=(
agent-tui-common
agent-tui-domain
agent-tui-usecases
agent-tui-adapters
agent-tui-infra
agent-tui-app
agent-tui
do
)

preexisting_crates=()
for crate in "${crates[@]}"; do
if crate_published "$crate"; then

@8090-software-factory 8090-software-factory Bot Jul 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Drift Bot (agent-tui) — Blueprint: Installation and Distribution

The blueprint specifies that the ReleasePackager is responsible for building and assembling release artifacts, but it does not document the safety requirement that the release workflow must abort if target crate versions already exist on crates.io to prevent dependency confusion.

echo "$crate@$VERSION already published."
continue
preexisting_crates+=("$crate@$VERSION")
fi
done

if [ "${#preexisting_crates[@]}" -gt 0 ]; then
printf '::error::Refusing to publish because these crate versions already exist on crates.io: %s\n' "${preexisting_crates[*]}"
echo "Verify ownership and contents manually, then publish a new version instead of trusting preexisting internal crates."
exit 1
fi

for crate in "${crates[@]}"; do
retry cargo publish -p "$crate" --allow-dirty
done

Expand Down
2 changes: 2 additions & 0 deletions cli/crates/xtask/src/main_tests.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -655,6 +655,8 @@ fn release_workflow_publishes_and_smokes_crates_io_and_source_install() -> Resul
for needle in [
"publish-crates:",
"release-channels verify-crates-io-publish-plan",
"preexisting_crates=()",
"Refusing to publish because these crate versions already exist on crates.io",
"cargo publish -p \"$crate\" --allow-dirty",
"--channel crates-io",
"--channel source-install",
Expand Down
Loading