chore(release): v0.11.50 — #382 large load/store offset + #378/#381 h… #61
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Publishes the synth workspace to crates.io on every `v*` tag push, | |
| # in parallel with release.yml (binaries + provenance + cosign). | |
| # | |
| # Trust model: an org-wide CRATES_IO_TOKEN secret (set at the | |
| # pulseengine GitHub organization, inherited by this repo). | |
| # Cargo reads it from `CARGO_REGISTRY_TOKEN`. We considered OIDC | |
| # trusted publishing (matches sigil) but chose the simpler token | |
| # path because the org secret already exists and OIDC requires | |
| # per-crate trusted-publisher registration on crates.io (11 forms). | |
| # Migration to OIDC is tracked as a future-work item in | |
| # docs/release-process.md "Phase 4 — auth model". | |
| # | |
| # Mirrors pulseengine/sigil's publish-to-crates-io.yml plus a Rust | |
| # helper script (scripts/publish.rs) that walks the dependency order. | |
| name: Publish to crates.io | |
| concurrency: | |
| group: publish-${{ github.ref }} | |
| cancel-in-progress: false | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: "Existing tag whose workspace state should be (re)published (e.g. v0.6.0)" | |
| required: true | |
| type: string | |
| permissions: | |
| contents: read | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| publish: | |
| name: Publish workspace | |
| if: github.repository == 'pulseengine/synth' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| ref: ${{ inputs.tag || github.ref }} | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| key: publish-crates-io | |
| - name: Verify tag matches workspace version | |
| env: | |
| INPUT_TAG: ${{ inputs.tag }} | |
| run: | | |
| set -euo pipefail | |
| VERSION="${INPUT_TAG:-${GITHUB_REF#refs/tags/}}" | |
| EXPECTED="${VERSION#v}" | |
| ACTUAL=$( | |
| awk ' | |
| /^\[workspace.package\]/ { in_pkg = 1; next } | |
| /^\[/ { in_pkg = 0 } | |
| in_pkg && /^version *=/ { | |
| gsub(/[ \t"]/, "", $0) | |
| sub(/version=/, "", $0) | |
| exit | |
| } | |
| ' Cargo.toml | |
| ) | |
| if [ "$EXPECTED" != "$ACTUAL" ]; then | |
| echo "::error::tag $VERSION expects workspace version $EXPECTED but Cargo.toml has $ACTUAL" | |
| exit 1 | |
| fi | |
| echo "::notice::tag $VERSION matches workspace version $ACTUAL" | |
| - name: Build publish helper | |
| run: rustc --edition 2024 scripts/publish.rs -o publish | |
| # NOTE: there is intentionally NO pre-flight `./publish verify` step. | |
| # Both `cargo publish --dry-run` AND `cargo package` resolve the path-dep | |
| # *version requirements* (`synth-core = "^0.11.x"`) against the crates.io | |
| # index when preparing the upload, so a dependent crate fails with | |
| # "failed to select a version for synth-core = ^0.11.x" on the FIRST | |
| # publish of any new version (the deps aren't on the registry yet). This | |
| # is the same chicken-and-egg that sank the v0.7.0 verify step (dropped in | |
| # #144). #146 proposed `cargo package` to avoid it, but it does NOT — it | |
| # only passes when the version is already published. Re-tracked in #146. | |
| # Compile errors are already caught by the CI test/build (path deps, no | |
| # chicken-and-egg); `./publish publish` below validates each crate's | |
| # metadata as cargo's own pre-upload check, with a 10-attempt retry loop | |
| # (40s sleep) that rides out registry index propagation between deps. | |
| - name: Publish workspace to crates.io | |
| run: ./publish publish | |
| env: | |
| CARGO_REGISTRY_TOKEN: ${{ secrets.CRATES_IO_TOKEN }} |