chore(release): v0.33.1 — call_indirect guards + i64 globals (#642/#6… #91
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Publishes the synth workspace to crates.io on every `v*` tag push, | |
| # in parallel with release.yml (binaries + provenance + cosign). | |
| # | |
| # Trust model: an org-wide CRATES_IO_TOKEN secret (set at the | |
| # pulseengine GitHub organization, inherited by this repo). | |
| # Cargo reads it from `CARGO_REGISTRY_TOKEN`. We considered OIDC | |
| # trusted publishing (matches sigil) but chose the simpler token | |
| # path because the org secret already exists and OIDC requires | |
| # per-crate trusted-publisher registration on crates.io (11 forms). | |
| # Migration to OIDC is tracked as a future-work item in | |
| # docs/release-process.md "Phase 4 — auth model". | |
| # | |
| # Mirrors pulseengine/sigil's publish-to-crates-io.yml plus a Rust | |
| # helper script (scripts/publish.rs) that walks the dependency order. | |
| name: Publish to crates.io | |
| concurrency: | |
| group: publish-${{ github.ref }} | |
| cancel-in-progress: false | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: "Existing tag whose workspace state should be (re)published (e.g. v0.6.0)" | |
| required: true | |
| type: string | |
| permissions: | |
| contents: read | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| publish: | |
| name: Publish workspace | |
| if: github.repository == 'pulseengine/synth' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| ref: ${{ inputs.tag || github.ref }} | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| key: publish-crates-io | |
| - name: Verify tag matches workspace version | |
| env: | |
| INPUT_TAG: ${{ inputs.tag }} | |
| run: | | |
| set -euo pipefail | |
| VERSION="${INPUT_TAG:-${GITHUB_REF#refs/tags/}}" | |
| EXPECTED="${VERSION#v}" | |
| ACTUAL=$( | |
| awk ' | |
| /^\[workspace.package\]/ { in_pkg = 1; next } | |
| /^\[/ { in_pkg = 0 } | |
| in_pkg && /^version *=/ { | |
| gsub(/[ \t"]/, "", $0) | |
| sub(/version=/, "", $0) | |
| exit | |
| } | |
| ' Cargo.toml | |
| ) | |
| if [ "$EXPECTED" != "$ACTUAL" ]; then | |
| echo "::error::tag $VERSION expects workspace version $EXPECTED but Cargo.toml has $ACTUAL" | |
| exit 1 | |
| fi | |
| echo "::notice::tag $VERSION matches workspace version $ACTUAL" | |
| - name: Build publish helper | |
| run: rustc --edition 2024 scripts/publish.rs -o publish | |
| # Pre-flight fail-fast (#146). `cargo publish --dry-run` resolves every | |
| # path-dep *version requirement* against the crates.io index, so on the | |
| # FIRST publish of any new version a dependent fails with "failed to | |
| # select a version for synth-core = ^x.y" (the deps aren't on the | |
| # registry yet) — the chicken-and-egg that sank the v0.7.0 verify step | |
| # (dropped in #144). A *per-crate* `cargo package -p <name>` fails the | |
| # same way. `./publish verify` avoids it by packaging the whole | |
| # publishable set in ONE `cargo package -p a -p b ...` invocation: | |
| # cargo writes every member to target/package/*.crate first, then | |
| # verify-builds each against those local tarballs at the NEW version, | |
| # never touching the index (empirically confirmed at an unpublished | |
| # 0.99.0). This catches broken metadata / missing README / bad | |
| # include-exclude / code that doesn't compile before any upload. | |
| - name: Verify publishable crates package cleanly | |
| run: ./publish verify | |
| - name: Publish workspace to crates.io | |
| run: ./publish publish | |
| env: | |
| CARGO_REGISTRY_TOKEN: ${{ secrets.CRATES_IO_TOKEN }} |