Skip to content

fix(release): harden Cargo publish ordering and crates.io checks#2646

Closed
Hmbown wants to merge 1 commit into
mainfrom
codex/release-publish-hardening
Closed

fix(release): harden Cargo publish ordering and crates.io checks#2646
Hmbown wants to merge 1 commit into
mainfrom
codex/release-publish-hardening

Conversation

@Hmbown

@Hmbown Hmbown commented Jun 3, 2026

Copy link
Copy Markdown
Owner

Summary

Fixes the two release-tooling problems found while publishing v0.8.52:

  • reorder release_crates into the actual workspace dependency order, so crates like codewhale-config are not published before their freshly-versioned dependencies such as codewhale-execpolicy
  • send a crates.io-compliant user agent for release visibility checks, avoiding the 403 returned by bare curl requests under crates.io data-access policy

Refs #2643.

Verification

  • bash -n scripts/release/crates.sh scripts/release/publish-crates.sh
  • bash scripts/release/publish-crates.sh publish after v0.8.52 was fully published; all 15 crates skipped cleanly as already published

@Hmbown Hmbown added this to the v0.8.53 milestone Jun 3, 2026

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the release scripts by reordering the list of crates in crates.sh and adding a custom User-Agent header to crates.io API requests in publish-crates.sh. Feedback points out a dependency ordering issue in crates.sh where codewhale-tui and codewhale-agent are scheduled to be published before their dependency codewhale-core, which would cause the release process to fail.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

Comment thread scripts/release/crates.sh
Comment on lines +14 to 19
codewhale-config
codewhale-agent
codewhale-tui
codewhale-core
codewhale-app-server
codewhale-tui-core
codewhale-cli

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The current ordering publishes codewhale-tui and codewhale-agent before codewhale-core. Since codewhale-tui (and likely codewhale-agent) depends on codewhale-core, publishing them in this order will fail on a fresh release because their dependency (codewhale-core) is not yet available on crates.io.

Moving codewhale-core to be published immediately after codewhale-config and before codewhale-agent and codewhale-tui resolves this dependency ordering issue.

Suggested change
codewhale-config
codewhale-agent
codewhale-tui
codewhale-core
codewhale-app-server
codewhale-tui-core
codewhale-cli
codewhale-config
codewhale-core
codewhale-agent
codewhale-tui
codewhale-app-server
codewhale-cli

@Hmbown

Hmbown commented Jun 5, 2026

Copy link
Copy Markdown
Owner Author

This exact release-script hardening is already included on the v0.9 stewardship branch as 05950d1d5 and is covered by green #2762 at 15c506b77.

I also re-ran bash -n scripts/release/crates.sh scripts/release/publish-crates.sh, bash scripts/release/publish-crates.sh dry-run, and ./scripts/release/check-versions.sh on the stewardship branch. Closing this source PR as superseded; #2643 remains open because its checklist still includes npm recovery and final verification work beyond this two-file Cargo publish hardening.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant