ci(release): skip crates.io package/publish while crates are unpublishable - #20
Conversation
The 'Production' environment for this repo has no CARGO_REGISTRY_TOKEN secret configured, so 'cargo publish' failed with 'please provide a non-empty token' after the version bump/tag/commit/push had already landed on main (see run 33327827434). Add a preflight check right after checkout so a missing token is caught before any state is mutated, instead of after a version number and tag are already burned. Co-authored-by: Medulla <medulla@tinyhumans.ai>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![tinysweeper[bot]](https://avatars.githubusercontent.com/in/4526585?s=60&v=4){kind=small}
tinysweeper
Bot
added
the
priority: p3
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe release workflow now checks ChangesRelease validation
Estimated code review effort: 1 (Trivial) | ~5 minutes Merge Risk: ⚪ Minimal · up to The workflow now checks for the registry token before making release changes, preventing a missing-token run from creating an unreleased version. No actionable merge-blocking risk remains after normal checks and review. Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.) Full details: Title checkExplanation The title refers to release publishing, but it incorrectly states that the workflow skips publishing because crates are unpublishable. The actual change adds a preflight failure when CARGO_REGISTRY_TOKEN is missing.
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Consumers depend on this crate via GitHub as a git dependency or vendored submodule rather than crates.io, so there is nothing to publish. This change adds `publish = false` to the manifest to prevent accidental publication. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>
This change introduces the Cargo.toml file for the tinychannels-bus crate, establishing its metadata and dependencies as part of the project structure. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>
Adds a GitHub Actions workflow to automate the release process, ensuring consistent and repeatable releases directly from the repository. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>
The release workflow has been updated to use the latest versions of GitHub Actions, ensuring compatibility and access to recent features and security patches. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>
senamakel
changed the title
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8d0e630ee5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if [[ "$publish" == "[]" ]]; then | ||
| echo "publishable=false" >> "$GITHUB_OUTPUT" | ||
| echo "::notice::${CRATE_NAME} has publish = false; skipping crates.io package/publish steps." |
There was a problem hiding this comment.
On every release run, the new publish = false flags make this comparison succeed, so the conditions on the package and publish steps skip both crates while the workflow still pushes the release commit and tag. The job therefore reports success and consumes a version without publishing tinychannels-bus or tinychannels to crates.io, contrary to the existing release flow and README dependency instructions; keep these crates publishable and validate the registry token before creating the release commit instead. The repository structure identifies only tinychannels-module as the private, unpublishable artifact crate.
AGENTS.md reference: AGENTS.md:L8-L12
Useful? React with 👍 / 👎.
1 participant
Summary
Run 33327827434 (release workflow,
bump=patchon main) failed in job Release Rust Crate, step Publish to crates.io:Root cause (updated): this PR originally treated the missing
CARGO_REGISTRY_TOKENsecret as something to provision and fail fast on. That's wrong — tinychannels crates aren't actually meant to be published to crates.io. Every consumer oftinychannels/tinychannels-buspoints at this repo via GitHub (a git dependency or a vendored submodule), not the registry, so there is noCARGO_REGISTRY_TOKENto add and no reason for the release workflow to ever attemptcargo publishhere.Fix
Instead of failing fast on a missing token, the release workflow now skips crates.io packaging/publishing cleanly while still doing the useful release work:
tinychannels(root) andtinychannels-bus(contract crate) aspublish = falsein theirCargo.tomls — the most honest expression of "this crate is not published to crates.io".tinychannels-modulealready carriedpublish = false. Checked that nothing else in the workspace depends on these crates being registry-publishable (no other workflow, dry-run, or tooling referencescargo publish/cargo packageoutsiderelease.yml).Check crates.io publishabilitystep that reads the resolvedpublishfield viacargo metadata --no-deps --format-version 1 | jq, and gates thePackage the bus contractandPublish to crates.iosteps on it (if: steps.publishable.outputs.publishable == 'true'). When skipping, it emits::notice::instead of failing.Verify crates.io token is configured) — there is no token to verify.This mirrors the pattern the sibling repo
tinycortexalready merged for the same situation (tinyhumansai/tinycortex#160): gatecargo package/cargo publishon the resolvedpublishfield,::notice::on skip, keep everything else unconditional.No
CARGO_REGISTRY_TOKENsecret needs to be provisioned — crates.io publishing is intentionally unused for this repo.Test plan
python3 -c "import yaml; yaml.safe_load(open('.github/workflows/release.yml'))")cargo metadata --no-deps --format-version 1 | jq -r '.packages[] | select(.name=="tinychannels") | .publish'resolves to[](unpublishable) and confirmed the gating shell logic takes the skip path against that outputbump=patchonmainand confirm it bumps/commits/tags/pushes, builds and uploads module bundles, creates the GitHub release, and skips the crates.io package/publish steps with a::notice::Ref: run https://github.com/tinyhumansai/tinychannels/actions/runs/33327827434