The `cargo-smart-release` tool will not update crate manifest for safety bumped dependency

[jacderida]

Duplicates

• I have searched the existing issues

Current behavior 😯

We've been using smart-release on our project to do automated releases.

First, I'd just like to say, it's a great tool, so thank you for your efforts with it.

I've ran into a situation now where it isn't updating the manifest of a crate after safety bumping one of its dependencies. I'm on the latest published version, v0.9.0.

Our project is workspace crate with nine crates, three of which are internal and don't get published. Of the crates that do get published, with their dependencies, they look like so:

sn_dysfunction -> no dependencies
sn_interface -> no dependencies
sn_client -> sn_interface
sn_node -> sn_interface, sn_dysfunction
sn_api -> sn_interface, sn_client
sn_cli -> sn_api

For our latest release, we had a situation where four crates, sn_interface, sn_dysfunction, sn_node, and sn_client, had changes, and we would expect them to be released.

This is how I run smart-release in our release process:

  cargo smart-release \
    --update-crates-index \
    --no-push \
    --no-publish \
    --no-changelog-preview \
    --allow-fully-generated-changelogs \
    --no-changelog-github-release \
    --execute \
    "sn_dysfunction" "sn_interface" "sn_node" "sn_client" "sn_api" "sn_cli"

So the way we use it is just for generating a release commit; the Github Release, publishing, tagging etc. gets done by other parts of our release process, as we need control over that. So far this has worked great for us. Having smart-release determine our changes and do the bumping for us is a really crucial part of the process.

Anyway, unfortunately, for this release, smart-release exits with a failure, which causes our release process to fail. Here is the output:

[INFO ] Updating crates-io index
[DEBUG] Wanted to mark 'sn_api' for breaking manifest change, but its already known without breaking change.
[WARN ] Refused to publish 'sn_api' as as it didn't change.
[WARN ] Refused to publish 'sn_cli' as as it didn't change.
[INFO ] Will not publish or alter 2 dependent crates: unchanged = 'sn_api', 'sn_cli'
[INFO ] Will auto-bump dependent package 'sn_interface' from 0.2.4 to 0.3.0 for publishing
[INFO ] Will auto-bump provided package 'sn_dysfunction' from 0.1.3 to 0.2.0 for publishing, for SAFETY due to breaking package 'sn_interface'
[INFO ] Will auto-bump provided package 'sn_node' from 0.58.20 to 0.59.0 for publishing, for SAFETY due to breaking package 'sn_dysfunction', ignoring computed version 0.58.21
[INFO ] Will auto-bump provided package 'sn_client' from 0.62.3 to 0.63.0 for publishing, for SAFETY due to breaking package 'sn_interface', ignoring computed version 0.62.4
[INFO ] Will adjust version constraints in manifest of 1 package as direct dependencies are changing: log_cmds_inspector
[WARN ] sn_interface: The following tags were not encountered during commit graph traversal: refs/tags/sn_interface-v0.1.1
[INFO ] Will modify existing changelog for 'sn_interface'.
[WARN ] sn_dysfunction: The following tags were not encountered during commit graph traversal: refs/tags/sn_dysfunction-v0.1.0
[INFO ] Will modify existing changelog for 'sn_dysfunction'.
[WARN ] sn_node: The following tags were not encountered during commit graph traversal: refs/tags/sn_node-v0.58.13
[TRACE] Cannot handle End(Item)
[TRACE] Cannot handle End(List(None))
[TRACE] Cannot handle End(Item)
[TRACE] Cannot handle End(List(None))
[TRACE] Cannot handle End(Item)
[TRACE] Cannot handle End(List(None))
[TRACE] Cannot handle End(Item)
[TRACE] Cannot handle End(List(None))
[TRACE] Cannot handle End(Item)
[TRACE] Cannot handle End(List(None))
[TRACE] Cannot handle End(Item)
[TRACE] Cannot handle End(List(None))
[TRACE] Cannot handle End(Item)
[TRACE] Cannot handle End(List(None))
[TRACE] Cannot handle End(Item)
[TRACE] Cannot handle End(List(None))
[TRACE] Cannot handle End(Item)
[TRACE] Cannot handle End(List(None))
[TRACE] Cannot handle End(Item)
[TRACE] Cannot handle End(List(None))
[TRACE] Cannot handle End(Item)
[TRACE] Cannot handle End(List(None))
[TRACE] Cannot handle End(Item)
[TRACE] Cannot handle End(List(None))
[TRACE] Cannot handle End(Item)
[TRACE] Cannot handle End(List(None))
[INFO ] Will modify existing changelog for 'sn_node'.
[WARN ] sn_client: The following tags were not encountered during commit graph traversal: refs/tags/sn_client-v0.62.0
[INFO ] Will modify existing changelog for 'sn_client'.
[TRACE] Pending 'sn_interface' manifest version update: "0.3.0"
[TRACE] Pending 'sn_dysfunction' manifest version update: "0.2.0"
[TRACE] Pending 'sn_dysfunction' manifest dependencies update: 'sn_interface = "^0.3.0"' (from  "^0.2.4" )
[TRACE] Pending 'sn_node' manifest version update: "0.59.0"
[TRACE] Pending 'sn_node' manifest dependencies update: 'sn_interface = "^0.3.0"' (from  "^0.2.4" )
[TRACE] Pending 'sn_node' manifest dependencies update: 'sn_dysfunction = "^0.2.0"' (from  "^0.1.3" )
[TRACE] Pending 'sn_node' manifest dev-dependencies update: 'sn_interface = "^0.3.0"' (from  "^0.2.3")
[TRACE] Pending 'sn_client' manifest version update: "0.63.0"
[TRACE] Pending 'sn_client' manifest dependencies update: 'sn_interface = "^0.3.0"' (from  "^0.2.4" )
[TRACE] Pending 'sn_client' manifest dev-dependencies update: 'sn_interface = "^0.3.0"' (from  "^0.2.3")
[TRACE] Pending 'log_cmds_inspector' manifest dependencies update: 'sn_interface = "^0.3.0"' (from  "^0.2.4" )
[TRACE] Will persist changes to 5 manifests and 4 changelogs with: "Bump sn_interface v0.3.0, sn_dysfunction v0.2.0, sn_node v0.59.0, sn_client v0.63.0, safety bump 3 crates\n\nSAFETY BUMP: sn_dysfunction v0.2.0, sn_node v0.59.0, sn_client v0.63.0"
Error: `cargo metadata` exited with an error: error: failed to select a version for the requirement `sn_client = "^0.62.3"`
candidate versions found which didn't match: 0.63.0
location searched: /home/runner/work/safe_network/safe_network/sn_client
required by package `sn_api v0.60.2 (/home/runner/work/safe_network/safe_network/sn_api)`

What's seems to be happening is, sn_client is being safety bumped, but sn_api is not being updated to reference the new version of sn_client. This should be a legit situation: we should be able to have changes in sn_client without also having changes in sn_api.

I think there is some kind of clue here:

[DEBUG] Wanted to mark 'sn_api' for breaking manifest change, but its already known without breaking change.

However, I can't get smart-release to behave any differently.

I would really appreciate any help you could give us with this, as I'm stumped. This may be related or similar to #222, but I'm not entirely sure.

Expected behavior 🤔

We would expect our sn_api crate to be updated to reference the new version of the safety-bumped sn_client crate.

Steps to reproduce 🕹

• Clone a copy of our repository: git clone https://github.com/maidsafe/safe_network/
• Checkout commit 1d1689f91d0bc450257d1a279561ea7b0c1b71a7 (At the time of writing this is HEAD, but by the time you see this message, we will most likely have moved on.)
• Run smart-release like so:

  cargo smart-release \
    --update-crates-index \
    --no-push \
    --no-publish \
    --no-changelog-preview \
    --allow-fully-generated-changelogs \
    --no-changelog-github-release \
    --execute \
    "sn_dysfunction" "sn_interface" "sn_node" "sn_client" "sn_api" "sn_cli"

[Byron]

Thanks for the detailed report! I can reproduce the issue and will take a look. Your hints may help to speed up the investigation, thanks for that.

[Byron]

A new release of cargo-smart-release was created which is able to publish the crates as one would expect. The debug message did indeed help to debug the issue more quickly 🎉, even though it took me some time to get back into the code.

For posterity, here is the command-line I used to do that the release: cargo run --package cargo-smart-release --bin cargo-smart-release -- smart-release cargo-smart-release 🤣.

Even though the issue auto-closed, please do let me know if this does indeed work for you.

[jacderida]

Thanks so much for the quick response and resolution! I re-ran our release today and everything worked fine. Btw, this time it has also safety bumped crates that were dependent on sn_client.

Like I had said before, smart-release has been a great tool for us - keep up the good work!

I love the command: that's some Inception stuff there! 😂

[Byron]

Btw, this time it has also safety bumped crates that were dependent on sn_client.

Yes, it propagates all the way up the chain. It's interesting how much work in extra-tooling is needed to address this behavior of cargo to upgrade dependencies even if they are in pre-release or beta/alpha state. According to semver, pre-release versions are never compatible to each other, but cargo really prefers more recent versions at the risk of causing breakage. It's definitely something that will catch folks off-guard. At least thanks to smart-release one regains control over that.

Like I had said before, smart-release has been a great tool for us - keep up the good work!

I am glad it works for you, even though I hope that it keeps working so I don't have to touch it again :D.

I love the command: that's some Inception stuff there! 😂

The best comparison, I had a good chuckle :D!