Skip to content

ci: exercise the release path on every pull request - #14

Open
P4suta wants to merge 1 commit into
mainfrom
ci/release-dry-run
Open

ci: exercise the release path on every pull request#14
P4suta wants to merge 1 commit into
mainfrom
ci/release-dry-run

Conversation

@P4suta

@P4suta P4suta commented Aug 4, 2026

Copy link
Copy Markdown
Owner

Every defect found in the release path so far was invisible to CI, because CI tests the crate and nothing runs the release. All of these came from real failed releases, discovered by attempting one and reading the failure:

Defect Where it hid
release-plz/action missing from the repository allowlist workflow could not start
cargo-bins/cargo-binstall and release-plz/git-config also missing — release-plz calls them workflow could not start
xtask had publish = false while the config said otherwise release-plz refused to run
ubuntu-latest runner cannot build a Windows-only crate cargo publish verification
A path dependency broke cargo metadata release-plz could not resolve the workspace
release_always = false made the crate permanently unreleasable nothing happened, silently

Six separate round trips, each one costing a release attempt.

The fix

Run the real release action with dry_run on every pull request. It:

  • downloads the same actions, including the ones release-plz calls internally — which is the part a static allowlist check cannot see;
  • parses the same release-plz.toml against the same manifests;
  • resolves the same versions against the registry;
  • performs the same cargo publish verification build, on the same runner;
  • uploads nothing.

That covers the whole class. An unlisted action fails when it is downloaded. A configuration conflict fails when it is parsed. A runner that cannot build the crate fails in the verification build. All on the pull request, not during a release.

Wired into ci-required, so it gates merges like every other job.

🤖 Generated with Claude Code

Every defect found in the release path so far was invisible to CI, because CI
tests the crate and nothing runs the release. The list, all from real failed
releases: an action missing from the repository allowlist, and then two more
that release-plz itself calls; a release-plz configuration that disagreed with
a manifest; a runner that cannot build the crate `cargo publish` verifies; a
`release_always` setting that made the crate permanently unreleasable. Each
one was found by attempting a release and reading the failure.

Run the real release action with `dry_run`. It downloads the same actions,
including the ones release-plz calls internally, parses the same
configuration, resolves the same versions, and performs the same `cargo
publish` verification build. It uploads nothing.

That covers the whole class: an unlisted action fails when it is downloaded, a
configuration conflict fails when it is parsed, and a runner that cannot build
the crate fails in the verification build -- all on the pull request instead of
during a release.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant