From 2fcda59bc193744fc5f161045b11a717e418ee01 Mon Sep 17 00:00:00 2001 From: tison Date: Fri, 4 Sep 2026 16:38:15 +0800 Subject: [PATCH 1/3] fix: keep release candidates off crates.io --- .github/workflows/release.yml | 17 +++-------------- CHANGELOG.md | 6 ++++-- RELEASE.md | 2 +- 3 files changed, 8 insertions(+), 17 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e8f0164..47a2440 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -112,7 +112,8 @@ jobs: publish: name: Publish to crates.io - if: ${{ startsWith(github.ref, 'refs/tags/') }} + # Only the final tag approved through the ASF release vote may publish to crates.io. + if: ${{ github.ref == format('refs/tags/v{0}', needs.check.outputs.version) }} needs: check runs-on: ubuntu-24.04 timeout-minutes: 30 @@ -127,22 +128,10 @@ jobs: rustup toolchain install stable --profile minimal --no-self-update - - name: Prepare crates.io release candidate - if: ${{ needs.check.outputs.publish_version != needs.check.outputs.version }} - shell: bash - env: - PACKAGE_VERSION: ${{ needs.check.outputs.version }} - PUBLISH_VERSION: ${{ needs.check.outputs.publish_version }} - run: | - perl -pi -e 's/^version = "\Q$ENV{PACKAGE_VERSION}\E"$/version = "$ENV{PUBLISH_VERSION}"/' asyncband/Cargo.toml - grep -Fx "version = \"${PUBLISH_VERSION}\"" asyncband/Cargo.toml - cargo check --package asyncband - id: auth name: Authenticate with crates.io uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5 - name: Publish asyncband - run: >- - cargo publish --package asyncband --locked - ${{ needs.check.outputs.publish_version != needs.check.outputs.version && '--allow-dirty' || '' }} + run: cargo publish --package asyncband --locked env: CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }} diff --git a/CHANGELOG.md b/CHANGELOG.md index 95b8431..885bce9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,7 +10,7 @@ All notable changes to this project will be documented in this file. * Preserve applicable third-party licensing and copyright notices on derived source files, and record exact provenance mappings in `LICENSE` and source comments. -## v0.7.1 +## v0.7.1 - 2026-09-04 This is an interim non-ASF release. It has not been approved by the Apache Incubator PMC and is not an act of the Apache Software Foundation. @@ -18,7 +18,9 @@ This is an interim non-ASF release. It has not been approved by the Apache Incub * Correct source-header treatment and make third-party derivation and test provenance records more precise in source distributions. -## v0.7.0 +## v0.7.0 - 2026-09-04 + +This non-ASF release was not approved by the Apache Incubator PMC, is not an act of the Apache Software Foundation, and has been yanked from crates.io. ### Breaking changes diff --git a/RELEASE.md b/RELEASE.md index 7abe9d1..2184c95 100644 --- a/RELEASE.md +++ b/RELEASE.md @@ -94,7 +94,7 @@ git tag --sign "${RC_TAG}" \ git push https://github.com/apache/asyncband.git "${RC_TAG}" ``` -Wait for the `Release` GitHub Actions workflow to pass. The workflow publishes a convenience prerelease named `${VERSION}-rc.${RC}` to crates.io while the source tag and release candidate retain the stable `${VERSION}` package version. A candidate that needs a code change gets a new release pull request, merge commit, RC number, and signed tag. +Wait for the `Release` GitHub Actions workflow to pass. The workflow validates a convenience prerelease package named `${VERSION}-rc.${RC}` with `cargo publish --dry-run` but does not publish it to crates.io. A candidate that needs a code change gets a new release pull request, merge commit, RC number, and signed tag. ## 3. Build and verify the source archive From 1a2337b6f512ac5e29dade3865a277da8b7a5ec4 Mon Sep 17 00:00:00 2001 From: tison Date: Fri, 4 Sep 2026 16:42:00 +0800 Subject: [PATCH 2/3] docs: use parenthesized changelog dates --- CHANGELOG.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 885bce9..0543a04 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,7 +10,7 @@ All notable changes to this project will be documented in this file. * Preserve applicable third-party licensing and copyright notices on derived source files, and record exact provenance mappings in `LICENSE` and source comments. -## v0.7.1 - 2026-09-04 +## v0.7.1 (2026-09-04) This is an interim non-ASF release. It has not been approved by the Apache Incubator PMC and is not an act of the Apache Software Foundation. @@ -18,7 +18,7 @@ This is an interim non-ASF release. It has not been approved by the Apache Incub * Correct source-header treatment and make third-party derivation and test provenance records more precise in source distributions. -## v0.7.0 - 2026-09-04 +## v0.7.0 (2026-09-04) This non-ASF release was not approved by the Apache Incubator PMC, is not an act of the Apache Software Foundation, and has been yanked from crates.io. From b79b9e897f86a8b6c995df3337d1773a3b18c51a Mon Sep 17 00:00:00 2001 From: tison Date: Fri, 4 Sep 2026 16:45:27 +0800 Subject: [PATCH 3/3] fix: validate the final package for release candidates --- .github/workflows/release.yml | 20 -------------------- RELEASE.md | 2 +- 2 files changed, 1 insertion(+), 21 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 47a2440..3c82ec0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -41,7 +41,6 @@ jobs: timeout-minutes: 30 outputs: version: ${{ steps.package.outputs.version }} - publish_version: ${{ steps.package.outputs.publish_version }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: @@ -60,12 +59,7 @@ jobs: echo "The asyncband package version must be a stable X.Y.Z version, got: ${version}" >&2 exit 1 fi - publish_version="${version}" - if [[ "${GITHUB_REF_NAME}" == "v${version}-rc."* ]]; then - publish_version="${GITHUB_REF_NAME#v}" - fi echo "version=${version}" >> "${GITHUB_OUTPUT}" - echo "publish_version=${publish_version}" >> "${GITHUB_OUTPUT}" - name: Check tag if: ${{ startsWith(github.ref, 'refs/tags/') }} shell: bash @@ -93,22 +87,8 @@ jobs: echo "Release tag ${GITHUB_REF_NAME} does not point to a commit on main." >&2 exit 1 fi - - name: Prepare crates.io release candidate - if: ${{ steps.package.outputs.publish_version != steps.package.outputs.version }} - shell: bash - env: - PACKAGE_VERSION: ${{ steps.package.outputs.version }} - PUBLISH_VERSION: ${{ steps.package.outputs.publish_version }} - run: | - perl -pi -e 's/^version = "\Q$ENV{PACKAGE_VERSION}\E"$/version = "$ENV{PUBLISH_VERSION}"/' asyncband/Cargo.toml - grep -Fx "version = \"${PUBLISH_VERSION}\"" asyncband/Cargo.toml - cargo check --package asyncband - name: Check crates.io package - if: ${{ steps.package.outputs.publish_version == steps.package.outputs.version }} run: cargo publish --package asyncband --locked --dry-run - - name: Check crates.io release candidate - if: ${{ steps.package.outputs.publish_version != steps.package.outputs.version }} - run: cargo publish --package asyncband --locked --dry-run --allow-dirty publish: name: Publish to crates.io diff --git a/RELEASE.md b/RELEASE.md index 2184c95..2b479f0 100644 --- a/RELEASE.md +++ b/RELEASE.md @@ -94,7 +94,7 @@ git tag --sign "${RC_TAG}" \ git push https://github.com/apache/asyncband.git "${RC_TAG}" ``` -Wait for the `Release` GitHub Actions workflow to pass. The workflow validates a convenience prerelease package named `${VERSION}-rc.${RC}` with `cargo publish --dry-run` but does not publish it to crates.io. A candidate that needs a code change gets a new release pull request, merge commit, RC number, and signed tag. +Wait for the `Release` GitHub Actions workflow to pass. The workflow validates the RC tag and runs `cargo publish --dry-run` against the unchanged `${VERSION}` package; it skips the crates.io publish job for RC tags. A candidate that needs a code change gets a new release pull request, merge commit, RC number, and signed tag. ## 3. Build and verify the source archive