Fix crates.io publish detection

[jsturtevant]

The publish workflow treated any response containing .version as proof that the requested crate version existed, which caused release publish steps to be skipped. The check now skips only for HTTP 200 with an exact .version.num match, publishes only for HTTP 404, and fails on malformed or unexpected responses after bounded retries.

The check is a standalone script for local use. Shell scripts use LF endings so Windows checkouts remain runnable.

Create a Release · hyperlight-dev/hyperlight@388ea8e failed to publish since it showed:

  
  needs_publish hyperlight-libc
  needs_publish hyperlight-common
  needs_publish hyperlight-guest
  needs_publish hyperlight-guest-macro
  needs_publish hyperlight-guest-bin
  needs_publish hyperlight-component-util
  needs_publish hyperlight-component-macro
  needs_publish hyperlight-host
  needs_publish hyperlight-guest-tracing
  shell: /usr/bin/bash -e {0}
  env:
    CARGO_HOME: /opt/cargo
    CARGO_INCREMENTAL: 0
    CARGO_TERM_COLOR: always
    RUST_BACKTRACE: full
    VERSION: 0.17.0
✅ hyperlight-libc@0.17.0 already exists.
✅ hyperlight-common@0.17.0 already exists.
✅ hyperlight-guest@0.17.0 already exists.
✅ hyperlight-guest-macro@0.17.0 already exists.
✅ hyperlight-guest-bin@0.17.0 already exists.
✅ hyperlight-component-util@0.17.0 already exists.
✅ hyperlight-component-macro@0.17.0 already exists.
✅ hyperlight-host@0.17.0 already exists.
✅ hyperlight-guest-tracing@0.17.0 already exists.

This is now runnable locally:

bash ./scripts/crates-to-publish.sh 0.16.0 hyperlight-libc hyperlight-common hyperlight-guest hyperlight-guest-macro hyperlight-guest-bin hyperlight-component-util hyperlight-component-macro hyperlight-host hyperlight-guest-tracing
PUBLISH_HYPERLIGHT_LIBC=false
hyperlight-libc@0.16.0 already exists.
PUBLISH_HYPERLIGHT_COMMON=false
hyperlight-common@0.16.0 already exists.
PUBLISH_HYPERLIGHT_GUEST=false
hyperlight-guest@0.16.0 already exists.
PUBLISH_HYPERLIGHT_GUEST_MACRO=false
hyperlight-guest-macro@0.16.0 already exists.
PUBLISH_HYPERLIGHT_GUEST_BIN=false
hyperlight-guest-bin@0.16.0 already exists.
PUBLISH_HYPERLIGHT_COMPONENT_UTIL=false
hyperlight-component-util@0.16.0 already exists.
PUBLISH_HYPERLIGHT_COMPONENT_MACRO=false
hyperlight-component-macro@0.16.0 already exists.
PUBLISH_HYPERLIGHT_HOST=false
hyperlight-host@0.16.0 already exists.
PUBLISH_HYPERLIGHT_GUEST_TRACING=false
hyperlight-guest-tracing@0.16.0 already exists.

[Copilot]

Pull request overview

This PR fixes the crates.io “already published” detection used by the release workflow by moving the check into a dedicated script that validates HTTP status and the exact returned version number, preventing publishes from being skipped due to overly-broad JSON matching.

Changes:

• Added scripts/crates-to-publish.sh to decide per-crate publish flags using HTTP 200/404 and an exact .version.num match.
• Updated the CargoPublish GitHub Actions workflow to use the new script and write PUBLISH_* variables into $GITHUB_ENV.
• Added .gitattributes to enforce LF endings for .sh files to keep scripts runnable across platforms.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
scripts/crates-to-publish.sh	New script that queries crates.io per crate/version and emits PUBLISH_* env lines.
.github/workflows/CargoPublish.yml	Replaces inline publish-detection logic with a call to the new script.
.gitattributes	Enforces LF line endings for shell scripts.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[jprendes]

Tried the script locally and it works. I think crates.io now pays attention to the user agent, and that might have been breaking out check.

I still think that using cargo info would be a better approach, but this is fine.