Heal the release workflows' dependency-binary publication (#288) - #291
Conversation
Restore the pipeline that publishes prebuilt cargo-dylint and dylint-link archives, which failed on four compounding defects: - Host-tool installs ran under the repository's pinned nightly, so cargo-dylint 6.0.1's locked rustc 1.93 floor failed the build on the one push whose manifest change would have published the archives. Installs now run under an explicit stable toolchain. - Cross-compiled legs broke on `openssl-sys` (dependency binaries) and cross-architecture `rustc-dev` installs (lints). Every leg now builds natively: `ubuntu-24.04-arm` for aarch64-linux and `macos-15-intel` for x86_64-darwin. The cross tooling steps are gone. - The tagged release's `publish` job required every build leg, so one failed leg discarded all artefacts. It now runs unless cancelled, tolerates absent per-leg artefacts, and warns per missing target. - The rolling gate only rebuilt when the triggering push changed the manifest, so it could never recover from a failed publish. When the manifest is unchanged it now probes the rolling release for every archive the manifest implies, via the new `scripts/check_dependency_binary_assets.py` (a uv-run Cyclopts script per docs/scripting-standards.md, imported here), and rebuilds on any absence. Contract tests in `tests/workflows/test_release_workflow_healing.py` lock in each behaviour, and `scripts/tests` covers the probe script's asset derivation, missing-asset computation, and output writing.
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 24 minutes Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
@coderabbitai review |
✅ Action performedReview finished.
|
![codescene-access[bot]](https://avatars.githubusercontent.com/in/3755875?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d21697845c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
- Run the probe in uv script mode (`uv run --script`): the previous shebang ran plain `uv run python`, which ignores the PEP 723 dependency block, so a fresh runner would fail at import before writing `should_build`. Verified empirically both ways. - Refuse to publish an empty tagged release: when every build leg fails, the provenance document alone satisfied the asset guard, so a release could be created with no archives. `publish` now requires at least one `.tgz`/`.zip` before generating provenance. - Expect `.sha256` sidecars in the self-heal probe: the installer verifies each archive's checksum before accepting it, so a release missing a sidecar is as broken as one missing the archive.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
`#!/usr/bin/env -S uv run python` executes the interpreter directly and ignores the PEP 723 metadata block, so a directly invoked script fails at import time on machines without its dependencies preinstalled (verified empirically during the review of #291). Prescribe `#!/usr/bin/env -S uv run --script` in the scripting standard, explain why, and update `scripts/typos_rollout_check.py` to match. Co-authored-by: leynos <leynos@rohga>
2 participants
Summary
This branch restores the release pipeline that publishes prebuilt
cargo-dylintanddylint-linkarchives, repairing the four compounding defects documented in #288.Closes #288.
cargo +stable install), installed by a dedicated step.openssl-sys(dependency binaries) and cross-architecturerustc-devinstalls (lints — the cause of weeks of chronically red rolling runs). Every leg now builds natively:ubuntu-24.04-armandmacos-15-intelrunners replace the cross legs, and the cross-tooling steps are removed.publishjob needed every build leg, so one failure discarded all artefacts. It now runs unless cancelled, tolerates absent per-leg artefacts, and emits a warning per missing target while still failing when nothing was built.The probe is implemented as a uv-run Cyclopts script per the newly imported docs/scripting-standards.md, rather than inline workflow shell.
Review walkthrough
publishjob (!cancelled(),continue-on-errordownloads, per-target warnings).installer/dependency-binaries.toml, queries the release viagh, and writesshould_buildto the Actions output.Validation
make check-fmt,make lint,make typecheck,make test(1459 passed, 3 skipped),make markdownlint,make nixie: all pass.test_publish_check_provisioning.pyreproduce identically on a cleanorigin/maincheckout in this environment (they pass in CI) and are unrelated.Notes
workflow_dispatchof Rolling Release (or any push) exercises the self-healing gate; the manually uploaded x86_64-linux tarballs onrollingandv0.2.6should then be superseded by CI-built archives for all five targets.docs/scripting-standards.mdis imported verbatim from the shared standard.