ci: collapse crates.io publish + cut redundant CI work - #94
Merged
Conversation
Release deploy (release.yml): - Replace the 23 hand-ordered `cargo publish -p ...` steps and all 8 inter-step sleeps (~300s of pure waiting) with a single `cargo publish --workspace --locked`. cargo (>=1.66, repo pins 1.95.0) waits for each crate to be live on the index before the next and derives the topological order itself, so adding a workspace member no longer needs a release.yml edit. Retires the recurring "forgot to add the new crate in dep order" incident class (v0.15/16/17). - Rework the workflow_dispatch recovery path: native `--workspace` does not skip already-published crates (rust-lang/cargo#15006, #16139), so recovery enumerates publishable members, probes crates.io per version, and `--exclude`s the live ones — cargo then publishes only the missing tail, still in dep order. Validated locally with `--dry-run`. - Build aarch64-unknown-linux-gnu on a native ubuntu-24.04-arm runner (free for public repos) instead of `cross` Docker emulation. CI (ci.yml): - Add concurrency + cancel-in-progress so a newer push cancels stale runs. - Fold tracing-leak-guard + mcp-tools-inventory + secret-no-leak-grep into one toolchain-free `lint-greps` job (gates kept as named steps). - Switch the test job to `cargo nextest run` + a separate doctest step. Security (security.yml, new): - Move `cargo deny` + `cargo audit` out of ci.yml into a dependency-path- filtered workflow plus a weekly schedule for time-based advisories. Safe: main has no required status checks, so path-filtering cannot deadlock a merge. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
CI/CD pass to cut deploy time (crates.io publish) and CI build time, and retire the hand-maintained publish ordering that caused 4 release incidents (v0.15/16/17).
Release deploy (
release.yml)cargo publish --workspace --lockedreplaces 23 hand-orderedcargo publish -p …steps + 8 sleeps (~300s). cargo (≥1.66; repo pins 1.95.0) waits on the index between crates and derives the topological order itself, so adding a workspace member no longer needs a release.yml edit.--workspacedoes not skip already-published crates (cargo#15006, #16139) — it errors at the first and never reaches the missing tail.workflow_dispatchnow enumerates publishable members, probes crates.io per version, and--excludes the live ones so cargo fills only the gap. Validated locally with--dry-run(correct order, zero errors).aarch64-unknown-linux-gnubuilds onubuntu-24.04-arm(free for public repos) instead ofcross/Docker.CI (
ci.yml)concurrency+cancel-in-progress— a newer push cancels stale runs.lint-grepsjob (gates kept as named steps).testjob →cargo nextest run+ a separate--docstep.Security (
security.yml, new)cargo deny+cargo auditmoved to a dependency-path-filtered workflow + weekly schedule (time-based advisories). Safe:mainhas no required status checks, so path-filtering can't deadlock a merge.Watch on first run
publish-cratesbehavior only fully exercises on a release tag.Not done (deliberate)
rust-toolchain.toml; forcing shared cache keys needs before/after measurement. Seekb/wiki/build-plans/cicd-workflow-optimization.md.🤖 Generated with Claude Code