From c49adc6e83e0f6b73fc1ffd31cb8bcf011b999d1 Mon Sep 17 00:00:00 2001 From: Chisanan232 Date: Mon, 15 Jun 2026 10:06:33 +0800 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=A7=20(release-python):=20Sync=20Cargo?= =?UTF-8?q?.lock=20in=20pin-ffi-to-tag.sh?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/scripts/pin-ffi-to-tag.sh | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/.github/scripts/pin-ffi-to-tag.sh b/.github/scripts/pin-ffi-to-tag.sh index 11bb4b7a..8766355f 100755 --- a/.github/scripts/pin-ffi-to-tag.sh +++ b/.github/scripts/pin-ffi-to-tag.sh @@ -98,3 +98,17 @@ PY echo "aa-ffi git deps pinned to ${sha}:" grep -nE '^aa-(core|proto|sdk-client)[[:space:]]*=' "$CARGO_TOML" + +# Sync the sibling Cargo.lock so it agrees with the freshly-pinned rev. +# Without this the manifest points at the new core commit while the lock +# still records the old one; the wheel build only tolerates that because it +# does not run `--locked` (cargo silently re-resolves). Syncing keeps the +# lock honest and lets the build be hardened with `--locked` later. The +# maturin build mounts this same checkout, so the synced lock is what it uses. +LOCKFILE="$(dirname "$CARGO_TOML")/Cargo.lock" +if [[ -f "$LOCKFILE" ]] && command -v cargo >/dev/null 2>&1; then + echo "::notice::Syncing ${LOCKFILE} to ${sha}" + cargo update --manifest-path "$CARGO_TOML" -p aa-core -p aa-proto -p aa-sdk-client +else + echo "::warning::skipped Cargo.lock sync (cargo or ${LOCKFILE} missing); build will re-resolve" +fi