fix(release): sync full workspace in Cargo.lock on release#58
Conversation
📝 WalkthroughWalkthroughThe release-please workflow now refreshes ChangesRelease workflow lockfile sync
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Greptile SummaryThis PR fixes a broken release pipeline caused by stale package names in the
Confidence Score: 5/5Safe to merge — the change is a targeted one-line fix in the release workflow and a mechanical lockfile sync with no external dependency changes. The workflow change replaces a broken, name-sensitive command with the standard workspace-wide equivalent. The Cargo.lock update is exactly what No files require special attention. Important Files Changed
Reviews (2): Last reviewed commit: "fix(release): sync full workspace in Car..." | Re-trigger Greptile |
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 0 |
| Duplication | 0 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
The "Sync Cargo.lock" step ran `cargo update -p csp -p csp-cli`, but `csp` stopped being a package name once the library crate was renamed to code-search-please (crates.io publish, #53/#54) and csp-node was added (#56). `-p csp` now errors with "package ID specification `csp` did not match any packages", failing the step — so the release PR never synced the lockfile and v0.1.5 shipped a stale 0.1.4 Cargo.lock. The release build's `cargo build --locked` then fails: cannot update Cargo.lock. Use `cargo update --workspace`, which re-locks every local member by its real package name without bumping external deps, and refresh the stale lockfile (members 0.1.4 -> 0.1.5) on main. Typed `fix:` (not `ci:`) on purpose: v0.1.5 is a dud release (its tag points at the stale-lock commit, so it can never be rebuilt), and a `ci:` commit would not make release-please cut a new version. `fix:` triggers the 0.1.6 patch release that actually ships binaries with the corrected lockfile sync.
84b8101 to
85574e7
Compare
|



Problem
The
v0.1.5release build failed:The release-rust.yml build runs
cargo build --release --locked, but thev0.1.5tag shipped a staleCargo.lock— all three workspace members were still pinned at0.1.4whileCargo.tomldeclared0.1.5.Root cause
release-please.yml's "Sync Cargo.lock" step ran:But
cspstopped being a package name:csp→code-search-pleasefor the crates.io publish (ci(release): publish library crate to crates.io via Trusted Publishing #53/docs: note the library is on crates.io as code-search-please #54), andcsp-nodewas added (feat(sdk): remove deprecated TS implementation; add napi-rs SDK (@pleaseai/csp-sdk) #56) and was never in the update list.So
-p cspnow hard-errors:That failed the whole step, the release PR never committed a synced lockfile, and
v0.1.5was tagged with the stale0.1.4lock.Fix
cargo update --workspace, which re-locks every local member by its real package name (code-search-please/csp-cli/csp-node) without bumping external deps — and won't break again on future renames or new crates.Cargo.lockonmain(members0.1.4→0.1.5), socargo build --locked/cargo test --lockedpass again.Verification
Note for maintainers
The
v0.1.5tag itself still points at the stale-lock commit, so re-running its release build won't help — cut 0.1.6 to ship released binaries.Summary by cubic
Sync the full Rust workspace in
Cargo.lockduring releases to keep versions aligned and fix failingcargo build --lockedrelease builds. Replaces brittle per-package updates with a workspace-wide re-lock that survives crate renames and new members, and triggers a patch release to ship the fix.cargo update --workspaceinrelease-please.ymlto re-lock only local members (no external bumps). Marked as a fix so release-please cuts0.1.6with the corrected workflow.Cargo.lockonmain(members0.1.4→0.1.5) socargo build --lockedand tests pass.Written for commit 85574e7. Summary will update on new commits.
Summary by CodeRabbit