@ondeinference / ed / commits / c23e71d

Drop --allow-branch and harden the publish plan count

Review flagged `--allow-branch "*"` as letting a release publish from any branch. It does neither thing. cargo-workspaces only consults it from GitOpt::validate, whose sole caller is the versioning path, and --publish-as-is skips that path entirely. The same check rejects a detached HEAD before it ever tests the pattern, so on a tag checkout the flag could never have helped either. Verified against 0.4.2's source and by dry running from a detached worktree at v1.0.0 without it. The plan count was worth hardening. Inside `echo "count=$(...)"` a failing python3 still leaves exit status 0 and writes an empty count, and GitHub coerces an empty string to 0 in `!= '0'`, so a broken plan step would quietly skip the publish and report that everything was already on crates.io. Assigning first lets `bash -e` abort instead. Also records why the publish interval is there. Co-Authored-By: siGit Code <noreply@sigit.si>

Seto Elkahfi committed Sep 11, 2026 at 08:27 UTC c23e71d3ea6e5098d61ee33f75f1294ac00ef44d

1 file changed +5 -3

.github/workflows/release-sdk-rust.yml

+5 -3

@@ -68,7 +68,7 @@ jobs:

68 - name: Install cargo-workspaces

69 run: cargo install cargo-workspaces --version 0.4.2 --locked

70 - name: Dry-run the workspace publish

71 - run: cargo workspaces publish --publish-as-is --dry-run --locked --allow-branch "*" --yes

71 + run: cargo workspaces publish --publish-as-is --dry-run --locked --yes

73 publish:

74 needs: preflight

@@ -103,7 +103,8 @@ jobs:

103 run: |

104 cargo workspaces plan --skip-published --json > plan.json

105 cat plan.json

106 - echo "count=$(python3 -c 'import json; print(len(json.load(open("plan.json"))))')" >> "$GITHUB_OUTPUT"

106 + count="$(python3 -c 'import json; print(len(json.load(open("plan.json"))))')"

107 + echo "count=$count" >> "$GITHUB_OUTPUT"

108 - name: Authenticate to crates.io

109 if: steps.plan.outputs.count != '0'

110 id: auth

@@ -113,11 +114,12 @@ jobs:

114 env:

115 TOKEN: ${{ steps.auth.outputs.token }}

116 run: |

117 + # --publish-interval gives the sparse index time to serve ed-agent

118 + # before ed-agent-tauri's verification build tries to resolve it.

119 cargo workspaces publish \

120 --publish-as-is \

121 --yes \

122 --locked \

120 - --allow-branch "*" \

123 --publish-interval 15 \

124 --token "$TOKEN"

125 - name: Nothing to publish