From ad17915e49ebdc7014ee72c67970218602ff7935 Mon Sep 17 00:00:00 2001 From: kingchenc Date: Fri, 22 May 2026 12:32:04 +0200 Subject: [PATCH] D3: drop --allow-dirty --no-verify from release cargo package The release workflow built the .crate attachments with `cargo package --allow-dirty --no-verify`, so the attached artefact could diverge from the tagged tree and was never proven to build. Remove both flags. actions/checkout provides a clean tree and no prior step mutates it, so --allow-dirty is unnecessary. The crates are published to crates.io earlier in the same job, so the verification build now resolves workspace dependencies from the registry and confirms each .crate compiles before it is attached. --- .github/workflows/release.yml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1a24636f..3774762c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -54,11 +54,17 @@ jobs: # Produce .crate files for the GitHub Release attachments. `cargo package` # writes them to target/package/-.crate. + # + # No --allow-dirty: `actions/checkout` gives a clean tree and nothing + # above mutates it. No --no-verify: every crate was just published to + # crates.io in the steps above, so the verification build resolves its + # workspace dependencies from the registry and confirms each .crate + # actually builds before it is attached to the release. - name: Build .crate files for release attachment run: | - cargo package -p wickra-core --allow-dirty --no-verify - cargo package -p wickra-data --allow-dirty --no-verify - cargo package -p wickra --allow-dirty --no-verify + cargo package -p wickra-core + cargo package -p wickra-data + cargo package -p wickra - name: Upload .crate files uses: actions/upload-artifact@v4