Repository navigation
Conversation
Cargo.lock was initially added as a kludge to make the old 5.4.0 release workflow pass. It was copied from the published boring-sys archive, so it represented the release state of boring-sys instead of the full workspace. The two downstream crates also used a different resolution: tokio-boring and hyper-boring targeted cc 1.11.1 instead of the cc 1.10.0 selected by boring-sys and boring. This is the complete workspace lockfile for the final 5.4.0 dependency resolution.
Publishing is now handled by the guarded GitHub Actions workflow.
![clanky-the-clanker[bot]](https://avatars.githubusercontent.com/in/5306670?s=60&v=4){kind=small}
There was a problem hiding this comment.
Superseded by the review of
2f0bc015.
This review, of 1d461eb5
💬 Approved with comments — Release tooling is well guarded; the one note is non-blocking: the git-cliff changelog range depends on local tags the script never checks.
Findings: 1 info (1 is an inline comment on the diff)
The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.
📋 Code Quality: 💬 1 info
The release script is sound, with one gap: the changelog range depends on local tags the script never checks.
Recommendation: 💬 Optional Nits
- [INFO] The changelog range depends on local tags, which the script never fetches or checks. (
scripts/release.sh:113)
View full review
scripts/release.sh:113-114:git cliff --offline --unreleasedtakes its range from the latest local tag that matchestag_pattern. The canonical fetch at line 52 uses--no-tags, so a clone without tags (a fresh fork, or a shallow clone) passes every check. The script then writes the whole project history intoRELEASE_NOTESand the commit body. The empty-output check at lines 119-122 does not catch this case.
✅ All other checks passed
🚀 Release: ✅ LGTM
Release risk is low. Publishing stays in the GitHub Actions workflow, and the new script only prepares a local release branch.
🔒 Security: ✅ LGTM
No security issues found.
📖 AGENTS.md: ✅ LGTM
No issues found.
⚡ Performance: ✅ LGTM
No performance issues found.
📝 Documentation: ✅ LGTM
No documentation issues found.
Reviewed commit: 1d461eb5
1d461eb to
2f0bc01
Compare
There was a problem hiding this comment.
✅ Approved — No open findings. The earlier note about the changelog range relying on local tags is fixed: the script now fetches and checks the previous release tag and passes git-cliff an explicit range.
The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.
✅ All checks passed
🚀 Release: ✅ LGTM
Release risk is low. Publishing stays in the GitHub Actions workflow, and the script only prepares a local release branch.
🔒 Security: ✅ LGTM
No security issues found.
📖 AGENTS.md: ✅ LGTM
No issues found.
📋 Code Quality: ✅ LGTM
The script now fetches and checks the previous release tag v<version>. It confirms the tag is an ancestor of the release base and gives git-cliff the explicit range ${previous_tag}..HEAD (scripts/release.sh:53-88, 137-139). The rest of the changes look consistent.
⚡ Performance: ✅ LGTM
No performance issues found.
📝 Documentation: ✅ LGTM
No documentation issues found.
Reviewed commit: 2f0bc015
This fixes
Cargo.lockfor the full workspace and adds a script for preparing release PRs without contacting crates.io. Cargo-release handles the version bump, while git-cliff updates the release notes and commit body. The script checks canonical master and release refs unless--offlineis used. Publishing remains in the guarded GitHub Actions workflow, so the old local publishing script is removed.