Adopt tag-driven crate releases - #54
Conversation
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.
Tip: disable this comment in your organization's Code Review settings.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1f2434efaf
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| Gatehouse releases are driven by a version tag. Do not create or publish the | ||
| GitHub Release manually; the release workflow creates it only after crates.io | ||
| publication succeeds. |
There was a problem hiding this comment.
This tag-driven procedure leaves the root AGENTS.md telling coding agents the opposite release flow: it still says publishing a GitHub Release triggers cargo publish and describes a different split between feature and release PR versioning. Because scoped agent instructions take precedence over ordinary documentation, a future release task could follow that stale procedure, manually create the release, and cause this workflow's final job to fail after crates.io publication. Update AGENTS.md alongside this change.
AGENTS.md reference: AGENTS.md:L23-L24
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Pull request overview
This PR moves Gatehouse’s release process from “GitHub Release published triggers crates.io publish” to a tag-driven workflow (v*) that verifies the tag matches Cargo.toml, confirms CI passed on the exact tagged SHA, audits/dry-runs packaging, publishes via crates.io Trusted Publishing (OIDC), and only then creates the GitHub Release. It also adds operator documentation for the new process.
Changes:
- Add a dedicated tag-push release workflow with version/CI gates, audit + dry-run checks, OIDC publish, and final GitHub Release creation.
- Remove the previous CI workflow’s
release: publishedtrigger and crates.io publish job. - Document one-time crates.io Trusted Publisher setup and the step-by-step release procedure.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| RELEASING.md | Documents the new tag-driven release process and required crates.io Trusted Publisher setup. |
| .github/workflows/release.yml | Implements the tag-driven release pipeline (verification → audit/dry-run → OIDC publish → GitHub Release). |
| .github/workflows/ci.yml | Removes the old “Release on GitHub Release published” publishing path from CI. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| -f branch=main \ | ||
| -f head_sha="${EXPECTED_SHA}" \ | ||
| -f event=push \ | ||
| -f status=success \ | ||
| -f per_page=100 \ |
| args=(--verify-tag --title "$TAG" --generate-notes) | ||
| if [ -s release-notes.md ]; then | ||
| args+=(--notes-file release-notes.md) | ||
| fi |
Summary
v*tag workflowmainCI on the exact tagged SHARequired before v0.5.1
Configure the
gatehousecrate on crates.io with a GitHub Trusted Publisher forthepartly/gatehouse, workflowrelease.yml, with no environment.Validation
cargo auditcargo publish --dry-run --locked --allow-dirtygit diff --check