Repository navigation
fix(release): count lockfile changes only when the published crate's dependencies change - #60
Conversation
…dependencies change The version gate treated every Cargo.lock diff as a change to the published atrinik-protocol package. Cargo trims a packaged crate's Cargo.lock to the graph reachable from that crate, so an update confined to an unpublished workspace member, such as sha2 for the dev-only rendezvous-conformance tool, cannot change packaged content. For a Cargo.lock change, compare the locked graph reachable from each published crate at the base and the candidate. The walk follows every workspace edge, including dev-dependencies and features enabled by other members, so it can only over-approximate the packaged lock. Unresolvable or ambiguous references fail closed. Manifest, toolchain, crate-path and cargo configuration changes still count unconditionally, and release preparation still compares complete packaged content with the owning archive. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
@codex review |
Dependency Review✅ No vulnerabilities or license issues found.Scanned FilesNone |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cb63a07bb2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Cargo can carry top-level Cargo.lock sections such as [metadata] into a packaged lock. Compare every top-level section other than the package list verbatim, so a lockfile-only edit there still requires a version bump before release preparation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Codex round 1:
|
|
@codex review |
|
Codex Review: Didn't find any major issues. Delightful! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex security review |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
Summary
tools/crate_prepare.py check-versiontreated everyCargo.lockdiff as a change to the publishedatrinik-protocolpackage. That blocks #57 (sha2 0.11.0 → 0.11.1), even though the only sha2 user is the unpublished, dev-onlytools/rendezvous-conformancemember. The publishedatrinik-protocol-0.2.0.crateships a trimmedCargo.lockthat contains no sha2 or hmac.Implementation / behavior
Cargo.lockchanges, compare the locked graph reachable from each published crate at the base and the candidate. Only a difference in that graph, or in the lockfile format version, now counts as changed package content.Cargo.toml, toolchain, crate path and.cargo/changes still count unconditionally. Release preparation still compares complete packaged content with the owning archive, so a missed change would stop preparation rather than publish different bytes at an owned version.check-versioncommand.No generated files, crate versions, publication policy or packaged data changed.
Validation
git diff --checkpass locally.Cargo.lockdiff applied to current main:package content changed without reviewed version bump;prostchecksum, which is in the published graph, still fails.Cargo.lockinside the publishedatrinik-protocol-0.2.0.crate.Protocol validationremains the acceptance gate.Limitations / follow-up
After this merges,
@dependabot rebaseon #57 should let it pass without a crate version bump.seraphinastudios/tilewright-renderercarries a separate copy of this gate. Its sha2 update really does change packaged content and was handled with a version bump there.🤖 Generated with Claude Code