ci: catch release-bump dependency rebinds on the PR that causes them - #4223
Open
nikw9944 wants to merge 4 commits into
Open
ci: catch release-bump dependency rebinds on the PR that causes them#4223nikw9944 wants to merge 4 commits into
nikw9944 wants to merge 4 commits into
Conversation
packethog
approved these changes
Aug 21, 2026
The release's version bump runs cargo update --workspace, which re-resolves every workspace member's dependency edges and can silently rebind them onto a different locked minor. bump-version.sh already fails on that, but only ran at release time, so the rebind that broke the v0.37.0 testnet release sat dormant for a week after the PR that made it possible. Run the same script against a throwaway next-minor version in PR CI and discard the result, so the failure lands on the PR that causes it. Refs #4220
Say plainly that the job is advisory until its context is added to the main ruleset, and that a rebind can also arrive from the live crates.io index rather than from the PR under test. Move the remedy into plain log lines so the error annotation stays short enough to read in the Annotations panel. Refs #4220
nikw9944
force-pushed
the
nikw9944/doublezero-4220
branch
from
August 21, 2026 20:58
bfa8b10 to
451150f
Compare
nikw9944
enabled auto-merge (squash)
August 21, 2026 21:01
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary of Changes
release-bump-dry-runjob runs the realscripts/release/bump-version.shagainst a throwaway next-minor version on every PR and push tomain, then discards the result.cargo update --workspacecan silently rebind workspace members onto a different locked minor.bump-version.shalready fails on that, but only ran at release time, so the rebind that broke v0.37.0 sat dormant for a week after ip-verifier: add the IP ownership verification service #4213 (pinned in deps: pin reqwest and tokio-util to their locked 0.x minors #4219). This puts the failure on the PR that causes it.Two things the diff cannot cover:
rust.ymlconfers nothing (rust-validator-testandrust-cli-staticare in this workflow and not required either). Once it is green onmain, append{"context":"release-bump-dry-run"}torequired_status_checks. Noted in the docs paragraph and CHANGELOG entry.maintoo. This is the release-day flakiness moved somewhere cheap to fix; the remedy is always to pin the requirement, which the job's failure output says.The bare-
"0"lint (item 2 in #4220) is out: 27 such requirements remain and would all need pinning first, and this guard catches the consequence however the requirement is spelled.Testing Verification
95336a36(ip-verifier: add the IP ownership verification service #4213 as merged, pre-deps: pin reqwest and tokio-util to their locked 0.x minors #4219): fails, naming the addedreqwest 0.12.28/tokio-util 0.6.10lines and the newhyper-tls/native-tls/tokio-native-tlspackages — the same diagnosis the v0.37.0 release produced a week later. Passes on the current tree.Cargo.tomlalready bumped, CHANGELOG already promoted): next-minor keepsPREV != NEW, the second bump adds only member version lines, job passes. No special-casing needed.