ci: catch release-bump dependency rebinds on the PR that causes them

.github/workflows/rust.yml

@@ -74,3 +74,22 @@ jobs:
             echo "::error::doublezero CLI is not statically linked"
             exit 1
           fi
+  # The release bump runs `cargo update --workspace`, which can silently rebind
+  # members onto a different locked minor.
+  release-bump-dry-run:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@1.97.1
+      - name: Dry-run the release version bump
+        run: |
+          set -euo pipefail
+          PREV=$(grep -m1 '^version = ' Cargo.toml | sed 's/version = "\(.*\)"/\1/')
+          NEXT=$(echo "$PREV" | awk -F. '{print $1"."$2+1".0"}')
+          echo "Dry-running the release bump $PREV -> $NEXT; the result is discarded."
+          if ! ./scripts/release/bump-version.sh "$NEXT"; then
+            echo "Fix: if the failure lists Cargo.lock lines, cargo update --workspace rebound a workspace dependency onto a different version. Pin the offending requirement in [workspace.dependencies] to its locked minor (0.13, not a bare 0). The guard lives in scripts/release/bump-version.sh."
+            echo "If the rebind looks unrelated to your changes, check this job on main: re-resolution runs against the live crates.io index, so a rebind can pre-date your PR or arrive with an upstream publish."
+            echo "::error::The release version bump fails on this tree, so the next release would fail the same way. The cause and the fix are in this job's log."
+            exit 1
+          fi

CHANGELOG.md

@@ -11,6 +11,8 @@ All notable changes to this project will be documented in this file.
 
 ### Changes
 
+- CI
+  - The new `release-bump-dry-run` job dry-runs the release version bump on every PR, so a `cargo update --workspace` dependency rebind fails on the PR that causes it instead of a week later at release time, as it did for v0.37.0 (#4213, fixed in #4219). Advisory until its context is added to the `main` ruleset. (#4220)
 - CLI
   - `doublezero connect Multicast` with N groups is one transaction in the common case (all groups sharing one publisher/subscriber flag pair fold into the create, skipping the activation wait); `doublezero multicast subscribe|unsubscribe|publish|unpublish`, `doublezero user subscribe`, and the role-strip cleanup in `user delete`/`request-ban` batch their role changes by flag pair, chunked to 16 groups per transaction. Failure reporting in the multicast verbs is per batch: a failed batch lists every group it carried, since none was applied. (malbeclabs/infra#2114)
   - `doublezero feed update|delete --force-unsubscribe` strips each user's orphaned groups with one batched role update per user (chunked to 16 groups per transaction) instead of one transaction per group. (malbeclabs/infra#2114)

docs/testnet-release.md

@@ -88,6 +88,15 @@ are merged — this pushes the tags" / "approve only after the programs are depl
 on nyc-tn-bm2"). Each gate is followed by a verification step, so approving the
 wrong thing or approving early fails fast rather than advancing the release.
 
+`open-prs` failing on the `Cargo.lock` guard in `bump-version.sh` should be rare:
+the `release-bump-dry-run` job in `.github/workflows/rust.yml` dry-runs the same
+script on every PR and every push to `main`. It is not airtight — the job is
+advisory until its context is added to the `main` ruleset, so a red X can be merged
+past, and the bump re-resolves against the live crates.io index, so two
+individually green PRs can still combine into a rebind. When it does fail here,
+read the guard output: the fix is to pin the rebound requirement to its locked
+minor.
+
 ## Dry-run mode
 
 `dry_run=true` exercises the plumbing without releasing anything: