Skip to content

fix: make release workflow resilient to re-runs [skip changelog] #577

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
avifenesh merged 4 commits into from
Feb 27, 2026
Merged

fix: make release workflow resilient to re-runs [skip changelog] #577

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
482b09d
fix: make release workflow resilient to re-runs
avifenesh Feb 27, 2026
0e3e5f1
ci: trigger new workflow run for skip-changelog
avifenesh Feb 27, 2026
2a6e9bd
fix: address review feedback on release workflow
avifenesh Feb 27, 2026
a7d05ef
fix: address second round of review feedback
avifenesh Feb 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
73 changes: 67 additions & 6 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -247,34 +247,85 @@ jobs:
chmod +x /tmp/wait-for-crate.sh

# Publish order: agnix-rules (leaf) -> agnix-core -> agnix-cli/agnix-lsp/agnix-mcp
# Each step tolerates "already exists" errors so re-runs work correctly
- name: Publish agnix-rules
run: cargo publish -p agnix-rules
run: |
set -euo pipefail
VERSION="${{ steps.version.outputs.version }}"
cargo publish -p agnix-rules 2>&1 || {
if cargo search agnix-rules --limit 1 | grep -qF "agnix-rules = \"$VERSION\""; then
echo "agnix-rules $VERSION already published, skipping"
else
echo "Publish failed and crate not found on crates.io"
exit 1
fi

Copilot AI Feb 27, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The “already published” detection relies on cargo search <crate> --limit 1 containing the exact version string. cargo search only returns the latest version, so this can false-negative when re-running older tags after a newer release exists (the older version is published but won’t appear in search output), and it can also false-negative during crates.io indexing lag. Consider instead keying off the cargo publish error output (match the known “already uploaded/exists” message), or querying the crates.io HTTP API for the specific version (/api/v1/crates/<crate>/<version>) with retries before deciding to fail.

Copilot uses AI. Check for mistakes.

@avifenesh avifenesh Feb 27, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed. Extracted into /tmp/publish-crate.sh helper that uses the crates.io HTTP API for reliable version detection instead of cargo search.

}

Copilot AI Feb 27, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This publish/skip logic is duplicated across all crates, which makes it easy for the steps to drift over time (and it’s already long in YAML). Consider generating a small helper script (e.g., /tmp/publish-crate.sh <name> <version>) and calling it for each crate to keep the behavior consistent in one place.

Copilot uses AI. Check for mistakes.

@avifenesh avifenesh Feb 27, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed. All 5 publish steps now call the shared /tmp/publish-crate.sh helper, keeping behavior in one place.

env:
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

- name: Wait for agnix-rules indexing
run: /tmp/wait-for-crate.sh agnix-rules ${{ steps.version.outputs.version }}

- name: Publish agnix-core
run: cargo publish -p agnix-core
run: |
set -euo pipefail
VERSION="${{ steps.version.outputs.version }}"
cargo publish -p agnix-core 2>&1 || {
if cargo search agnix-core --limit 1 | grep -qF "agnix-core = \"$VERSION\""; then
echo "agnix-core $VERSION already published, skipping"
else
echo "Publish failed and crate not found on crates.io"
exit 1
fi
}
env:
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

- name: Wait for agnix-core indexing
run: /tmp/wait-for-crate.sh agnix-core ${{ steps.version.outputs.version }}

- name: Publish agnix-cli
run: cargo publish -p agnix-cli
run: |
set -euo pipefail
VERSION="${{ steps.version.outputs.version }}"
cargo publish -p agnix-cli 2>&1 || {
if cargo search agnix-cli --limit 1 | grep -qF "agnix-cli = \"$VERSION\""; then
echo "agnix-cli $VERSION already published, skipping"
else
echo "Publish failed and crate not found on crates.io"
exit 1
fi
}
env:
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

- name: Publish agnix-lsp
run: cargo publish -p agnix-lsp
run: |
set -euo pipefail
VERSION="${{ steps.version.outputs.version }}"
cargo publish -p agnix-lsp 2>&1 || {
if cargo search agnix-lsp --limit 1 | grep -qF "agnix-lsp = \"$VERSION\""; then
echo "agnix-lsp $VERSION already published, skipping"
else
echo "Publish failed and crate not found on crates.io"
exit 1
fi
}
env:
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

- name: Publish agnix-mcp
run: cargo publish -p agnix-mcp
run: |
set -euo pipefail
VERSION="${{ steps.version.outputs.version }}"
cargo publish -p agnix-mcp 2>&1 || {
if cargo search agnix-mcp --limit 1 | grep -qF "agnix-mcp = \"$VERSION\""; then
echo "agnix-mcp $VERSION already published, skipping"
else
echo "Publish failed and crate not found on crates.io"
exit 1
fi
}
env:
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

Expand Down Expand Up @@ -444,6 +495,8 @@ jobs:
run: npm --prefix website run version:cut -- "${{ steps.version.outputs.version }}"

- name: Commit and push versioned docs
env:
GH_TOKEN: ${{ secrets.COMMITTER_TOKEN }}
run: |
set -euo pipefail
git config user.name "github-actions[bot]"
Expand All @@ -452,6 +505,14 @@ jobs:
if git diff --cached --quiet; then
echo "No changes to commit"
else
BRANCH="docs/version-${{ steps.version.outputs.version }}"
git checkout -b "$BRANCH"
git commit -m "docs: version ${{ steps.version.outputs.version }} docs and update site data"

Copilot AI Feb 27, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using git push --force-with-lease on line 488 is safer than regular force-push, but in this context where the branch is created fresh on line 486 with git checkout -B, the force-with-lease provides limited protection. If this is a re-run and the branch already exists remotely, force-with-lease will prevent overwriting if someone else pushed to it in the meantime.

This is correct behavior for the use case, but consider adding a comment explaining that force-push is intentional for re-runs.

Suggested change
git commit -m "docs: version ${{ steps.version.outputs.version }} docs and update site data"
git commit -m "docs: version ${{ steps.version.outputs.version }} docs and update site data"
# Intentionally force-push to update the auto-generated docs branch on workflow re-runs.

Copilot uses AI. Check for mistakes.

@avifenesh avifenesh Feb 27, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added a comment explaining force-push is intentional for re-runs of the auto-generated docs branch.

git push origin main
git push origin "$BRANCH"
gh pr create \
--base main \
--head "$BRANCH" \
--title "docs: version ${{ steps.version.outputs.version }} docs" \
--body "Auto-generated versioned docs snapshot for v${{ steps.version.outputs.version }}." \
--label "documentation"

Copilot AI Feb 27, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This docs step still isn’t resilient to re-runs: git checkout -b "$BRANCH" will fail if the branch already exists locally/remotely, and gh pr create will fail if a PR for that head branch already exists. To make re-runs safe, consider using git checkout -B (or git switch -C) and either updating the existing PR (detect via gh pr view --head "$BRANCH") or treating “PR already exists” as a non-fatal outcome.

Copilot uses AI. Check for mistakes.

@avifenesh avifenesh Feb 27, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed. Now uses git checkout -B (force-create), git push --force-with-lease, and checks for existing PRs via gh pr view --head before creating.

fi
Loading