ci(release): keep every registry and manifest on one version

SharpeArena publishes to crates.io, npm and PyPI from manifests that nothing rewrote,
so the next bump would have drifted: the publish step reads a stale version, finds it
already on the registry, and skips - green run, nothing shipped. That is how the
sibling repo's npm package stalled two releases behind.

Rewrites five version sites from the workspace version (including the pyo3 crate that
is excluded from the workspace, and the Python __version__ that had already gone
stale), asserts manifests match the tag before publishing, and verifies all three
registries serve the release afterwards.

Author: ReverseZoom2151

.github/workflows/release.yml

@@ -75,6 +75,23 @@ jobs:
       # npm trusted publishing (OIDC) needs npm >= 11.5; provenance is automatic.
       - run: npm install -g npm@latest
 
+      # cargo-release rewrites this manifest from the workspace version (the rules live in
+      # crates/sharpearena/release.toml), so it must already equal the tag. If it does not,
+      # the publish step below reads a stale version, finds it already on the registry, and
+      # "skips" - a green run that shipped nothing. That is exactly how the sibling repo's
+      # npm package stalled at 0.0.10 while its crates went to 0.0.11.
+      - name: Assert the npm manifest matches the release tag
+        if: startsWith(github.ref, 'refs/tags/v')
+        working-directory: npm/sharpearena
+        run: |
+          TAG="${GITHUB_REF_NAME#v}"
+          V=$(node -p "require('./package.json').version")
+          if [ "$V" != "$TAG" ]; then
+            echo "::error file=npm/sharpearena/package.json::version $V does not match tag $TAG - the manifest is stale, cut the release with 'cargo release' so pre-release-replacements rewrite it"
+            exit 1
+          fi
+          echo "ok   npm manifest is at $V"
+
       - name: Publish (skip if version exists)
         working-directory: npm/sharpearena
         run: |
@@ -94,6 +111,25 @@ jobs:
     environment: pypi
     steps:
       - uses: actions/checkout@v6
+
+      # Same stale-manifest trap as the npm job: `skip-existing: true` below turns an
+      # already-published version into a silent no-op, so a pyproject.toml left behind by
+      # a hand-edited bump would ship nothing and still report green. crates/sharpearena-py
+      # is excluded from the Cargo workspace, so only pre-release-replacements move it.
+      - name: Assert the Python manifest matches the release tag
+        if: startsWith(github.ref, 'refs/tags/v')
+        run: |
+          TAG="${GITHUB_REF_NAME#v}"
+          fail=0
+          for f in crates/sharpearena-py/pyproject.toml crates/sharpearena-py/Cargo.toml; do
+            V=$(grep -m1 -E '^version = "' "$f" | sed 's/.*"\(.*\)".*/\1/')
+            if [ "$V" != "$TAG" ]; then
+              echo "::error file=$f::version $V does not match tag $TAG - the manifest is stale, cut the release with 'cargo release' so pre-release-replacements rewrite it"
+              fail=1
+            fi
+          done
+          exit $fail
+
       - name: Build manylinux wheels + sdist
         uses: PyO3/maturin-action@v1
         with:
@@ -114,3 +150,60 @@ jobs:
           # Idempotent re-runs: a version already on PyPI is skipped, not an error
           # (matches the crates + npm skip-if-published guards in this workflow).
           skip-existing: true
+
+  # Every publish step above is skip-if-present, which makes re-runs idempotent but also
+  # lets a surface that shipped nothing still report green. This job asks the three
+  # registries directly, so an incomplete release fails the run instead of passing quietly.
+  verify:
+    name: verify every registry serves the release
+    needs: [crates, npm, pypi]
+    if: always() && startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+      - name: Assert crates.io, npm and PyPI all serve the tag version
+        run: |
+          TAG="${GITHUB_REF_NAME#v}"
+          UA="sharpearena-release (general-liquidity)" # crates.io rejects requests without a User-Agent
+          fail=0
+
+          if [ "${{ vars.PUBLISH_CRATES }}" = "true" ]; then
+            for c in sharpearena sharpearena-wasm; do
+              if curl -s -A "$UA" "https://crates.io/api/v1/crates/$c/$TAG" | grep -q "\"num\":\"$TAG\""; then
+                echo "ok   crates.io $c@$TAG"
+              else
+                echo "::error::crates.io is not serving $c@$TAG"; fail=1
+              fi
+            done
+          fi
+
+          if [ "${{ vars.PUBLISH_NPM }}" = "true" ]; then
+            ok=0
+            # the registry read-path lags a few seconds behind a publish
+            for i in $(seq 1 20); do
+              if [ "$(npm view "@general-liquidity/sharpearena@$TAG" version 2>/dev/null)" = "$TAG" ]; then ok=1; break; fi
+              sleep 5
+            done
+            if [ "$ok" = "1" ]; then
+              echo "ok   npm @general-liquidity/sharpearena@$TAG"
+            else
+              echo "::error::npm is not serving @general-liquidity/sharpearena@$TAG"; fail=1
+            fi
+          fi
+
+          if [ "${{ vars.PUBLISH_PYPI }}" = "true" ]; then
+            ok=0
+            for i in $(seq 1 20); do
+              if curl -sf -A "$UA" "https://pypi.org/pypi/sharpearena/$TAG/json" >/dev/null; then ok=1; break; fi
+              sleep 5
+            done
+            if [ "$ok" = "1" ]; then
+              echo "ok   PyPI sharpearena@$TAG"
+            else
+              echo "::error::PyPI is not serving sharpearena@$TAG"; fail=1
+            fi
+          fi
+
+          exit $fail

RELEASING.md

@@ -18,6 +18,20 @@ cargo release patch --execute  # bump shared version + rewrite pins + tag vX.Y.Z
 `release.toml` sets `publish = false` — the local machine never publishes. The `v*`
 tag triggers CI, which publishes via **OIDC Trusted Publishing** (no stored tokens).
 
+Never hand-edit a version. `Cargo.toml` is the only place one is authored: the npm
+`package.json` and the two `crates/sharpearena-py` manifests (that crate is excluded from
+the Cargo workspace) are rewritten from the workspace version by `pre-release-replacements`
+in **`crates/sharpearena/release.toml`** — they live on the crate, not at the workspace
+root, because cargo-release resolves `file` relative to each crate being processed.
+
+Three guards keep the surfaces in lockstep, because every publish step is skip-if-present
+and a stale manifest therefore ships nothing while still reporting green:
+
+1. `pre-release-replacements` rewrite all three non-inherited manifests on every bump.
+2. The npm and PyPI jobs assert their manifest equals the tag *before* publishing.
+3. The `verify` job queries crates.io, npm and PyPI after the fact and fails the run if
+   any of them is not serving the tag version.
+
 ## One-time publishing setup (pending)
 
 Before the first CI publish, each registry needs its trusted publisher configured —

crates/sharpearena-py/python/sharpearena/__init__.py

@@ -294,4 +294,4 @@
     "DEFAULT_THRESHOLDS",
     "register_envs",
 ]
-__version__ = "0.6.0"
+__version__ = "0.7.0"

crates/sharpearena/release.toml

@@ -0,0 +1,49 @@
+# Version rewrites for the non-Cargo-workspace release surfaces, attached to this crate
+# because cargo-release resolves `file` relative to the crate being processed, not to the
+# workspace root. Workspace-level rules look under crates/<first-crate>/ and abort. This
+# crate is the root of the published surface, so the rules belong here; the shared release
+# settings stay in the workspace release.toml.
+#
+# Without these the manifests keep the previous version across a bump, the publish step
+# finds that version already on the registry, and skips - reporting success while shipping
+# nothing. That is exactly how the sibling repo's npm package stalled at 0.0.10 while its
+# crates went to 0.0.11. Cargo.toml is the only place a version is authored.
+
+# npm: @general-liquidity/sharpearena. NOT workspace-inherited.
+[[pre-release-replacements]]
+file = "../../npm/sharpearena/package.json"
+search = '"version": "[0-9]+\.[0-9]+\.[0-9]+"'
+replace = '"version": "{{version}}"'
+exactly = 1
+
+# PyPI: sharpearena. crates/sharpearena-py is EXCLUDED from the workspace (pyo3
+# extension-module needs an interpreter at build time), so cargo-release never touches
+# it on its own - both its pyproject.toml and its Cargo.toml need explicit rules.
+[[pre-release-replacements]]
+file = "../../crates/sharpearena-py/pyproject.toml"
+search = '^version = "[0-9]+\.[0-9]+\.[0-9]+"'
+replace = 'version = "{{version}}"'
+exactly = 1
+
+[[pre-release-replacements]]
+file = "../../crates/sharpearena-py/Cargo.toml"
+search = '^version = "[0-9]+\.[0-9]+\.[0-9]+"'
+replace = 'version = "{{version}}"'
+exactly = 1
+
+# The pyo3 crate pins the published `sharpearena` version alongside the path dep, so it
+# must move in lockstep or the sdist resolves against a version that no longer exists.
+[[pre-release-replacements]]
+file = "../../crates/sharpearena-py/Cargo.toml"
+search = 'sharpearena = \{ path = "\.\./sharpearena", version = "[0-9]+\.[0-9]+\.[0-9]+" \}'
+replace = 'sharpearena = { path = "../sharpearena", version = "{{version}}" }'
+exactly = 1
+
+# The Python package reports its own version too, and this one had already gone stale: it
+# still said 0.6.0 after 0.6.1 and 0.7.0 shipped, so `sharpearena.__version__` lied about
+# which release was installed. Same drift, just further from the registries.
+[[pre-release-replacements]]
+file = "../../crates/sharpearena-py/python/sharpearena/__init__.py"
+search = '^__version__ = "[0-9]+\.[0-9]+\.[0-9]+"'
+replace = '__version__ = "{{version}}"'
+exactly = 1

release.toml

@@ -8,7 +8,17 @@
 #   cargo release patch --execute    # bump + tag + push  (publishing happens in CI)
 #
 # Publishing is done by CI via OIDC Trusted Publishing on the `v*` tag (see
-# RELEASING.md), NOT from the local machine — so `publish = false` here.
+# RELEASING.md), NOT from the local machine — so `publish = false` here. This is not just
+# a preference: these crates are Trusted-Publishing-only on crates.io, so a token upload
+# from a laptop is refused with a 403 ("New versions of this crate can only be published
+# using Trusted Publishing") part-way through the workspace, leaving a half-published
+# release behind. The `v*` tag is the only publish path.
+#
+# The three registry manifests that are NOT Cargo-workspace-inherited (npm/sharpearena,
+# and crates/sharpearena-py, which is excluded from the workspace) are rewritten from the
+# workspace version by `pre-release-replacements`. Those rules live in
+# crates/sharpearena/release.toml, because cargo-release resolves `file` relative to each
+# crate rather than to the workspace root - a workspace-level rule aborts.
 
 shared-version = true
 consolidate-commits = true