Half of this works. Conventional Commits are enforced at commit time, the
version is computed from them by git cliff into cargo release, the bump
writes the current release into the README, and a test fails if that line and
Cargo.toml ever disagree. Bumping is a maintainer act on main rather than
something a PR does, because several branches are open at once and every one of
them would otherwise edit the same version = line.
Publish the built docs somewhere. target/doc is a self-contained static
tree with no external requests, and Tangled hosts static sites, but
building it on a push needs a spindle this repo does not have. Where it
goes is chosen — atgc.codes rather than a Tangled static site — but the
site is not online yet, so this is still the whole entry: stand it up,
and build and push the tree on a release
[patch.crates-io] does not travel to crates.io , and three fixes
ride on it.tangled-lexicon and
userinput-lexicon as the path dependencies that block publication;
there is a third thing in the way and it fails differently. The
vendored jacquard-oauth is not a dependency but a [patch] override,
which is a workspace-local source replacement — a consumer building the
published crate resolves jacquard-oauth from crates.io . vendor/ is
not in the include allowlist either, so the vendored source does not
ship at all.
What rides on that patch is not cosmetic. (1) rpc:<nsid>?aud=* scopes
serialize as bare rpc:<nsid>, which Bluesky PDSes match to no
audience, so service auth fails and pr merge, stack merge,
repo create and delete-branch stop working. (2) There is no
cross-process refresh lock, which is the single-use refresh token race
that deletes a live session — the one credential-store spent three
pull requests closing. (3) A server-returned scope is parsed with
Scopes::new().expect(), so an authorization server granting a scope
jacquard cannot spell aborts the process : bsky.social granting
repo: killed auth login mid-callback. That is a panic in the first
command a new user runs.
So publishing today would ship a binary that panics during login for
bsky.social accounts and cannot do knot service auth — or, if cargo
retains the patch instead of dropping it, one that fails to build at
all on a vendor/ path the tarball does not carry. Which of the two
was not settled here: cargo package aborts on the entry below before
it gets far enough to say. Settle it with a real cargo package
once the path dependencies are resolved, before any publish. The way
out is upstreaming all three, or depending on a published fork; both
are decisions rather than hygiene
atgc cannot be published to crates.io as it stands, and cargo-deny is
what said so: tangled-lexicon and userinput-lexicon are path
dependencies with no version requirement, which is a wildcard, and
allow-wildcard-paths is only consulted for a crate that is itself
publish = false. atgc is not, so bans failed. The finding is real —
crates.io disallows path dependencies, and both crates are
publish = false, so cargo publish would refuse for the same reason
one step later. Left as a finding rather than fixed: the choices are to
publish the two generated crates, to inline them, or to say atgc is not
publishable, and none of those belongs in a hygiene pass. wildcards
is "warn" meanwhile, so it is printed on every run instead of failing
every run; restore "deny" with the fix
The 1.0.0 arc: CI (the spindle entry under pipelines), publishing to
crates.io , and the release binaries above are deliberately deferred and
meant to land together after 1.0.0 ships. Each one needs credentials and
a signup, each is hard to get right, and doing them piecemeal leaves
three half-configured pipelines
scripts/release.sh refuses to cut 1.0.0 or later while cliff.toml
still carries the 0.x bumping rule. breaking_always_bump_major = false
is correct below 1.0 and argued where it is set — no compatibility
promise has been made, so a ! moving the minor is the usual reading of
semver's 0.y.z clause, and 1.0.0 is meant to be a version somebody types
on purpose. What nothing enforced was the other half: on the day 1.0.0
ships that flag has to become true, or the first breaking change after
it computes 1.1.0 and publishes silently, and docs/output.md's promise
that renaming a --json field is a breaking ! stops meaning anything
when a ! and a plain feat produce the same number. A wrong version on
crates.io cannot be unpublished or reused, so it is checked rather than
remembered
--version says which build, not just which release — the commit on the
version line, then target triple, profile and rustc under it. -V stays
one bare line for scripts. build.rs records the four while they are
still knowable and src/build_info.rs is the only reader; every value
can be empty and an empty one drops its line, because a crates.io
tarball carries no .git and commit unknown would be worse than no
commit line in exactly the build this is groundwork for. No dirty flag
and no build timestamp, both on purpose — see build.rs for why each
would have been a field that lies
Conventional Commits enforced at commit time by committed as a
commit-msg hook, and the version in Cargo.toml computed from them —
git cliff --bumped-version into cargo release (cliff.toml,
committed.toml, release.toml). Bumped on main as a maintainer act, not
inside a PR: several branches are open at once and every one of them
would otherwise edit the same version = line. Breaking changes bump
the minor while pre-1.0, overriding git-cliff's jump to 1.0.0. No longer
unexercised: v0.2.0, v0.2.1 and v0.3.0 were all cut this way, through
scripts/release.sh
The bump also writes which release is current into the README, on an
italic line under the lockup linking the tag on Tangled. A
pre-release-replacements rule in release.toml rewrites the block
between two HTML comment markers, so it lands in the chore(release):
commit rather than trailing it; tests/release_metadata.rs fails if
that line and Cargo.toml ever disagree. The markers, rather than a
match on the prose, because the line is meant to grow — see the
release-artifacts entry above, which is what it should point at once
there is a built binary to point at
Push the v0.1.0 epoch tag. Annotated, on 6d16818 — the last commit
before Conventional Commits start — so the first bump counts every
conforming commit. It is on origin, and the bumps since have counted
from it
