Publish rainlang_parser to crates.io - #516
Conversation
Now that rainlang_bindings (0.1.12) and rainlang_dispair (0.1.7) are on crates.io, parser can publish. cargo publish requires path deps to carry a version, so pin the workspace dependency entries, and add rainlang_parser to the Package Release crates list (dependency order: bindings, dispair, parser). Verified parser packages cleanly against the published bindings/dispair. The three crates now release as a lockstep unit, so a change to any member republishes all three and cargo-release keeps parser's pins in sync. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
📝 WalkthroughWalkthroughRelease workflow extended to include ChangesCrate Publication and Dependency Management
🎯 2 (Simple) | ⏱️ ~5 minutes
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/package-release.yaml:
- Line 20: Update the reusable workflow call that currently says "uses:
rainlanguage/rainix/.github/workflows/rainix-autopublish.yaml@main" to pin to an
exact commit SHA (replace `@main` with @<commit-sha>) and remove "secrets:
inherit"; instead explicitly pass only the required secrets by name (e.g.,
secrets: { NPM_TOKEN: ${{ secrets.NPM_TOKEN }}, GITHUB_TOKEN: ${{
secrets.GITHUB_TOKEN }} } or the exact secret names the called workflow
expects). Locate the invocation line with "rainix-autopublish.yaml@main" and the
"secrets: inherit" block in package-release.yaml and replace them accordingly so
the workflow uses a fixed ref and a minimal, explicit secrets mapping.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: b25e27db-e033-43e0-9228-6d2ea7e3913d
📒 Files selected for processing (2)
.github/workflows/package-release.yamlCargo.toml
| # | ||
| # rainlang-eval is still excluded — its foundry-evm git dep blocks | ||
| # `cargo publish` entirely. | ||
| uses: rainlanguage/rainix/.github/workflows/rainix-autopublish.yaml@main |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify mutable workflow refs and inherited secrets in GitHub workflows.
rg -nP --type=yaml '^\s*uses:\s*.+@main\s*$|^\s*secrets:\s*inherit\s*$' .github/workflows -C2Repository: rainlanguage/rainlang
Length of output: 2393
Pin the reusable workflow ref and avoid inheriting all secrets.
.github/workflows/package-release.yaml uses rainix-autopublish.yaml@main (mutable ref) and forwards all secrets via secrets: inherit (broadens blast radius). Pin the workflow to a commit SHA and pass only the specific secrets required by the called workflow.
Suggested hardening
- uses: rainlanguage/rainix/.github/workflows/rainix-autopublish.yaml@main
+ uses: rainlanguage/rainix/.github/workflows/rainix-autopublish.yaml@<commit-sha>
...
- secrets: inherit
+ secrets:
+ PUBLISH_PRIVATE_KEY: ${{ secrets.PUBLISH_PRIVATE_KEY }}🧰 Tools
🪛 zizmor (1.25.2)
[error] 20-20: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[warning] 20-20: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow
(secrets-inherit)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/package-release.yaml at line 20, Update the reusable
workflow call that currently says "uses:
rainlanguage/rainix/.github/workflows/rainix-autopublish.yaml@main" to pin to an
exact commit SHA (replace `@main` with @<commit-sha>) and remove "secrets:
inherit"; instead explicitly pass only the required secrets by name (e.g.,
secrets: { NPM_TOKEN: ${{ secrets.NPM_TOKEN }}, GITHUB_TOKEN: ${{
secrets.GITHUB_TOKEN }} } or the exact secret names the called workflow
expects). Locate the invocation line with "rainix-autopublish.yaml@main" and the
"secrets: inherit" block in package-release.yaml and replace them accordingly so
the workflow uses a fixed ref and a minimal, explicit secrets mapping.
|
@coderabbitai assess this PR size classification for the totality of the PR with the following criterias and report it in your comment: S/M/L PR Classification Guidelines:This guide helps classify merged pull requests by effort and complexity rather than just line count. The goal is to assess the difficulty and scope of changes after they have been completed. Small (S)Characteristics:
Review Effort: Would have taken 5-10 minutes Examples:
Medium (M)Characteristics:
Review Effort: Would have taken 15-30 minutes Examples:
Large (L)Characteristics:
Review Effort: Would have taken 45+ minutes Examples:
Additional Factors to ConsiderWhen deciding between sizes, also consider:
Notes:
|
|
Tip For best results, initiate chat on the files or code changes. SIZE=S |
1 participant
Now that
rainlang_bindings(0.1.12) andrainlang_dispair(0.1.7) are on crates.io,rainlang_parsercan be published.Changes
[workspace.dependencies.rainlang_bindings]→ 0.1.12,rainlang_dispair→ 0.1.7).cargo publishrequires path deps to carry a version; they were path-only.rainlang_parserto the Package Release crates list (dependency order: bindings, dispair, parser).Verified locally:
cargo package -p rainlang_parser --no-verifypackages cleanly against the published bindings/dispair (parser's other deps — alloy, thiserror, tokio — are already versioned; it doesn't touch the foundry/git deps that blockeval).Note on lockstep
The three crates now release as a unit, so merging this triggers a Package Release that bumps + publishes all three (bindings/dispair get a no-content version bump alongside parser), and cargo-release rewrites parser's pins to match. This matches the rain.metadata workspace pattern.
rainlang-evalstays excluded (foundry-evm git dep blocks publish).Merging to main triggers the release.
🤖 Generated with Claude Code
Summary by CodeRabbit