From 473cd1b0dcdd5f92f4d437c72eab8e1baf661df8 Mon Sep 17 00:00:00 2001 From: blacktoe Date: Tue, 15 Sep 2026 22:38:01 +1000 Subject: [PATCH] ci(ci): Pin the three tools that prepare a release `git-cliff@2` floated on a major and `cargo binstall --no-confirm cargo-release` took whatever was newest, so the two tools that write the release commit and the changelog were both unpinned, and so was the `cargo-binstall` that fetches one of them. A release cut today and the same release cut next month were not made by the same tools. All three are pinned to the versions that cut v0.4.4, read off that run rather than chosen: git-cliff 2.14.1, cargo-binstall 1.23.0 and cargo-release 1.1.5. cargo-release stays behind `cargo binstall` rather than joining the other two in `taiki-e/install-action`, because that action does not carry it. What the pins cost is that they go stale quietly. Dependabot bumps the `uses:` line above them but not a version inside `tool:` or inside a `run:`, so these three are bumped by hand, which the comment beside them now says. Co-Authored-By: Claude Opus 5 --- .github/workflows/prepare-release.yml | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml index 33ce2cee..314ca5e9 100644 --- a/.github/workflows/prepare-release.yml +++ b/.github/workflows/prepare-release.yml @@ -51,12 +51,20 @@ jobs: - uses: taiki-e/install-action@d438492cf8a250514fa2d34b30bc3c0dc37c65ff # v2.87.8 with: - # cliff.toml is written against the version 2 template syntax - tool: cargo-binstall,git-cliff@2 + # pinned exactly, because these two write the release commit and the + # changelog and a tool that floats makes a release unreproducible. + # these are the versions that cut v0.4.4. cliff.toml is written + # against git-cliff's version 2 template syntax, so a major bump here + # is a template change as well as a version one. dependabot bumps the + # `uses:` line above but not a version inside `tool:`, so these two + # are bumped by hand + tool: cargo-binstall@1.23.0,git-cliff@2.14.1 - name: Install cargo-release run: | - cargo binstall --no-confirm cargo-release + # pinned for the reason above. installed here rather than through the + # action, which does not carry cargo-release + cargo binstall --no-confirm cargo-release@1.1.5 # binstall can exit zero without installing anything, so fail here # rather than several steps later with a confusing error cargo release --version