BUNYIP-59: immutable release tags, Cargo.lock sync, tag-collision guard #79

Merged

nrupard merged 1 commit from fix/bunyip-59-release-hygiene into main

2026-06-08 21:52:07 +02:00

nrupard commented

2026-06-08 21:50:15 +02:00

Owner

Fixes BUNYIP-59. Three release-process defects surfaced shipping the BUNYIP-58 fix.

Changes

Immutable version tags (bunyip-api/oci-build/get-tags.nu, bunyip-web/oci-build/get-tags.nu): a vX.Y.Z image tag is emitted only on a CI tag event (GITHUB_REF=refs/tags/vX.Y.Z), or for local runs with no CI ref when HEAD is exactly on a v* tag. CI branch builds (main, feature-*) publish only latest. A routine push to main can no longer re-push and silently overwrite an already-released version tag, which is how the stub v0.2.0 lingered. Verified all three paths: tag event -> vX.Y.Z,latest; main branch -> latest; local-on-tag -> vX.Y.Z,latest.
Cargo.lock sync in create-release (justfile): after the version bump, run cargo update --workspace and git add Cargo.lock in the same release commit. The workspace crates inherit version.workspace, so the bump changes their lock entries; v0.2.1 had to be hand-edited.
Tag-collision guard (justfile): abort if the computed tag already exists, so a stale manifest version can never target a published release (this is what produced the erroneous v0.1.2 attempt).
CI lock guard (.forgejo/workflows/check.yml): build with --locked so a forgotten lock sync fails check instead of the release build.

Not included

Deleting the off-history v0.2.0 git tag is destructive (published tag) and left to an operator. After this merges, git push origin :refs/tags/v0.2.0 (and optionally prune the stale v0.2.0 images) reconciles the tag state; the working release is v0.2.1, cut correctly from main.

#BUNYIP-59

Fixes BUNYIP-59. Three release-process defects surfaced shipping the BUNYIP-58 fix. ## Changes - **Immutable version tags** (`bunyip-api/oci-build/get-tags.nu`, `bunyip-web/oci-build/get-tags.nu`): a `vX.Y.Z` image tag is emitted only on a CI tag event (`GITHUB_REF=refs/tags/vX.Y.Z`), or for local runs with no CI ref when HEAD is exactly on a `v*` tag. CI branch builds (`main`, `feature-*`) publish only `latest`. A routine push to main can no longer re-push and silently overwrite an already-released version tag, which is how the stub `v0.2.0` lingered. Verified all three paths: tag event -> `vX.Y.Z,latest`; main branch -> `latest`; local-on-tag -> `vX.Y.Z,latest`. - **Cargo.lock sync in `create-release`** (`justfile`): after the version bump, run `cargo update --workspace` and `git add Cargo.lock` in the same release commit. The workspace crates inherit `version.workspace`, so the bump changes their lock entries; v0.2.1 had to be hand-edited. - **Tag-collision guard** (`justfile`): abort if the computed tag already exists, so a stale manifest version can never target a published release (this is what produced the erroneous v0.1.2 attempt). - **CI lock guard** (`.forgejo/workflows/check.yml`): build with `--locked` so a forgotten lock sync fails `check` instead of the release build. ## Not included Deleting the off-history `v0.2.0` git tag is destructive (published tag) and left to an operator. After this merges, `git push origin :refs/tags/v0.2.0` (and optionally prune the stale `v0.2.0` images) reconciles the tag state; the working release is `v0.2.1`, cut correctly from main. #BUNYIP-59

nrupard added 1 commit

2026-06-08 21:50:15 +02:00

fix(release): immutable version tags, lockfile sync, tag-collision guard

Check / fmt / clippy / build / test (pull_request) Successful in 1m8s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

881e1c1b2c

Three release-hygiene fixes (BUNYIP-58 surfaced all of them):

get-tags.nu (api + web): version tags are now immutable. A vX.Y.Z image tag is emitted only on a CI tag event (GITHUB_REF=refs/tags/vX.Y.Z) or, for local runs with no CI ref, when HEAD is exactly on a v* tag. CI branch builds (main, feature-*) publish only latest, so a routine push can no longer re-push and overwrite an already-released version tag.

create-release: sync Cargo.lock in the release commit (the workspace crates inherit version.workspace, so the bump changes their lock entries and CI builds --locked), and abort if the target tag already exists so a stale manifest can never target a published release.

check.yml: build with --locked so a manifest bump that forgot to sync Cargo.lock fails CI instead of breaking the release build.

Not included (destructive, left to an operator): deleting the off-history v0.2.0 git tag.

#BUNYIP-59