fix(ci): run publish-crates on the dev runner image (VA-145) #157

Merged

David merged 1 commit from fix/VA-145-publish-crates-dev-runner into main

2026-08-08 19:07:19 +02:00

David commented

2026-08-08 18:53:39 +02:00

Owner

Problem

Run #661 (publish-crates.yml, tag v0.4.2) failed at cargo publish with error: linker `cc` not found. cargo publish compiles the packaged tarball on the runner host during its verify stage, but the job ran on RUNS_ON_OPENSUSE_BASE_LATEST, which ships cargo/rustc and no C toolchain. Every build-script crate (proc-macro2, quote, serde, serde_json, thiserror, zmij) failed to link, the loop died on crate 1 of 2, and tag v0.4.2 published zero crates.

Fix

Moved the job to RUNS_ON_OPENSUSE_DEV_LATEST. opensuse-dev is FROM base AS dev and its dev-extras package set adds gcc, clang, and libopenssl-devel, so nushell and the rest of the base tooling carry over unchanged. This is the rule governance/CI.md already states: a job that compiles on the runner host goes on the dev label, everything else (including compiles inside a container) stays on base.

Replaced the job's Verify Docker availability step with a Verify build toolchain preflight for cargo and cc. The job compiles on the runner and never touches Docker, so the old step proved nothing while the real prerequisite went unchecked until minutes into a dependency compile. The new step fails in about a second and names the label to check.

Annotated every runs-on in the repo with the reason its label is correct, per governance/CI.md: an unannotated base label is indistinguishable from an unaudited one, and this defect hides behind a warm Swatinem/rust-cache restore, so a green history is not evidence the label is right.

Audit of the other six jobs

Workflow / job	Compiles where	Label	Verdict
`publish-crates.yml` publish	`cargo publish` verify, on the runner	was BASE	violating, now DEV
`check.yml` check	inside `check.Dockerfile`	BASE	correct
`build-package.yml` build-and-upload	inside `release.Dockerfile`	BASE	correct
`build-windows.yml` build-and-upload	inside `release-windows.Dockerfile` and `release.Dockerfile`	BASE	correct
`create-release.yml` create-release	compiles nothing	BASE	correct
`build-macos.yml` build-and-upload	on the runner, native	MACOS	N/A, Xcode command line tools supply clang/ld
`check-macos-features.yml` check	on the runner, native	MACOS	N/A, same

Only publish-crates.yml was on the wrong label.

Verification

The preflight snippet was run against the installed nushell 0.112.2 and exits 0 with cargo 1.94.1 / cc (SUSE Linux) 15.3.0; all seven workflow files parse as valid YAML. just pre-commit passed via the git hook.

Follow-up (not part of this PR)

v0.4.2 still has no crates in the registry. After this merges, republish the existing tag without recreating it: fj --host dev.a8n.run actions dispatch publish-crates.yml main --input ref=v0.4.2.

#VA-145

## Problem Run [#661](https://dev.a8n.run/psa-systems/vervain-agent/actions/runs/661) (`publish-crates.yml`, tag `v0.4.2`) failed at `cargo publish` with ``error: linker `cc` not found``. `cargo publish` compiles the packaged tarball on the runner host during its verify stage, but the job ran on `RUNS_ON_OPENSUSE_BASE_LATEST`, which ships `cargo`/`rustc` and no C toolchain. Every build-script crate (proc-macro2, quote, serde, serde_json, thiserror, zmij) failed to link, the loop died on crate 1 of 2, and tag `v0.4.2` published zero crates. ## Fix Moved the job to `RUNS_ON_OPENSUSE_DEV_LATEST`. `opensuse-dev` is `FROM base AS dev` and its `dev-extras` package set adds `gcc`, `clang`, and `libopenssl-devel`, so nushell and the rest of the base tooling carry over unchanged. This is the rule `governance/CI.md` already states: a job that compiles on the runner host goes on the dev label, everything else (including compiles inside a container) stays on base. Replaced the job's `Verify Docker availability` step with a `Verify build toolchain` preflight for `cargo` and `cc`. The job compiles on the runner and never touches Docker, so the old step proved nothing while the real prerequisite went unchecked until minutes into a dependency compile. The new step fails in about a second and names the label to check. Annotated every `runs-on` in the repo with the reason its label is correct, per `governance/CI.md`: an unannotated base label is indistinguishable from an unaudited one, and this defect hides behind a warm `Swatinem/rust-cache` restore, so a green history is not evidence the label is right. ## Audit of the other six jobs | Workflow / job | Compiles where | Label | Verdict | |---|---|---|---| | `publish-crates.yml` publish | `cargo publish` verify, on the runner | was BASE | violating, now DEV | | `check.yml` check | inside `check.Dockerfile` | BASE | correct | | `build-package.yml` build-and-upload | inside `release.Dockerfile` | BASE | correct | | `build-windows.yml` build-and-upload | inside `release-windows.Dockerfile` and `release.Dockerfile` | BASE | correct | | `create-release.yml` create-release | compiles nothing | BASE | correct | | `build-macos.yml` build-and-upload | on the runner, native | MACOS | N/A, Xcode command line tools supply clang/ld | | `check-macos-features.yml` check | on the runner, native | MACOS | N/A, same | Only `publish-crates.yml` was on the wrong label. ## Verification The preflight snippet was run against the installed nushell 0.112.2 and exits 0 with `cargo 1.94.1` / `cc (SUSE Linux) 15.3.0`; all seven workflow files parse as valid YAML. `just pre-commit` passed via the git hook. ## Follow-up (not part of this PR) `v0.4.2` still has no crates in the registry. After this merges, republish the existing tag without recreating it: `fj --host dev.a8n.run actions dispatch publish-crates.yml main --input ref=v0.4.2`. #VA-145

David added 1 commit

2026-08-08 18:53:39 +02:00

fix(ci): run publish-crates on the dev runner image

Check / fmt + clippy + tests (pull_request) Successful in 13m38s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

e5a48deadb

`cargo publish` compiles the packaged tarball on the runner host during its verify stage, so the job needs the C toolchain. It ran on `RUNS_ON_OPENSUSE_BASE_LATEST`, which ships cargo/rustc but no `cc`, and every build-script crate failed with ``error: linker `cc` not found``; the v0.4.2 tag published zero crates. Moved the job to `RUNS_ON_OPENSUSE_DEV_LATEST`, which adds gcc/ld plus the glibc and OpenSSL headers.

Replaced the job's `Verify Docker availability` step with a `Verify build toolchain` preflight: the job compiles on the runner and never touches Docker, so checking Docker proved nothing while the actual prerequisite went unchecked until minutes into a dependency compile.

Annotated every `runs-on` in the repo with the reason its label is correct, per governance/CI.md: an unannotated base label is indistinguishable from an unaudited one. Audit of the other six jobs: check, build-package, and build-windows compile inside a Dockerfile so the runner only needs Docker; create-release compiles nothing; the two macOS jobs compile natively but get clang/ld from the Xcode command line tools. All correct as they stand.

#VA-145

David scheduled this pull request to auto merge when all checks succeed

2026-08-08 18:56:34 +02:00