chore(build): vendor common submodule and sync Cargo.lock on release #80

Merged

David merged 1 commit from fix/VAPP-69-adopt-common-cargo-lock into main

2026-07-04 16:02:06 +02:00

David commented

2026-07-04 15:59:12 +02:00

Owner

Summary

Fixes the recurring "Cargo.lock left behind on release" bug in vervain-apps and vendors the shared psa-systems/common task runner so the release logic stops being a per-repo fork.

The local create-release recipe bumped Cargo.toml and package.json but never staged Cargo.lock. The v0.2.0 release therefore shipped a lockfile still pinned to vervain-app = 0.1.0 while Cargo.toml read 0.2.0; the next cargo run rewrote the lock and left it dirty (the M Cargo.lock this PR also commits).

Changes

Add common as a git submodule and import 'common/common.just'.
Inherit common's create-release. Its _create-release engine syncs Cargo.lock via cargo update --package vervain-app --precise <ver> and, through the release_version_files variable (added in common #9 / PC-2), bumps package.json in the same release commit. release_layout stays generic; release_crate := "vervain-app" (crate name diverges from the vervain-apps app/repo name).
Drop the local create-release and install-hooks recipes (now inherited). Keep the Dioxus toolchain recipes as local overrides: pre-commit, check + check-server/check-web/check-clippy/check-test, build-css, watch-css, dev-web, dev-desktop, build-web, build-desktop, install.
Commit the corrected Cargo.lock (vervain-app = 0.2.0) so main's lockfile matches Cargo.toml.

Verification

just --evaluate / just --list resolve the import; inherited (create-release, install-hooks, fmt, test) and overridden (pre-commit, check, check-*) recipes both present.
cargo metadata --locked succeeds; the only Cargo.lock delta is the vervain-app version line.
Full just pre-commit (fmt + clippy + --features server check + wasm check + tests, in the CI builder image) run by the commit hook.

Merge order

Depends on common PR #9 (PC-2), which adds release_version_files. The submodule is pinned to that commit. Merge #9 first (as a merge commit, the repo's default, so the pinned commit stays reachable); this PR can then merge. After #9 merges, the submodule gitlink can optionally be bumped to common's main.

Closes #VAPP-69.

🤖 Generated with Claude Code

## Summary Fixes the recurring "Cargo.lock left behind on release" bug in vervain-apps and vendors the shared `psa-systems/common` task runner so the release logic stops being a per-repo fork. The local `create-release` recipe bumped `Cargo.toml` and `package.json` but never staged `Cargo.lock`. The v0.2.0 release therefore shipped a lockfile still pinned to `vervain-app = 0.1.0` while `Cargo.toml` read `0.2.0`; the next `cargo` run rewrote the lock and left it dirty (the `M Cargo.lock` this PR also commits). ## Changes - Add `common` as a git submodule and `import 'common/common.just'`. - Inherit common's `create-release`. Its `_create-release` engine syncs `Cargo.lock` via `cargo update --package vervain-app --precise <ver>` and, through the `release_version_files` variable (added in `common` #9 / PC-2), bumps `package.json` in the same release commit. `release_layout` stays `generic`; `release_crate := "vervain-app"` (crate name diverges from the `vervain-apps` app/repo name). - Drop the local `create-release` and `install-hooks` recipes (now inherited). Keep the Dioxus toolchain recipes as local overrides: `pre-commit`, `check` + `check-server`/`check-web`/`check-clippy`/`check-test`, `build-css`, `watch-css`, `dev-web`, `dev-desktop`, `build-web`, `build-desktop`, `install`. - Commit the corrected `Cargo.lock` (`vervain-app = 0.2.0`) so `main`'s lockfile matches `Cargo.toml`. ## Verification - `just --evaluate` / `just --list` resolve the import; inherited (`create-release`, `install-hooks`, `fmt`, `test`) and overridden (`pre-commit`, `check`, `check-*`) recipes both present. - `cargo metadata --locked` succeeds; the only `Cargo.lock` delta is the `vervain-app` version line. - Full `just pre-commit` (fmt + clippy + `--features server` check + wasm check + tests, in the CI builder image) run by the commit hook. ## Merge order Depends on `common` PR #9 (PC-2), which adds `release_version_files`. The submodule is pinned to that commit. Merge #9 first (as a merge commit, the repo's default, so the pinned commit stays reachable); this PR can then merge. After #9 merges, the submodule gitlink can optionally be bumped to `common`'s `main`. Closes #VAPP-69. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

David added 1 commit

2026-07-04 15:59:12 +02:00

chore(build): vendor common submodule and sync Cargo.lock on release

Check / fmt + clippy + build + tests (pull_request) Successful in 28s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

4e2cd5a046

The local create-release recipe bumped Cargo.toml and package.json but never staged Cargo.lock, so the v0.2.0 release shipped a lockfile still pinned to vervain-app 0.1.0 while Cargo.toml read 0.2.0; the next cargo run rewrote the lock and left it dirty. This is the forked-recipe / unstaged-lock bug seen across several psa-systems repos.

Adopt the shared psa-systems/common task runner as the `common` git submodule and inherit its create-release. Its private _create-release engine syncs Cargo.lock via `cargo update --package vervain-app --precise` and, through the release_version_files variable (PC-2), bumps package.json in the same release commit, so the lockfile and the JS version can no longer drift from Cargo.toml. The Dioxus toolchain recipes (pre-commit, check and its members, build-css/watch-css, dev/build web+desktop, install) stay as local overrides; release_layout stays generic and release_crate is vervain-app.

Commit the corrected Cargo.lock (vervain-app 0.2.0) so main's lockfile matches Cargo.toml.

#VAPP-69

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: David Randall <David@NiceGuyIT.biz>