fix(release): sync Cargo.lock on version bump (VS-76) #94

Merged
David merged 1 commit from fix/VS-76-release-cargo-lock-sync into main 2026-07-01 00:12:11 +02:00
Owner

Problem

Merged release commit 41cf233 Release v0.1.0 shipped Cargo.toml at 0.1.0 while Cargo.lock still pinned all 26 workspace members at 0.0.1. Every --locked build now fails, e.g. check.Dockerfile line 56 cargo clippy --workspace --all-targets --locked -- --deny warnings: error: cannot update the lock file ... because --locked was passed to prevent this. This blocks just pre-commit and just create-release (the release image build).

Root cause

The create-release recipe bumps workspace.package.version in Cargo.toml and commits only that file. It never regenerates Cargo.lock, even though the line-203 comment claims it bumps the version "in both files".

Fix

Regenerate Cargo.lock so its 26 workspace-member entries read 0.1.0 (via cargo update --workspace --offline, which scopes the change to workspace crates and leaves the 57 external deps untouched). Then patch the create-release recipe to run cargo update --workspace --offline and git add Cargo.lock alongside Cargo.toml before the release commit, so future bumps carry a matching lock.

Verification

cargo metadata --locked succeeds. The exact failing CI command cargo clippy --workspace --all-targets --locked -- --deny warnings finishes clean. Full just pre-commit passes locally (fmt, clippy, check, 431 tests).

Fixes VS-76.

## Problem Merged release commit `41cf233 Release v0.1.0` shipped `Cargo.toml` at `0.1.0` while `Cargo.lock` still pinned all 26 workspace members at `0.0.1`. Every `--locked` build now fails, e.g. `check.Dockerfile` line 56 `cargo clippy --workspace --all-targets --locked -- --deny warnings`: `error: cannot update the lock file ... because --locked was passed to prevent this`. This blocks `just pre-commit` and `just create-release` (the release image build). ## Root cause The `create-release` recipe bumps `workspace.package.version` in `Cargo.toml` and commits only that file. It never regenerates `Cargo.lock`, even though the line-203 comment claims it bumps the version "in both files". ## Fix Regenerate `Cargo.lock` so its 26 workspace-member entries read `0.1.0` (via `cargo update --workspace --offline`, which scopes the change to workspace crates and leaves the 57 external deps untouched). Then patch the `create-release` recipe to run `cargo update --workspace --offline` and `git add Cargo.lock` alongside `Cargo.toml` before the release commit, so future bumps carry a matching lock. ## Verification `cargo metadata --locked` succeeds. The exact failing CI command `cargo clippy --workspace --all-targets --locked -- --deny warnings` finishes clean. Full `just pre-commit` passes locally (fmt, clippy, check, 431 tests). Fixes VS-76.
fix(release): sync Cargo.lock on version bump
All checks were successful
Check / fmt + clippy + build + tests (pull_request) Successful in 1m10s
Create release / Create release from merged PR (pull_request) Has been skipped
6abd2da174
The `create-release` recipe bumped `workspace.package.version` in Cargo.toml and committed, but never regenerated Cargo.lock (despite the line-203 comment claiming it updated "both files"). The v0.1.0 release commit shipped Cargo.toml at 0.1.0 with all 26 workspace members still pinned at 0.0.1 in the lock, so every `--locked` build failed with "cannot update the lock file ... because --locked was passed".

Regenerate Cargo.lock so the workspace members read 0.1.0 (via `cargo update --workspace --offline`, which leaves the 57 external deps untouched), and add `cargo update --workspace --offline` plus `git add Cargo.lock` to the release recipe so future bumps carry a matching lock.

Signed-off-by: David Randall <David@NiceGuyIT.biz>

#VS-76
David scheduled this pull request to auto merge when all checks succeed 2026-07-01 00:11:52 +02:00
David scheduled this pull request to auto merge when all checks succeed 2026-07-01 00:11:56 +02:00
David merged commit c5d69e19c8 into main 2026-07-01 00:12:11 +02:00
David deleted branch fix/VS-76-release-cargo-lock-sync 2026-07-01 00:12:11 +02:00
Sign in to join this conversation.
No reviewers
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
psa-systems/vervain-server!94
No description provided.