ci: build dev track and PR checks against dependency main, keep releases on tag pins #39

Merged

Breadway merged 1 commit from feature/dev-deps-main into main

2026-09-28 01:25:39 +08:00

Breadway commented

2026-09-26 22:33:22 +08:00

Owner

Part of ECO-38.

Adds scripts/dev-deps.sh: run from a consumer app's checkout root, it finds every dependency in the app's Cargo.toml manifests whose source is git.breadway.dev, shallow-clones each distinct dependency repo's main into a sibling directory (or DEV_DEPS_DIR if set), writes a generated .cargo/config.toml patching the app's git dependencies to those clones' paths, and runs cargo update for the patched crates so Cargo.lock matches. A dev-deps.lock.txt record of each dependency's resolved SHA is written for reproducibility. A clone the script creates is marked and refreshed in place on a later run; a pre-existing developer checkout (no marker) is reused as-is and never mutated. The script refuses to overwrite a .cargo/config.toml it did not generate unless --force is passed. --check gives a dry run.

Adds scripts/lint-pins.sh: a shared CI guard, callable from any consumer repo, that fails if a git.breadway.dev dependency uses rev or branch instead of tag, or if a path dependency's target escapes the repo (the local dev-loop path-patch pattern leaking into a committed Cargo.toml, as distinct from an ordinary intra-workspace path reference within the same repo). Wired into this repo's own check.yml, since bread-utils depends on bread-shared from Breadway/bread.

docs/release-channels.md documents the full model under "Cross-repo dependency resolution": tag pins stay permanent in Cargo.toml, beta/stable builds are unchanged (--locked against the tag), dev track and PR checks resolve to dependency main via this script, and the release order for a cross-repo change is tag the dependency, bump the consumer's pin in a PR, tag the consumer. CONTRIBUTING.md and AGENTS.md cross-reference it.

Tested locally end to end against real clones of this repo and Breadway/bread (see the ECO-38 progress comment): fresh run, idempotent second run (refresh of an owned clone), untouched-developer-checkout reuse, refuse-to-clobber a foreign config plus --force, and a full cargo build --release of breadbar against both dependencies' main. Also confirmed a clean-clone cargo build --release --locked still resolves to the tagged pins with no .cargo/config.toml present.

The companion breadbar PR (feature/dev-deps-main there) wires dev-release.yml/check.yml to fetch these scripts from this repo's main, so it depends on this PR merging first.

Part of ECO-38. Adds `scripts/dev-deps.sh`: run from a consumer app's checkout root, it finds every dependency in the app's Cargo.toml manifests whose source is git.breadway.dev, shallow-clones each distinct dependency repo's main into a sibling directory (or `DEV_DEPS_DIR` if set), writes a generated `.cargo/config.toml` patching the app's git dependencies to those clones' paths, and runs `cargo update` for the patched crates so Cargo.lock matches. A `dev-deps.lock.txt` record of each dependency's resolved SHA is written for reproducibility. A clone the script creates is marked and refreshed in place on a later run; a pre-existing developer checkout (no marker) is reused as-is and never mutated. The script refuses to overwrite a `.cargo/config.toml` it did not generate unless `--force` is passed. `--check` gives a dry run. Adds `scripts/lint-pins.sh`: a shared CI guard, callable from any consumer repo, that fails if a git.breadway.dev dependency uses `rev` or `branch` instead of `tag`, or if a path dependency's target escapes the repo (the local dev-loop path-patch pattern leaking into a committed Cargo.toml, as distinct from an ordinary intra-workspace path reference within the same repo). Wired into this repo's own `check.yml`, since `bread-utils` depends on `bread-shared` from `Breadway/bread`. `docs/release-channels.md` documents the full model under "Cross-repo dependency resolution": tag pins stay permanent in Cargo.toml, beta/stable builds are unchanged (`--locked` against the tag), dev track and PR checks resolve to dependency `main` via this script, and the release order for a cross-repo change is tag the dependency, bump the consumer's pin in a PR, tag the consumer. CONTRIBUTING.md and AGENTS.md cross-reference it. Tested locally end to end against real clones of this repo and Breadway/bread (see the ECO-38 progress comment): fresh run, idempotent second run (refresh of an owned clone), untouched-developer-checkout reuse, refuse-to-clobber a foreign config plus `--force`, and a full `cargo build --release` of breadbar against both dependencies' main. Also confirmed a clean-clone `cargo build --release --locked` still resolves to the tagged pins with no `.cargo/config.toml` present. The companion breadbar PR (feature/dev-deps-main there) wires `dev-release.yml`/`check.yml` to fetch these scripts from this repo's main, so it depends on this PR merging first.

Breadway added 1 commit

2026-09-26 22:33:23 +08:00

ci: build dev track and PR checks against dependency main, keep releases on tag pins

check / check (push) Successful in 2m23s

Details

e383ec11dc

Adds scripts/dev-deps.sh: shallow-clones each git.breadway.dev dependency
repo's main beside a consumer app's checkout, patches it in via a
generated .cargo/config.toml, and updates Cargo.lock to match, so a
cross-repo change can be exercised on the dev track and in PR checks
before either side is tagged. Adds scripts/lint-pins.sh, a shared CI guard
that fails if any git.breadway.dev dependency uses rev, branch, or an
escaping path instead of tag. Wires lint-pins.sh into this repo's own
check.yml (bread-utils depends on bread-shared from Breadway/bread) and
documents the whole model in docs/release-channels.md, CONTRIBUTING.md,
and AGENTS.md.

Part of ECO-38.

Breadway referenced this pull request from Breadway/breadbar

2026-09-26 22:33:36 +08:00

ci: build dev track and PR checks against dependency main #29

Breadway merged commit 252cf7db4b into main

2026-09-28 01:25:39 +08:00

Breadway referenced this pull request from a commit

2026-09-28 01:25:40 +08:00

Merge pull request 'ci: build dev track and PR checks against dependency main, keep releases on tag pins' (#39) from feature/dev-deps-main into main

Breadway referenced this pull request

2026-09-28 01:26:12 +08:00

Dev track builds against dependency main; releases stay on locked tag pins #38

~~Breadway referenced this pull request 2026-09-28 01:43:07 +08:00~~