ci: add release-plz for crates.io publishing by unclesp1d3r · Pull Request #69 · EvilBit-Labs/libmagic-rs

unclesp1d3r · 2026-02-15T07:27:36Z

Summary

Add release-plz alongside cargo-dist to automate crates.io publishing
release-plz handles version bumping, changelog generation, and cargo publish via OIDC trusted publishing (no token secret needed)
cargo-dist continues to handle binary builds, Homebrew tap, SBOM, attestations, and GitHub Releases -- triggered by the git tags release-plz creates
Update release process documentation to reflect the two-tool pipeline

New files

release-plz.toml -- delegates GitHub Releases to cargo-dist, enables semver-checks
.github/workflows/release-plz.yml -- official quickstart pattern with trusted publishing

Setup required after merge

Manually run cargo publish once to create the crate on crates.io
Configure trusted publisher on crates.io (Settings > Trusted Publishers) for this repo/workflow

Test plan

CI passes (clippy, tests, dist plan)
Verify release-plz workflow triggers on push to main
Manually publish v0.1.0 to crates.io before first automated release
Configure trusted publisher on crates.io after initial publish
Verify release-plz opens a release PR on next push to main
Verify merging release PR triggers both crates.io publish and cargo-dist binary builds

Add release-plz alongside cargo-dist to automate crates.io publishing. release-plz handles version bumping, changelog generation, and crate publishing via OIDC trusted publishing (no token secret needed). cargo-dist continues to handle binary builds, Homebrew, SBOM, and GitHub Releases -- triggered by the git tags release-plz creates. - Add release-plz.toml (git_release_enable=false, delegates to cargo-dist) - Add .github/workflows/release-plz.yml (official quickstart pattern) - Update release-process.md to document the two-tool pipeline - Pin release-plz v0.3.155 in mise.toml Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

coderabbitai · 2026-02-15T07:27:53Z

Caution

Review failed

The pull request is closed.

Summary by CodeRabbit

Chores
- Added a CI aggregator job to consolidate test and quality results and fail when any required job fails
- Introduced an automated release pipeline to handle publishing, tagging, and release PRs
- Added release tooling configuration for the new release flow
Documentation
- Updated release-process guidance to describe the new tool-based release flow, configuration, and authentication steps

Walkthrough

Adds release automation with a new release-plz workflow, CI aggregation via a ci-pass job, release-plz.toml config, a mise.toml tool entry, and updated release-process documentation.

Changes

Cohort / File(s)	Summary
CI workflow `.github/workflows/ci.yml`	Adds `ci-pass` job that depends on `quality`, `test`, `test-cross-platform`, and `coverage`; aggregates their outcomes and fails if any result is neither `success` nor `skipped`.
Release workflows `.github/workflows/release-plz.yml`	Adds a new workflow with `release-plz-release` and `release-plz-pr` jobs; pins actions, configures checkout credentials per job, sets permissions and concurrency, and runs `release-plz` commands.
Release configuration `release-plz.toml`, `mise.toml`	Adds `release-plz.toml` (git tag enabled, publish true, semver & changelog settings) and adds `cargo:release-plz = "0.3.155"` to `mise.toml`.
Documentation `docs/src/release-process.md`	Replaces prior Release workflow docs with a narrative two-tool release process describing roles for `release-plz` and `cargo-dist`, triggers, config files, and authentication guidance.
Changelog `CHANGELOG.md`	Consolidates unreleased entries to focus on CI/security/CI hardening and adds entries referencing release-plz and workflow changes.

Sequence Diagram(s)

sequenceDiagram
    actor Developer
    participant GitHub as GitHub
    participant ReleasePLZ as release-plz
    participant CratesIO as crates.io
    participant CargoDist as cargo-dist

    Developer->>GitHub: Push to main
    GitHub->>ReleasePLZ: run release-plz (create/update release PR)
    Developer->>GitHub: Merge release PR
    GitHub->>ReleasePLZ: run release-plz (publish & tag)
    ReleasePLZ->>CratesIO: Publish crate
    ReleasePLZ->>GitHub: Create git tag
    GitHub->>CargoDist: Trigger cargo-dist on tag
    CargoDist->>GitHub: Create GitHub Release with artifacts

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

ci: add release-plz for crates.io publishing #69 — Adds release-plz workflow/config, pins release-plz in mise.toml, updates docs, and adds CI aggregation (strong code-level overlap).
12 add magic file format detection subtask 143 #25 — Related CI/workflow and tooling configuration changes affecting .github/workflows/ci.yml and mise.toml.

Poem

🐰 I hopped a patch into the trees,

release-plz hummed on the breeze,
Tags and crates in tidy rows,
CI tallies passing shows,
A carrot-launch — off it goes! 🚀

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: adding release-plz for crates.io publishing automation, which is the primary objective of this PR.
Description check	✅ Passed	The description comprehensively covers the changeset, including the rationale for release-plz, the division of responsibilities with cargo-dist, new files, and required setup steps.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Merge Conflict Detection	✅ Passed	✅ No merge conflicts detected when merging into `main`

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch feat/publish-crates-io

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

release-plz needs persist-credentials: true on the release job to push signed tags via the git CLI instead of the GitHub API. Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

Use the same jdx/mise-action pattern as all other workflows. This installs the pinned Rust toolchain from mise.toml along with all other project dependencies in a single step. Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

Copilot

Pull request overview

This pull request integrates release-plz for automated crates.io publishing alongside the existing cargo-dist setup. The two-tool pipeline automates version bumping, changelog generation, crates.io publishing, and binary distribution. On every push to main, release-plz opens/updates a release PR with version bumps and changelog updates. When that PR is merged, release-plz publishes to crates.io and creates a git tag, which triggers cargo-dist to build binaries and create the GitHub Release.

Changes:

Add release-plz configuration and workflow for automated crates.io publishing via OIDC trusted publishing
Add release-plz v0.3.155 to mise tooling configuration
Update release process documentation to describe the two-tool automation pipeline

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
`release-plz.toml`	Configuration for release-plz: delegates GitHub Releases to cargo-dist, enables semver checks and git tagging
`.github/workflows/release-plz.yml`	Workflow with two jobs: one to create/update release PRs, one to publish to crates.io on merge
`mise.toml`	Adds release-plz v0.3.155 to development tooling
`mise.lock`	Lock file update for release-plz tool
`docs/src/release-process.md`	Updated documentation explaining the release-plz + cargo-dist automation pipeline

Copilot · 2026-02-15T07:32:47Z

+          fetch-depth: 0
+          persist-credentials: false
+      - uses: jdx/mise-action@6d1e696aa24c1aa1bcc1adea0212707c71ab78a8 # v3.6.1
+        with:


GitHub Actions should be pinned to full commit SHA hashes with version comments for security, following the repository's established pattern. The release-plz/action@v0.5 reference should be pinned to a specific commit SHA with a version comment (e.g., release-plz/action@<commit-sha> # v0.5).

Copilot · 2026-02-15T07:32:48Z

+          fetch-depth: 0
+          # persist-credentials required for pushing signed tags via git CLI
+          persist-credentials: true
+      - uses: jdx/mise-action@6d1e696aa24c1aa1bcc1adea0212707c71ab78a8 # v3.6.1


GitHub Actions should be pinned to full commit SHA hashes with version comments for security, following the repository's established pattern. The dtolnay/rust-toolchain@stable reference should be pinned to a specific commit SHA. Based on the CI workflow, consider using dtolnay/rust-toolchain@0dd4a6d07aedb0ef7f65e79f3e229a6c102ae2e0 # 1.91.0 or update to a newer pinned version if needed.

Copilot · 2026-02-15T07:32:48Z

+          persist-credentials: true
+      - uses: jdx/mise-action@6d1e696aa24c1aa1bcc1adea0212707c71ab78a8 # v3.6.1
+        with:
+          install: true


GitHub Actions should be pinned to full commit SHA hashes with version comments for security, following the repository's established pattern. The release-plz/action@v0.5 reference should be pinned to a specific commit SHA with a version comment (e.g., release-plz/action@<commit-sha> # v0.5).

Copilot · 2026-02-15T07:32:48Z

+    concurrency:
+      group: release-plz-${{ github.ref }}
+      cancel-in-progress: false
+    steps:


GitHub Actions should be pinned to full commit SHA hashes with version comments for security, following the repository's established pattern. The actions/checkout@v6 reference should be pinned to actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 to match the rest of the codebase and prevent potential supply chain attacks.

Copilot · 2026-02-15T07:32:48Z

+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false


GitHub Actions should be pinned to full commit SHA hashes with version comments for security, following the repository's established pattern. The dtolnay/rust-toolchain@stable reference should be pinned to a specific commit SHA. Based on the CI workflow, consider using dtolnay/rust-toolchain@0dd4a6d07aedb0ef7f65e79f3e229a6c102ae2e0 # 1.91.0 or update to a newer pinned version if needed.

Add a ci-pass job that acts as a single required status check. It passes when all CI jobs succeed OR when they are skipped due to path filtering (no Rust changes). This allows setting one required check ("CI") in branch protection instead of listing every job. Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

Pin actions/checkout and release-plz/action to full commit SHAs with version comments, matching the established pattern across all other workflows in this repository. Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

Copilot

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated no new comments.

Copilot AI review requested due to automatic review settings February 15, 2026 07:27

dosubot Bot added the size:L This PR changes 100-499 lines, ignoring generated files. label Feb 15, 2026

Copilot started reviewing on behalf of unclesp1d3r February 15, 2026 07:28 View session

unclesp1d3r added 2 commits February 15, 2026 02:28

fix(ci): enable persist-credentials for signed tag pushing

83e0a6c

release-plz needs persist-credentials: true on the release job to push signed tags via the git CLI instead of the GitHub API. Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

dosubot Bot added cli Command-line interface and tools documentation Improvements or additions to documentation labels Feb 15, 2026

unclesp1d3r self-assigned this Feb 15, 2026

Copilot AI reviewed Feb 15, 2026

View reviewed changes

unclesp1d3r added 2 commits February 15, 2026 02:32

Copilot AI review requested due to automatic review settings February 15, 2026 07:40

Copilot started reviewing on behalf of unclesp1d3r February 15, 2026 07:41 View session

coderabbitai Bot added enhancement New feature or request testing Test infrastructure and coverage labels Feb 15, 2026

chore(ci): update changelog with recent CI enhancements and fixes

cc096db

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

unclesp1d3r enabled auto-merge (squash) February 15, 2026 07:44

unclesp1d3r merged commit fa0e881 into main Feb 15, 2026
19 checks passed

unclesp1d3r deleted the feat/publish-crates-io branch February 15, 2026 07:45

Copilot AI reviewed Feb 15, 2026

View reviewed changes

coderabbitai Bot approved these changes Feb 15, 2026

View reviewed changes

coderabbitai Bot mentioned this pull request Feb 15, 2026

chore: regenerate CHANGELOG.md to fix duplicate entries #70

Merged

2 tasks

github-actions Bot mentioned this pull request Feb 15, 2026

chore: release v0.1.1 #71

Closed

This was referenced Feb 15, 2026

ci: add Mergify merge queue and simplify CI #78

Merged

ci: Mergify merge queue, dependabot integration, and CI simplification #79

Merged

coderabbitai Bot mentioned this pull request Mar 1, 2026

fix(mergify): exempt release-plz PRs from CI merge protection #121

Merged

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ci: add release-plz for crates.io publishing#69

ci: add release-plz for crates.io publishing#69
unclesp1d3r merged 6 commits into
mainfrom
feat/publish-crates-io

unclesp1d3r commented Feb 15, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Feb 15, 2026 •

edited

Loading

Review failed

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 15, 2026

Uh oh!

Uh oh!

Copilot AI Feb 15, 2026

Uh oh!

Copilot AI Feb 15, 2026

Uh oh!

Copilot AI Feb 15, 2026

Uh oh!

Copilot AI Feb 15, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

unclesp1d3r commented Feb 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

New files

Setup required after merge

Test plan

Uh oh!

coderabbitai Bot commented Feb 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Summary by CodeRabbit

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Possibly related PRs

Poem

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 15, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Feb 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 15, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

unclesp1d3r commented Feb 15, 2026 •

edited

Loading

coderabbitai Bot commented Feb 15, 2026 •

edited

Loading