putitoutthere 0.3.18 → 0.3.20

package/dist/write-dependent-version-reqs.js

@@ -0,0 +1,158 @@
+/**
+ * Move the in-repo version requirements that point at a crate whose version
+ * just changed. #640.
+ *
+ * #621 taught the *build*-time writers this, for the crates an artifact
+ * embeds. The *publish* path never learned it: the crates handler bumps
+ * exactly one manifest, the crate's own. For two crates.io packages in one
+ * repo where A path-deps B, releasing B moves it past A's requirement and
+ * nothing updates A:
+ *
+ *     error: failed to select a version for the requirement `expcore = "^0.2"`
+ *     candidate versions found which didn't match: 0.4.2
+ *     location searched: …/packages/core
+ *
+ * A hard failure (exit 101) before anything compiles or packages, and an
+ * intermittent one — a repo on a patch cadence stays green until the first
+ * bump that leaves the declared range. `location searched` naming the local
+ * path is also why registry state cannot rescue it: for a `path` + `version`
+ * dependency cargo checks the requirement against the path crate's on-disk
+ * manifest.
+ *
+ * A `version` key alongside `path` is *mandatory* for any crate that also
+ * publishes to crates.io, so the shape that breaks is the shape such a repo
+ * is required to have.
+ *
+ * This is the inverse walk of `write-embedded-crate-versions.ts`: that one
+ * walks *out* from a crate to what it embeds, this one looks *in* at what
+ * points back. It rewrites requirements only; no crate's version is bumped
+ * here, because at publish time each package owns its own planned version
+ * and stamping a neighbour's would publish a version nobody planned.
+ *
+ * Like #621's rewrites these are ephemeral — the publish job runs off a
+ * fresh checkout and nothing is committed — but unlike #621's they happen in
+ * the same job as `cargo publish`, so the pre-publish dirty-tree check has
+ * to be told which manifests they touched.
+ */
+import { readFile, writeFile } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { parse as parseToml } from 'smol-toml';
+import { expandDirGlob } from './glob.js';
+import { findWorkspaceRoot } from './find-workspace-root.js';
+import { replaceDepVersionReq } from './replace-dep-version-req.js';
+import { resolveDepDirs } from './resolve-dep-dirs.js';
+/**
+ * Rewrite every in-repo `version = "…"` requirement that points at the crate
+ * at `crateDir` to `version`. Returns the absolute paths modified.
+ *
+ * `siblingDirs` are the other declared packages' directories — they may sit
+ * outside any shared cargo workspace, so they are scanned in addition to the
+ * workspace's own members rather than instead of them.
+ *
+ * Only entries that resolve to `crateDir` move. A registry dependency, or a
+ * path dependency pointing anywhere else, keeps its requirement: pinning
+ * pyo3 to this release's version would name a pyo3 that does not exist.
+ */
+export async function writeDependentVersionReqs(crateDir, version, siblingDirs) {
+    // Canonicalize first: every candidate directory below arrives via
+    // `resolve`, and the check that decides whether a dependency points at
+    // this crate is string equality on those paths.
+    const target = resolve(crateDir);
+    const workspaceRoot = await findWorkspaceRoot(target);
+    const workspaceParsed = workspaceRoot === null ? null : (await readManifest(workspaceRoot))?.parsed;
+    const written = [];
+    // The released crate's own manifest is scanned like any other and simply
+    // never matches: cargo has no way to express a dependency on yourself, so
+    // no entry in it can resolve back to `target`.
+    //
+    // A member that inherits its requirement (`core.workspace = true`) is
+    // likewise a no-op here rather than a special case — the entry carries no
+    // `path` of its own, and `replaceDepVersionReq` only rewrites entries that
+    // do. The requirement it inherits lives in the workspace root, which is a
+    // candidate in its own right, so rewriting it there covers every member.
+    for (const dir of await candidateDirs(workspaceRoot, workspaceParsed, siblingDirs)) {
+        const manifest = await readManifest(dir);
+        if (manifest === null) {
+            continue;
+        }
+        let updated = manifest.source;
+        for (const dep of resolveDepDirs(manifest.parsed, dir, workspaceParsed, workspaceRoot)) {
+            if (!dep.hasVersionReq || dep.dir !== target) {
+                continue;
+            }
+            updated = replaceDepVersionReq(updated, dep.key, version);
+        }
+        if (updated !== manifest.source) {
+            const cargoPath = join(dir, 'Cargo.toml');
+            await writeFile(cargoPath, updated, 'utf8');
+            written.push(cargoPath);
+        }
+    }
+    return written;
+}
+/**
+ * Every manifest that could declare a requirement on the released crate: the
+ * workspace root (where an inheriting member's requirement actually lives),
+ * each of its members, and the other declared packages.
+ *
+ * Members are expanded with `expandDirGlob`, which mirrors how cargo resolves
+ * `[workspace].members` — a literal entry resolves as written, a glob entry
+ * matches against the real tree. Scanning members rather than only the
+ * declared packages matters because a crate the repo does not publish can
+ * still sit between two that it does, and cargo resolves the whole graph.
+ */
+async function candidateDirs(workspaceRoot, workspaceParsed, siblingDirs) {
+    const dirs = new Set();
+    // An explicit guard rather than a `?? []` default: the caller holds an
+    // optional field, and "no sibling packages" and "an empty list of them"
+    // are the same thing to this walk.
+    if (siblingDirs !== undefined) {
+        for (const d of siblingDirs) {
+            dirs.add(resolve(d));
+        }
+    }
+    if (workspaceRoot === null) {
+        return dirs;
+    }
+    dirs.add(resolve(workspaceRoot));
+    const members = workspaceParsed?.workspace
+        ?.members;
+    if (!Array.isArray(members)) {
+        return dirs;
+    }
+    for (const member of members) {
+        if (typeof member !== 'string') {
+            continue;
+        }
+        for (const d of await expandDirGlob(workspaceRoot, member)) {
+            dirs.add(resolve(d));
+        }
+    }
+    return dirs;
+}
+/**
+ * Read and parse `<dir>/Cargo.toml`. Null when absent or unparseable — a
+ * declared package directory need not be a crate at all, and an
+ * odd-but-writable manifest should not abort a release. ENOENT is caught
+ * rather than pre-checked to avoid the TOCTOU shape CodeQL flags, matching
+ * the rest of the version-write path.
+ */
+async function readManifest(dir) {
+    let source;
+    try {
+        source = await readFile(join(dir, 'Cargo.toml'), 'utf8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT') {
+            return null;
+        }
+        throw err;
+    }
+    try {
+        return { source, parsed: parseToml(source) };
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=write-dependent-version-reqs.js.map

package/dist/write-dependent-version-reqs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-dependent-version-reqs.js","sourceRoot":"","sources":["../src/write-dependent-version-reqs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,QAAgB,EAChB,OAAe,EACf,WAA+B;IAE/B,kEAAkE;IAClE,uEAAuE;IACvE,gDAAgD;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEjC,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,eAAe,GACnB,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC;IAE9E,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,yEAAyE;IACzE,0EAA0E;IAC1E,+CAA+C;IAC/C,EAAE;IACF,sEAAsE;IACtE,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,KAAK,MAAM,GAAG,IAAI,MAAM,aAAa,CAAC,aAAa,EAAE,eAAe,EAAE,WAAW,CAAC,EAAE,CAAC;QACnF,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YAAA,SAAS;QAAA,CAAC;QAElC,IAAI,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,eAAe,EAAE,aAAa,CAAC,EAAE,CAAC;YACvF,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;gBAAA,SAAS;YAAA,CAAC;YACzD,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,OAAO,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAC1C,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,aAAa,CAC1B,aAA4B,EAC5B,eAAwB,EACxB,WAA0C;IAE1C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,uEAAuE;IACvE,wEAAwE;IACxE,mCAAmC;IACnC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAAA,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAAA,CAAC;IACtD,CAAC;IACD,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAAA,OAAO,IAAI,CAAC;IAAA,CAAC;IAE1C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;IACjC,MAAM,OAAO,GAAI,eAAgE,EAAE,SAAS;QAC1F,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAAA,OAAO,IAAI,CAAC;IAAA,CAAC;IAC3C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAAA,SAAS;QAAA,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,MAAM,aAAa,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC;YAAA,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAAA,CAAC;IACrF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,YAAY,CAAC,GAAW;IACrC,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAAA,OAAO,IAAI,CAAC;QAAA,CAAC;QACpE,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "putitoutthere",
-  "version": "0.3.18",
+  "version": "0.3.20",
   "description": "Polyglot release orchestrator for crates.io, PyPI, and npm",
   "license": "MIT",
   "repository": {