ci: bootstrap release workflow

[KooshaPari]

User description

Adds .github/workflows/release.yml for tag-triggered or manual publish via CARGO_REGISTRY_TOKEN. Follow-up to #247.

Note

Medium Risk
Introduces automated publishing to crates.io on v* tags or manual dispatch, which can affect release integrity if misconfigured (e.g., --no-verify or selecting unintended crates). Scope is limited to CI configuration.

Overview
Adds a new GitHub Actions Release workflow (.github/workflows/release.yml) that publishes to crates.io when pushing v* tags, or via workflow_dispatch with an optional crate input.

The job checks out code, installs the stable Rust toolchain, and runs cargo publish --no-verify either for a specified crate or by iterating over publishable packages from cargo metadata (skipping failures such as already-published or path-dep crates).

^{Reviewed by Cursor Bugbot for commit 42601ae. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

CodeAnt-AI Description

Add a release workflow for publishing crates to crates.io

What Changed

• Adds a release workflow that runs on version tags or can be started manually
• Lets maintainers publish one chosen crate or publish all publishable crates in the repo
• Uses the release environment token for crates.io publishing and skips crates that are already published or not eligible

Impact

✅ Faster crate releases
✅ Manual single-crate publishing
✅ Fewer failed release runs

🔄 Retrigger CodeAnt AI Review

Details

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[codeant-ai]

CodeAnt AI is reviewing your PR.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[coderabbitai]

Warning

Rate limit exceeded

@KooshaPari has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 43 minutes and 57 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 43 minutes and 57 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 0e7058ee-73e7-4418-aeca-cae925e2c549

📥 Commits

Reviewing files that changed from the base of the PR and between e1cfe53 and 42601ae.

📒 Files selected for processing (1)

• .github/workflows/release.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/add-release-workflow

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch ci/add-release-workflow

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Script injection via unsanitized workflow dispatch input
  • Replaced direct shell interpolation of workflow input with environment variable intermediary to prevent script injection attacks.

Or push these changes by commenting:

@cursor push 7cfe916542

Preview (7cfe916542)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,9 +21,10 @@
       - name: Publish to crates.io
         env:
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+          CRATE_INPUT: ${{ inputs.crate }}
         run: |
-          if [ -n "${{ inputs.crate }}" ]; then
-            cargo publish -p "${{ inputs.crate }}" --no-verify
+          if [ -n "$CRATE_INPUT" ]; then
+            cargo publish -p "$CRATE_INPUT" --no-verify
           else
             for name in $(cargo metadata --format-version=1 --no-deps | jq -r '.packages[] | select(.publish != []) | .name'); do
               echo "Publishing $name"

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit 42601ae. Configure here.}

[cursor]

Script injection via unsanitized workflow dispatch input

High Severity

The ${{ inputs.crate }} expression is interpolated directly into the run: shell script, creating a script injection vulnerability. A user with write access could supply a crafted crate name (e.g., containing "; malicious-command; echo ") that breaks out of the string context and executes arbitrary commands — with access to CARGO_REGISTRY_TOKEN in the environment. The safe pattern is to pass the input through an intermediate environment variable (e.g., CRATE_INPUT: ${{ inputs.crate }}) and reference "$CRATE_INPUT" in the shell script instead.

 

^{Reviewed by Cursor Bugbot for commit 42601ae. Configure here.}

[codeant-ai]

🟠 Architect Review — HIGH

When publishing all crates, the workflow wraps cargo publish in || echo ..., which causes every publish failure (including auth, network, or packaging errors) to be treated as success, so the Release job can complete green even if some or all crates fail to publish.

Suggestion: Remove the blanket || echo so cargo publish failures fail the step, and if desired, explicitly detect and ignore only the "already uploaded" case by inspecting the error output or exit code before deciding to continue.

Fix in Cursor | Fix in VSCode Claude

(Use Cmd/Ctrl + Click for best experience)

Prompt for AI Agent 🤖

This is an **Architect / Logical Review** comment left during a code review. These reviews are first-class, important findings — not optional suggestions. Do NOT dismiss this as a 'big architectural change' just because the title says architect review; most of these can be resolved with a small, localized fix once the intent is understood.

**Path:** .github/workflows/release.yml
**Line:** 28:30
**Comment:**
	*HIGH: When publishing all crates, the workflow wraps `cargo publish` in `|| echo ...`, which causes every publish failure (including auth, network, or packaging errors) to be treated as success, so the Release job can complete green even if some or all crates fail to publish.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
If a suggested approach is provided above, use it as the authoritative instruction. If no explicit code suggestion is given, you MUST still draft and apply your own minimal, localized fix — do not punt back with 'no suggestion provided, review manually'. Keep the change as small as possible: add a guard clause, gate on a loading state, reorder an await, wrap in a conditional, etc. Do not refactor surrounding code or expand scope beyond the finding.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix

[codeant-ai]

CodeAnt AI finished reviewing your PR.

[codeant-ai]

CodeAnt AI is running the review.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[codeant-ai]

Sequence Diagram

This PR adds a GitHub Actions Release workflow that publishes Rust crates to crates.io when version tags are pushed or the workflow is manually dispatched, optionally targeting a single crate or iterating all publishable crates.

sequenceDiagram
    participant Developer
    participant GitHubActions
    participant CratesRegistry

    Developer->>GitHubActions: Push v tag or manual dispatch
    GitHubActions->>GitHubActions: Checkout code and set up Rust toolchain

    alt crate specified
        GitHubActions->>CratesRegistry: Publish specified crate with token
    else no crate specified
        loop each publishable crate
            GitHubActions->>CratesRegistry: Publish crate with token and skip on non fatal error
        end
    end

Loading

---

Generated by CodeAnt AI

[codeant-ai]

🟠 Architect Review — HIGH

In the "publish all" branch, cargo publish failures are always treated as skippable (via || echo), so crates.io errors such as an invalid registry token, outages, or rate limiting are silently ignored and the workflow can complete successfully even if every publish failed.

Suggestion: Remove the blanket || echo or restrict it to clearly non-fatal conditions (for example, "already uploaded"), and otherwise propagate a non-zero exit code so the job fails on real publish errors, optionally tracking and summarizing which crates were successfully published or skipped.

Fix in Cursor | Fix in VSCode Claude

(Use Cmd/Ctrl + Click for best experience)

Prompt for AI Agent 🤖

This is an **Architect / Logical Review** comment left during a code review. These reviews are first-class, important findings — not optional suggestions. Do NOT dismiss this as a 'big architectural change' just because the title says architect review; most of these can be resolved with a small, localized fix once the intent is understood.

**Path:** .github/workflows/release.yml
**Line:** 30:30
**Comment:**
	*HIGH: In the "publish all" branch, cargo publish failures are always treated as skippable (via `|| echo`), so crates.io errors such as an invalid registry token, outages, or rate limiting are silently ignored and the workflow can complete successfully even if every publish failed.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
If a suggested approach is provided above, use it as the authoritative instruction. If no explicit code suggestion is given, you MUST still draft and apply your own minimal, localized fix — do not punt back with 'no suggestion provided, review manually'. Keep the change as small as possible: add a guard clause, gate on a loading state, reorder an await, wrap in a conditional, etc. Do not refactor surrounding code or expand scope beyond the finding.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix

[codeant-ai]

CodeAnt AI finished running the review.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[codeant-ai]

CodeAnt AI is running the review.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[codeant-ai]

Sequence Diagram

This PR adds a GitHub Actions workflow that, on tagged pushes or manual dispatch, publishes either a specific crate or all publishable crates to crates.io using the configured registry token.

sequenceDiagram
    participant Developer
    participant GitHubActions as GitHub Actions
    participant ReleaseWorkflow as Release workflow
    participant CratesRegistry as Crates registry

    Developer->>GitHubActions: Push v tag or trigger release
    GitHubActions->>ReleaseWorkflow: Start publish job
    ReleaseWorkflow->>ReleaseWorkflow: Check if crate input is provided

    alt Specific crate provided
        ReleaseWorkflow->>CratesRegistry: Publish selected crate with registry token
    else No crate input
        ReleaseWorkflow->>CratesRegistry: Iterate publishable crates and publish with registry token
    end

Loading

---

Generated by CodeAnt AI

[codeant-ai]

🟠 Architect Review — HIGH

The bulk "publish all" loop treats every cargo publish failure as success via || echo, so auth errors, crates.io outages, or packaging issues can produce a green workflow even when no crates (or only a subset) are actually published.

Suggestion: Track publish outcomes in the loop and let the step fail (non-zero exit) when any crate fails for reasons other than explicitly allowed cases (e.g., already published/path-dep), emitting a final summary and failing the job when the release is incomplete.

Fix in Cursor | Fix in VSCode Claude

(Use Cmd/Ctrl + Click for best experience)

Prompt for AI Agent 🤖

This is an **Architect / Logical Review** comment left during a code review. These reviews are first-class, important findings — not optional suggestions. Do NOT dismiss this as a 'big architectural change' just because the title says architect review; most of these can be resolved with a small, localized fix once the intent is understood.

**Path:** .github/workflows/release.yml
**Line:** 28:30
**Comment:**
	*HIGH: The bulk "publish all" loop treats every `cargo publish` failure as success via `|| echo`, so auth errors, crates.io outages, or packaging issues can produce a green workflow even when no crates (or only a subset) are actually published.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
If a suggested approach is provided above, use it as the authoritative instruction. If no explicit code suggestion is given, you MUST still draft and apply your own minimal, localized fix — do not punt back with 'no suggestion provided, review manually'. Keep the change as small as possible: add a guard clause, gate on a loading state, reorder an await, wrap in a conditional, etc. Do not refactor surrounding code or expand scope beyond the finding.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix

[codeant-ai]

CodeAnt AI finished running the review.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn