fix(ci): repair crate publication order

[slin1237]

Description

The v1.8.0 crate release failed when publishing smg because its unpublished smg-mm-rdma dependency was missing from the release workflow. The dependency audit also found crates in invalid tiers and the publishable smg-client crate absent from the workflow.

Failed run: https://github.com/lightseekorg/smg/actions/runs/29648333758

Changes

• Add smg-mm-rdma to tier 1 and release-version tracking.
• Move smg-mcp to tier 1; move smg-wasm and llm-tokenizer to tier 2.
• Add smg-client to tier 2.
• Publish llm-multimodal in tier 3 and smg in tier 4.
• Trigger the release workflow when the workflow or publish action itself changes.
• Bump data-connector from 2.3.2 to 2.3.3 so the changes merged after the v1.8.0 release branch are published before retrying smg.
• Gate Linux-only test imports to keep all-feature clippy clean on macOS.

Test Plan

• ./scripts/check_release_versions.sh v1.7.0
• Structured manifest/workflow audit: all 16 publishable crates are present in valid dependency order
• cargo publish --dry-run -p smg-mm-rdma --allow-dirty
• cargo publish --dry-run -p data-connector --allow-dirty
• cargo +nightly fmt --all
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test
• git diff --check

Summary by CodeRabbit

• Release Management

  • Improved automated crate publishing so releases are triggered by relevant workflow and publishing updates.
  • Reorganized publishing stages to support a clearer sequence across crate tiers.
  • Added additional crates to release version consistency checks.

• Bug Fixes

  • Improved cross-platform handling for multimodal components, particularly outside Linux environments.

• Maintenance

  • Updated the data connector package to version 2.3.3.

[coderabbitai]

📝 Walkthrough

Walkthrough

The release workflow now uses expanded triggers, revised crate publishing tiers, and sequential publication of llm-multimodal and smg. Data connector versions and release checks are synchronized, while multimodal test imports are restricted to Linux.

Changes

Crate release and version alignment

Layer / File(s)	Summary
Crate publishing pipeline .github/workflows/release-crates.yml	Workflow triggers, crate matrices, and tier dependencies now publish crates through four sequential tiers.
Crate version synchronization Cargo.toml, crates/data_connector/Cargo.toml, scripts/check_release_versions.sh	smg-data-connector is updated to 2.3.3, and smg-mm-rdma is included in release-version checks.
Linux-only multimodal test imports model_gateway/src/routers/grpc/multimodal/assemble.rs	Test imports are reorganized under a Linux target condition.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Workflow
  participant Tier1
  participant Tier2
  participant Tier3
  participant Tier4
  participant Registry
  Workflow->>Tier1: start crate publishing
  Tier1->>Registry: publish Tier 1 crates
  Tier1->>Tier2: complete
  Tier2->>Registry: publish Tier 2 crates
  Tier2->>Tier3: complete
  Tier3->>Registry: publish llm-multimodal
  Tier3->>Tier4: complete
  Tier4->>Registry: publish smg

Loading

Possibly related PRs

• lightseekorg/smg#484: Introduced the version-checking script structure extended here.
• lightseekorg/smg#676: Also modified crate release workflow and version-checking logic.
• lightseekorg/smg#1849: Adjusted Linux-only multimodal test compilation.

Suggested labels: workflow

Suggested reviewers: key4ng, catherinesue

Poem

I hop through tiers of crates so neat,
While versions march on tiny feet.
Linux tests stay tucked away,
And releases bloom in ordered array.
“Publish!” I thump—then munch some hay.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main CI change: fixing crate publication order.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/crate-publish-order

---

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request bumps the version of smg-data-connector to 2.3.3 in both the workspace and package Cargo.toml files. It also adds platform-specific conditional compilation attributes (#[cfg(target_os = "linux")]) to Linux-only imports in the test module of assemble.rs to prevent compilation warnings or errors on other operating systems. Additionally, the smg-mm-rdma crate is added to the release version check script. There are no review comments, and I have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[claude]

👋 The PR description doesn't fully follow
PULL_REQUEST_TEMPLATE.md:

• Missing header: ### Problem
• Missing header: ### Solution

Please update the PR description so reviewers have the context they need.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/release-crates.yml:
- Line 83: Update the actions/checkout step in the publish job to disable
credential persistence by configuring its persist-credentials option to false,
ensuring the local action cannot access the GitHub token through Git
configuration.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 39fe7ada-9dbe-4ee0-9c22-d1aebb632bad

📥 Commits

Reviewing files that changed from the base of the PR and between 4c34502 and 10f0ea5.

📒 Files selected for processing (5)

• .github/workflows/release-crates.yml
• Cargo.toml
• crates/data_connector/Cargo.toml
• model_gateway/src/routers/grpc/multimodal/assemble.rs
• scripts/check_release_versions.sh

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Do not persist the checkout credential.

The publish job checks out repository code and then invokes a local action; any command executed during that path can read the persisted GitHub token from Git configuration. Disable persistence.

Proposed fix

-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	- uses: actions/checkout@v7
	- uses: actions/checkout@v7
	with:
	persist-credentials: false

🧰 Tools

🪛 zizmor (1.26.1)

[warning] 83-83: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

---

[error] 83-83: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release-crates.yml at line 83, Update the actions/checkout
step in the publish job to disable credential persistence by configuring its
persist-credentials option to false, ensuring the local action cannot access the
GitHub token through Git configuration.

Source: Linters/SAST tools