fix(cd): release via PR on protected main; bump cargo-deny action to v2 - #2
Merged
Conversation
The main-protect ruleset requires pushes to main to come through a pull request (only admins may bypass), so the CD workflow's direct 'git push origin main --follow-tags' was declined after cargo-release had already committed the version bump and pushed the v0.3.0 tag. Rework the flow: push the release commit to a release/vX.Y.Z branch, open a PR, and merge it through the protected flow; push the (unprotected) tag afterwards. Also grant the job pull-requests: write. Security Audit: EmbarkStudios/cargo-deny-action@v1 bundles cargo-deny 0.14.21 (2023), which fails to parse newer rustsec advisory entries (RUSTSEC-2026-0066: TOML parse error) and makes every audit red. Bump to @v2 and add a workflow_dispatch trigger so the audit can be re-run and verified manually.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The \main-protect\ ruleset requires pushes to \main\ to come through a pull request (only admins may bypass), so the CD workflow's direct \git push origin main --follow-tags\ was declined — but only AFTER cargo-release had committed the version bump and the \�0.3.0\ tag had already been pushed (pointing at a commit not on main; the dangling tag has been cleaned up).
Separately, the Security Audit job has been red since 2026-08-19: \EmbarkStudios/cargo-deny-action@v1\ bundles cargo-deny 0.14.21 (2023), which fails to parse newer rustsec advisory entries (\RUSTSEC-2026-0066: TOML parse error) and makes every audit run fail regardless of the dependency tree.
Changes
elease/vX.Y.Z\ branch, opens a PR against \main, and merges it through the protected flow; the (unprotected) tag is pushed afterwards. Job gets \pull-requests: write.