fix: update Cargo.lock and harden CI/release pipeline

- Fix stale Cargo.lock (was 2.0.1, now 2.1.0)
- Add cargo update + --allow-dirty to release publish step
- Add lockfile version consistency check to CI
- Remove cross-compilation from PR pipeline (covered by release)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: mikkeldamsgaard

.github/workflows/ci.yml

@@ -17,6 +17,18 @@ jobs:
       - uses: Swatinem/rust-cache@v2
       - run: cargo fmt --check
       - run: cargo clippy -- -D warnings
+  lockfile:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Verify Cargo.lock matches Cargo.toml
+        run: |
+          TOML_VERSION=$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)"/\1/')
+          LOCK_VERSION=$(sed -n '/^name = "initium"/{n;s/^version = "\(.*\)"/\1/p;}' Cargo.lock)
+          if [ "$TOML_VERSION" != "$LOCK_VERSION" ]; then
+            echo "::error::Cargo.toml version ($TOML_VERSION) does not match Cargo.lock version ($LOCK_VERSION). Run 'cargo update --workspace' and commit Cargo.lock."
+            exit 1
+          fi
   dprint:
     runs-on: ubuntu-latest
     steps:
@@ -29,33 +41,6 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - run: cargo test --all
-  build:
-    runs-on: ubuntu-latest
-    needs: [lint, test]
-    strategy:
-      matrix:
-        include:
-          - target: x86_64-unknown-linux-musl
-            arch: amd64
-          - target: aarch64-unknown-linux-musl
-            arch: arm64
-    steps:
-      - uses: actions/checkout@v6
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: ${{ matrix.target }}
-      - name: Install zig and cargo-zigbuild
-        run: pip install ziglang && curl -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash && cargo binstall -y cargo-zigbuild
-      - uses: mozilla-actions/sccache-action@v0.0.9
-      - name: Cross-compile for ${{ matrix.arch }}
-        run: cargo zigbuild --release --target ${{ matrix.target }}
-        env:
-          SCCACHE_GHA_ENABLED: "true"
-          RUSTC_WRAPPER: sccache
-      - uses: actions/upload-artifact@v7
-        with:
-          name: initium-${{ matrix.arch }}
-          path: target/${{ matrix.target }}/release/initium
   helm-lint:
     runs-on: ubuntu-latest
     steps:
@@ -67,7 +52,7 @@ jobs:
       - run: helm unittest charts/initium
   ci:
     if: always()
-    needs: [lint, test, build, helm-lint, dprint]
+    needs: [lint, test, helm-lint, dprint, lockfile]
     runs-on: ubuntu-latest
     steps:
       - run: |

.github/workflows/release.yml

@@ -136,9 +136,11 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: dtolnay/rust-toolchain@stable
+      - name: Ensure Cargo.lock is up to date
+        run: cargo update --workspace
       - name: Publish to crates.io
         run: |
-          cargo publish 2>&1 || {
+          cargo publish --allow-dirty 2>&1 || {
             if cargo search initium --limit 1 | grep -q "$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)"/\1/')"; then
               echo "::warning::Version already published to crates.io — skipping"
             else

CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- Release workflow: `cargo publish` failed when `Cargo.lock` was stale. Added an explicit `cargo update --workspace` step before publish to ensure lockfile consistency.
+
 ## [2.1.0] - 2026-03-14
 
 ### Added