fix(release): iterate all release PRs when refreshing Cargo.lock

The Cargo.lock refresh step in release-please.yml was gated on
steps.release.outputs.pr (singular), which under separate-pull-requests
only ever exposes one of the release PRs. On master's post-#382 run
the step successfully bumped Cargo.lock on the main-only PR #379 but
never touched fleet-agent PR #383, which is why #383 shipped with a
stale lockfile and would fail `cargo build --release --locked`.

Switch to iterating steps.release.outputs.prs (array of every currently
open release PR) and refresh Cargo.lock on each independently. Each
iteration is scoped to its own temp workdir and git config is set once
at the outer shell.

This replaces the earlier attempt on this branch to enable the
cargo-workspace release-please plugin. That plugin was suspected of
misbehaving against this repo's virtual-workspace layout (root
[workspace]-only manifest, members using version.workspace = true,
inter-crate versions pinned via # x-release-please-version generic
extra-files). The workflow step is a proven mechanism — the log from
the last release-please run showed it correctly refreshing 51
packages on the main release PR — it just wasn't iterating.

Author: PeronGH

.github/workflows/release-please.yml

@@ -28,30 +28,42 @@ jobs:
           manifest-file: .release-please-manifest.json
           token: ${{ steps.app-token.outputs.token }}
 
-      # After release-please creates/updates the PR, regenerate Cargo.lock
-      # so the release tag can build with --locked.
-      - name: Update Cargo.lock on release PR
-        if: steps.release.outputs.pr
+      # After release-please creates/updates release PRs, regenerate
+      # Cargo.lock on each so the release tag can build with --locked.
+      # Iterates the `prs` array — under separate-pull-requests each
+      # component has its own PR, and `outputs.pr` (singular) only
+      # exposes one of them.
+      - name: Update Cargo.lock on release PRs
+        if: steps.release.outputs.prs_created == 'true'
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          # Passed via env, not inline interpolation: the JSON contains the
-          # changelog body, whose quotes would break the shell script.
-          RELEASE_PR: ${{ steps.release.outputs.pr }}
+          # Passed via env, not inline interpolation: the JSON contains
+          # changelog bodies, whose quotes would break the shell script.
+          RELEASE_PRS: ${{ steps.release.outputs.prs }}
         run: |
-          PR_BRANCH=$(jq -r '.headBranchName' <<< "$RELEASE_PR")
-          git clone --depth 1 --branch "$PR_BRANCH" \
-            "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git" /tmp/release-pr
-          cd /tmp/release-pr
-          cargo update --workspace
-          if git diff --quiet Cargo.lock; then
-            echo "Cargo.lock already up to date"
-            exit 0
-          fi
-          git config user.name "arcbox-labs[bot]"
-          git config user.email "254083426+arcbox-labs[bot]@users.noreply.github.com"
-          git add Cargo.lock
-          git commit -m "chore: update Cargo.lock for release"
-          git push
+          git config --global user.name "arcbox-labs[bot]"
+          git config --global user.email "254083426+arcbox-labs[bot]@users.noreply.github.com"
+          echo "$RELEASE_PRS" | jq -c '.[]' | while read -r pr; do
+            PR_BRANCH=$(jq -r '.headBranchName' <<< "$pr")
+            PR_NUMBER=$(jq -r '.number' <<< "$pr")
+            echo "::group::Update Cargo.lock for PR #${PR_NUMBER} (${PR_BRANCH})"
+            workdir=$(mktemp -d)
+            git clone --depth 1 --branch "$PR_BRANCH" \
+              "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git" "$workdir"
+            (
+              cd "$workdir"
+              cargo update --workspace
+              if git diff --quiet Cargo.lock; then
+                echo "Cargo.lock already up to date"
+              else
+                git add Cargo.lock
+                git commit -m "chore: update Cargo.lock for release"
+                git push
+              fi
+            )
+            rm -rf "$workdir"
+            echo "::endgroup::"
+          done
 
   # Update arcbox-desktop version file when a new release is created.
   update-desktop: