ref(ci): Remove skip-signing and fix snapshot versioning

Remove the skip-signing input from build.yml since snapshots should
go through the same signing pipeline as releases. Also switch snapshot
versioning from minor bump to patch bump and use cargo metadata for
more reliable version parsing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: runningcode

.github/workflows/build.yml

@@ -6,9 +6,6 @@ on:
       - release/**
   workflow_call:
     inputs:
-      skip-signing:
-        type: boolean
-        default: false
       is-snapshot:
         type: boolean
         default: false
@@ -169,13 +166,11 @@ jobs:
 
     steps:
       - name: Checkout repository
-        if: ${{ !inputs.skip-signing }}
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
         with:
           ref: ${{ inputs.checkout-ref }}
 
       - name: Install `rcodesign`
-        if: ${{ !inputs.skip-signing }}
         run: |
           curl -L https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign%2F0.29.0/apple-codesign-0.29.0-x86_64-unknown-linux-musl.tar.gz \
             -o rcodesign.tar.gz
@@ -185,7 +180,6 @@ jobs:
           rm rcodesign.tar.gz
 
       - name: Decode Apple signing certificate and API key
-        if: ${{ !inputs.skip-signing }}
         env:
           APPLE_CERT_DATA: ${{ secrets.APPLE_CERT_DATA }}
           APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
@@ -199,7 +193,6 @@ jobs:
           name: unsigned-bin-macos-${{ matrix.arch }}
 
       - name: Sign binary
-        if: ${{ !inputs.skip-signing }}
         run: |
           rcodesign sign \
             --for-notarization \
@@ -209,12 +202,10 @@ jobs:
             sentry-cli-Darwin-${{ matrix.arch }}
 
       - name: Zip signed binary
-        if: ${{ !inputs.skip-signing }}
         run: |
           zip sentry-cli-Darwin-${{ matrix.arch }}.zip sentry-cli-Darwin-${{ matrix.arch }}
 
       - name: Notarize binary
-        if: ${{ !inputs.skip-signing }}
         run: |
           rcodesign notary-submit \
             --api-key-file ${{ env.APPLE_API_KEY_PATH }} \

.github/workflows/snapshot.yml

@@ -17,20 +17,22 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
 
       # Computes a semver-compliant snapshot version based on the current
-      # version in Cargo.toml. The minor version is bumped so that the
+      # version in Cargo.toml. The patch version is bumped so that the
       # snapshot sorts higher than the current release but lower than the
       # next real release. For example, if Cargo.toml has 3.3.1, the
-      # snapshot version will be 3.4.0-snapshot.20260312.abc1234.
+      # snapshot version will be 3.3.2-snapshot.20260312.abc1234.
       - name: Compute snapshot version
         id: version
         run: |
-          CURRENT=$(grep '^version = ' Cargo.toml | head -1 | sed 's/version = "\(.*\)"/\1/')
+          CURRENT=$(cargo metadata --no-deps --format-version 1 \
+            | jq -er '(.workspace_default_members[0]) as $id | .packages[] | select(.id == $id) | .version')
           MAJOR=$(echo "$CURRENT" | cut -d. -f1)
           MINOR=$(echo "$CURRENT" | cut -d. -f2)
-          NEXT_MINOR=$((MINOR + 1))
+          PATCH=$(echo "$CURRENT" | cut -d. -f3)
+          NEXT_PATCH=$((PATCH + 1))
           DATE=$(date -u +%Y%m%d)
           SHORT_SHA=$(git rev-parse --short HEAD)
-          VERSION="${MAJOR}.${NEXT_MINOR}.0-snapshot.${DATE}.${SHORT_SHA}"
+          VERSION="${MAJOR}.${MINOR}.${NEXT_PATCH}-snapshot.${DATE}.${SHORT_SHA}"
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
           echo "current=$CURRENT" >> "$GITHUB_OUTPUT"
           echo "Snapshot version: $VERSION"
@@ -59,7 +61,6 @@ jobs:
     needs: prepare
     uses: ./.github/workflows/build.yml
     with:
-      skip-signing: true
       is-snapshot: true
       checkout-ref: ${{ needs.prepare.outputs.ref }}
     secrets: inherit
@@ -108,7 +109,8 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Delete snapshot branch
+        if: needs.prepare.outputs.ref != ''
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          gh api -X DELETE "repos/${{ github.repository }}/git/refs/heads/${{ needs.prepare.outputs.ref }}" || true
+          gh api -X DELETE "repos/${{ github.repository }}/git/refs/heads/${{ needs.prepare.outputs.ref }}"