fix(release): make harmont-cli crates.io-publishable (or drop the dead channel) and fix install docs (#129)

markovejnovic · web-flow · commit 828348bdf316 · 2026-06-10T13:11:10.000-07:00
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -34,25 +34,46 @@ jobs:
           VERSION="${GITHUB_REF_NAME#v}"
           echo "VERSION=$VERSION" >> "$GITHUB_ENV"
 
-          # Bump crate versions
+          # Bump crate versions. Every workspace member that harmont-cli
+          # depends on (directly or transitively) must be published, so each
+          # one needs the tagged version stamped in.
           sed -i "0,/version = \"0.0.0-dev\"/s//version = \"$VERSION\"/" crates/hm-util/Cargo.toml
           sed -i "0,/version = \"0.0.0-dev\"/s//version = \"$VERSION\"/" crates/hm-pipeline-ir/Cargo.toml
+          sed -i "0,/version = \"0.0.0-dev\"/s//version = \"$VERSION\"/" crates/hm-config/Cargo.toml
           sed -i "0,/version = \"0.0.0-dev\"/s//version = \"$VERSION\"/" crates/hm-plugin-protocol/Cargo.toml
+          sed -i "0,/version = \"0.0.0-dev\"/s//version = \"$VERSION\"/" crates/hm-render/Cargo.toml
+          sed -i "0,/version = \"0.0.0-dev\"/s//version = \"$VERSION\"/" crates/hm-vm/Cargo.toml
+          sed -i "0,/version = \"0.0.0-dev\"/s//version = \"$VERSION\"/" crates/hm-exec/Cargo.toml
           sed -i "0,/version = \"0.0.0-dev\"/s//version = \"$VERSION\"/" crates/hm-plugin-cloud/Cargo.toml
           sed -i "0,/version = \"0.0.0-dev\"/s//version = \"$VERSION\"/" crates/hm-dsl-engine/Cargo.toml
           sed -i "0,/version = \"0.0.0-dev\"/s//version = \"$VERSION\"/" crates/hm/Cargo.toml
 
           # Rewrite workspace.dependencies pins so dependents resolve to the
           # tagged version (cargo publish strips path deps; the version field
           # is what consumers will receive).
-          sed -i "s|hm-util            = { path = \"crates/hm-util\",            version = \"0.0.0-dev\" }|hm-util            = { path = \"crates/hm-util\",            version = \"$VERSION\" }|" Cargo.toml
-          sed -i "s|hm-pipeline-ir     = { path = \"crates/hm-pipeline-ir\",     version = \"0.0.0-dev\" }|hm-pipeline-ir     = { path = \"crates/hm-pipeline-ir\",     version = \"$VERSION\" }|" Cargo.toml
+          sed -i "s|hm-exec           = { path = \"crates/hm-exec\",            version = \"0.0.0-dev\" }|hm-exec           = { path = \"crates/hm-exec\",            version = \"$VERSION\" }|" Cargo.toml
           sed -i "s|hm-plugin-protocol = { path = \"crates/hm-plugin-protocol\", version = \"0.0.0-dev\" }|hm-plugin-protocol = { path = \"crates/hm-plugin-protocol\", version = \"$VERSION\" }|" Cargo.toml
           sed -i "s|hm-plugin-cloud    = { path = \"crates/hm-plugin-cloud\",    version = \"0.0.0-dev\" }|hm-plugin-cloud    = { path = \"crates/hm-plugin-cloud\",    version = \"$VERSION\" }|" Cargo.toml
+          sed -i "s|hm-pipeline-ir     = { path = \"crates/hm-pipeline-ir\",     version = \"0.0.0-dev\" }|hm-pipeline-ir     = { path = \"crates/hm-pipeline-ir\",     version = \"$VERSION\" }|" Cargo.toml
+          sed -i "s|hm-util            = { path = \"crates/hm-util\",            version = \"0.0.0-dev\" }|hm-util            = { path = \"crates/hm-util\",            version = \"$VERSION\" }|" Cargo.toml
+          sed -i "s|hm-config          = { path = \"crates/hm-config\",          version = \"0.0.0-dev\" }|hm-config          = { path = \"crates/hm-config\",          version = \"$VERSION\" }|" Cargo.toml
           sed -i "s|hm-dsl-engine      = { path = \"crates/hm-dsl-engine\",     version = \"0.0.0-dev\" }|hm-dsl-engine      = { path = \"crates/hm-dsl-engine\",     version = \"$VERSION\" }|" Cargo.toml
+          sed -i "s|hm-render          = { path = \"crates/hm-render\",          version = \"0.0.0-dev\" }|hm-render          = { path = \"crates/hm-render\",          version = \"$VERSION\" }|" Cargo.toml
+          sed -i "s|hm-vm              = { path = \"crates/hm-vm\",              version = \"0.0.0-dev\" }|hm-vm              = { path = \"crates/hm-vm\",              version = \"$VERSION\" }|" Cargo.toml
 
           cargo check --workspace --exclude hm-fixtures
 
+      - name: Publishability guard (dry-run package the whole graph)
+        # Fail fast before any real `cargo publish` if the dependency graph
+        # isn't publishable — e.g. a publishable crate depending on a
+        # `publish = false` crate, or a missing version bump. `cargo package
+        # --workspace` resolves sibling path deps locally (no index lookup,
+        # unlike `cargo publish --dry-run`, which the not-yet-published deps
+        # would fail), so it catches exactly the publish=false / unpublished-dep
+        # class of regression. `--no-verify` skips the per-crate rebuild;
+        # `cargo check --workspace` above already proved it compiles.
+        run: cargo package --workspace --exclude hm-fixtures --allow-dirty --no-verify
+
       - name: Publish hm-util
         run: |
           if curl -sf -A "harmont-release-ci (github-actions)" "https://crates.io/api/v1/crates/hm-util/$VERSION" > /dev/null 2>&1; then
@@ -75,6 +96,17 @@ jobs:
       - name: Wait for crates.io index
         run: sleep 30
 
+      - name: Publish hm-config
+        run: |
+          if curl -sf -A "harmont-release-ci (github-actions)" "https://crates.io/api/v1/crates/hm-config/$VERSION" > /dev/null 2>&1; then
+            echo "hm-config@$VERSION already published, skipping"
+          else
+            cargo publish -p hm-config --token ${{ secrets.CRATES_IO_TOKEN }} --allow-dirty
+          fi
+
+      - name: Wait for crates.io index
+        run: sleep 30
+
       - name: Publish hm-plugin-protocol
         run: |
           if curl -sf -A "harmont-release-ci (github-actions)" "https://crates.io/api/v1/crates/hm-plugin-protocol/$VERSION" > /dev/null 2>&1; then
@@ -86,6 +118,39 @@ jobs:
       - name: Wait for crates.io index
         run: sleep 30
 
+      - name: Publish hm-render
+        run: |
+          if curl -sf -A "harmont-release-ci (github-actions)" "https://crates.io/api/v1/crates/hm-render/$VERSION" > /dev/null 2>&1; then
+            echo "hm-render@$VERSION already published, skipping"
+          else
+            cargo publish -p hm-render --token ${{ secrets.CRATES_IO_TOKEN }} --allow-dirty
+          fi
+
+      - name: Wait for crates.io index
+        run: sleep 30
+
+      - name: Publish hm-vm
+        run: |
+          if curl -sf -A "harmont-release-ci (github-actions)" "https://crates.io/api/v1/crates/hm-vm/$VERSION" > /dev/null 2>&1; then
+            echo "hm-vm@$VERSION already published, skipping"
+          else
+            cargo publish -p hm-vm --token ${{ secrets.CRATES_IO_TOKEN }} --allow-dirty
+          fi
+
+      - name: Wait for crates.io index
+        run: sleep 30
+
+      - name: Publish hm-exec
+        run: |
+          if curl -sf -A "harmont-release-ci (github-actions)" "https://crates.io/api/v1/crates/hm-exec/$VERSION" > /dev/null 2>&1; then
+            echo "hm-exec@$VERSION already published, skipping"
+          else
+            cargo publish -p hm-exec --token ${{ secrets.CRATES_IO_TOKEN }} --allow-dirty
+          fi
+
+      - name: Wait for crates.io index
+        run: sleep 30
+
       - name: Publish hm-plugin-cloud
         run: |
           if curl -sf -A "harmont-release-ci (github-actions)" "https://crates.io/api/v1/crates/hm-plugin-cloud/$VERSION" > /dev/null 2>&1; then
diff --git a/RELEASING.md b/RELEASING.md
@@ -36,23 +36,30 @@ test changes to the export script.
 
 Versioning is **driven by git tags on the public mirror**. The release
 workflow in `.github/workflows/release.yml` triggers on any tag matching
-`v*`, seds the version from the tag into all three crates' `Cargo.toml`
-files plus the `workspace.dependencies` pins, and publishes
-`hm-plugin-protocol`, `hm-plugin-sdk`, and `harmont-cli` to crates.io in
-that order. The bundled WASM plugins (`hm-plugin-docker`,
-`hm-plugin-output-human`, `hm-plugin-output-json`, `hm-plugin-cloud`)
-and `hm-fixtures` are not published — they ship embedded inside the
-`hm` binary.
+`v*`, seds the version from the tag into every publishable crate's
+`Cargo.toml` plus the `workspace.dependencies` pins, runs
+`cargo package --workspace` as a fail-fast guard (it resolves sibling
+path deps locally, so it catches the `publish = false` /
+unpublished-dep class of regression without needing the deps on the
+index yet — which `cargo publish --dry-run` would), then publishes the
+crates to crates.io in dependency (topological) order:
+
+```
+hm-util → hm-pipeline-ir → hm-config → hm-plugin-protocol → hm-render
+→ hm-vm → hm-exec → hm-plugin-cloud → hm-dsl-engine → harmont-cli
+```
+
+`harmont-cli` (the `hm` binary) depends on every other crate, so they
+must all reach crates.io first — including `hm-vm`, which carries the
+local Docker backend. `hm-fixtures` is test-only and not published.
 
 ### Prerequisites (one-time)
 
 - `CRATES_IO_TOKEN` set as a repository secret on
   https://github.com/harmont-dev/harmont-cli/settings/secrets/actions.
-  Generate it from https://crates.io/me with the `publish-update` scope
-  on `hm-plugin-protocol`, `hm-plugin-sdk`, and `harmont-cli`.
-- The three crates exist on crates.io (first publish only requires
-  `publish-new` scope). After the initial publish, narrow the token to
-  `publish-update`.
+  Generate it from https://crates.io/me. The first release needs the
+  `publish-new` scope (the crates do not yet exist on crates.io); after
+  the initial publish, narrow the token to `publish-update`.
 
 ### Per-release procedure
 
@@ -72,9 +79,8 @@ and `hm-fixtures` are not published — they ship embedded inside the
    https://github.com/harmont-dev/harmont-cli/actions/workflows/release.yml.
    Each crate's publish step skips if the version is already on
    crates.io, so re-running after a partial success is safe.
-5. After the workflow completes, verify on crates.io:
-   - https://crates.io/crates/hm-plugin-protocol/1.2.3
-   - https://crates.io/crates/hm-plugin-sdk/1.2.3
+5. After the workflow completes, verify the leaf crate on crates.io
+   (it depends on all the others, so its presence implies theirs):
    - https://crates.io/crates/harmont-cli/1.2.3
 
 ### Tagging in the monorepo (optional)
diff --git a/crates/hm-vm/Cargo.toml b/crates/hm-vm/Cargo.toml
@@ -3,7 +3,8 @@ name = "hm-vm"
 version = "0.0.0-dev"
 edition.workspace = true
 license.workspace = true
-publish = false
+repository.workspace = true
+description = "Local VM/container backends (Docker) that run hm pipeline steps on the developer's machine."
 
 [dependencies]
 anyhow = { workspace = true }
