max / makeover

release: assert the pin instead of pulling over it The recipe's checkout step ran `git pull --ff-only`, which predates the runner pinning each host to the release tag. Two things wrong with it now. The pull moves the checkout off the tag onto the branch tip, so a release could publish something other than what was tagged, defeating both the pin and the all-hosts-same-commit barrier the preflight enforces. And on the detached HEAD the pin leaves behind, it simply fails. So the step asserts what the preflight established: HEAD is exactly a tag, or the release is not coming from where it claims. Found publishing 2.1.0, the first library released through Bento.

Author: Max Johnson <me@maxj.phd> · 2026-07-24 20:20 UTC

Commit: ba8f9f5f03556e0f7dcfab7db6d940d3561135b5

Parent: 2bee5c7

1 file changed, +11 insertions, -1 deletion

M dist/recipes/publish.rhai +11 -1

			@@ -13,8 +13,18 @@ let h = build_host();
13	13		let r = repo();
14	14		let v = version();
15	15
	16	+	// No pull here. The runner's release preflight has already fetched and run
	17	+	// `git checkout v<version>` on every host, then compared `rev-parse HEAD`
	18	+	// across them so a release cannot be built from two different commits. That
	19	+	// leaves the checkout on the tag, detached. Pulling would move it off the tag
	20	+	// onto the branch tip, publishing something other than what was tagged — and on
	21	+	// a detached HEAD it just fails, which is how this was found, while publishing
	22	+	// makeover 2.1.0 as the first library to go through Bento.
	23	+	//
	24	+	// So this step asserts the pin instead of re-doing it: HEAD must be exactly a
	25	+	// tag, or the release is not coming from where it claims.
16	26		step("checkout");
17		-	sh_ok(h, "cd " + r + " && git pull --ff-only");
	27	+	sh_ok(h, "cd " + r + " && git describe --exact-match --tags HEAD");
18	28
19	29		// Gate: nothing reaches crates.io from code that fails clippy or its tests. A
20	30		// published version can be yanked but never edited, so this is the last point