max / supernote-push

release: assert the pin instead of pulling over it The recipe's checkout step ran `git pull --ff-only`, which predates the runner pinning each host to the release tag. The pull moves the checkout off the tag onto the branch tip, so a release could publish something other than what was tagged; and on the detached HEAD the pin leaves behind, it fails outright. The step now asserts what the preflight established: HEAD is exactly a tag. All five library repos carried a byte-identical copy of this recipe, so all five had the same break. Found publishing makeover 2.1.0.

Author: Max Johnson <me@maxj.phd> · 2026-07-24 20:21 UTC

Commit: 865c8ebdae3419792d63ff3ba49dc1b3287dec3a

Parent: df01474

1 file changed, +11 insertions, -1 deletion

M dist/recipes/publish.rhai +11 -1

			@@ -13,8 +13,18 @@ let h = build_host();
13	13		let r = repo();
14	14		let v = version();
15	15
	16	+	// No pull here. The runner's release preflight has already fetched and run
	17	+	// `git checkout v<version>` on every host, then compared `rev-parse HEAD`
	18	+	// across them so a release cannot be built from two different commits. That
	19	+	// leaves the checkout on the tag, detached. Pulling would move it off the tag
	20	+	// onto the branch tip, publishing something other than what was tagged — and on
	21	+	// a detached HEAD it just fails, which is how this was found, while publishing
	22	+	// makeover 2.1.0 as the first library to go through Bento.
	23	+	//
	24	+	// So this step asserts the pin instead of re-doing it: HEAD must be exactly a
	25	+	// tag, or the release is not coming from where it claims.
16	26		step("checkout");
17		-	sh_ok(h, "cd " + r + " && git pull --ff-only");
	27	+	sh_ok(h, "cd " + r + " && git describe --exact-match --tags HEAD");
18	28
19	29		// Gate: nothing reaches crates.io from code that fails clippy or its tests. A
20	30		// published version can be yanked but never edited, so this is the last point