From 210de72f4c5487e354a415ffc5bf4aa62378ed49 Mon Sep 17 00:00:00 2001 From: Douglas Eichelberger Date: Sat, 26 Sep 2026 15:22:28 -0700 Subject: [PATCH 1/4] Bump version to 0.5.0 The strict-mode change in #45 is breaking, and pre-1.0 that wants a minor bump rather than 0.4.x. Also rewrite INSTALLATION.md for the cargo-dist release artifacts. 0.5.0 is the first release through cargo-dist (#33), which publishes installer scripts and per-target archives but no dotslash `pks` file. And `cargo install pks` has only ever installed the original alexevanczuk/packs crate from crates.io, not this repository. --- Cargo.toml | 2 +- INSTALLATION.md | 36 +++++++++++++++++++++++++++--------- 2 files changed, 28 insertions(+), 10 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index e5dcb8d6..2fc0835d 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -2,7 +2,7 @@ [package] name = "pks" -version = "0.4.0" +version = "0.5.0" edition = "2021" description = "Welcome! Please see https://github.com/rubyatscale/pks for more information!" license = "MIT" diff --git a/INSTALLATION.md b/INSTALLATION.md index e39b5958..98d3fa71 100644 --- a/INSTALLATION.md +++ b/INSTALLATION.md @@ -1,12 +1,30 @@ # Installation -## Option 1: -- Install [dotslash](https://dotslash-cli.com/docs/installation/) -- Download the latest packs release dotslash `pks` file. Example: https://github.com/rubyatscale/pks/releases/tag/v0.2.21/pks -- Save the `pks` file to your ruby project's bin/ directory. You'll then have a `bin/pks` file in your project. -- Use `bin/pks` to execute the CLI. -## Option 2: +## Option 1: Prebuilt binary + +From v0.5.0, every release publishes prebuilt binaries for macOS, Linux, and Windows, along with installer scripts that put `pks` in `$CARGO_HOME/bin` (usually `~/.cargo/bin`). + +macOS and Linux: + +```sh +curl --proto '=https' --tlsv1.2 -LsSf https://github.com/rubyatscale/pks/releases/latest/download/pks-installer.sh | sh +``` + +Windows (PowerShell): + +```powershell +powershell -ExecutionPolicy Bypass -c "irm https://github.com/rubyatscale/pks/releases/latest/download/pks-installer.ps1 | iex" +``` + +To pin a version, replace `latest/download` with `download/v0.5.0` (or whichever version you want). You can also download a `pks-.tar.xz` archive, or the `.zip` on Windows, straight from the [releases page](https://github.com/rubyatscale/pks/releases). + +## Option 2: dotslash (v0.4.0 and earlier) + +Releases up to v0.4.0 include a [dotslash](https://dotslash-cli.com/docs/installation/) `pks` file, for example https://github.com/rubyatscale/pks/releases/download/v0.4.0/pks. Save it to your Ruby project's `bin/` directory and run `bin/pks`. Releases from v0.5.0 on don't publish a dotslash file. + +## Option 3: Build from source + - Install Rust: https://www.rust-lang.org/tools/install - - Note: If `which cargo` returns a path, skip this step! - - TLDR: `curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh`, and you're done! -- `cargo install pks` (it's like `gem install`) +- `cargo install --git https://github.com/rubyatscale/pks` + +Note that `cargo install pks` installs the crates.io `pks` crate, which is the original [alexevanczuk/packs](https://github.com/alexevanczuk/packs) at 0.2.40, not this repository. From 909777176b340ff0bf9016c5a82d04fa264f0f43 Mon Sep 17 00:00:00 2001 From: Douglas Eichelberger Date: Sat, 26 Sep 2026 16:35:58 -0700 Subject: [PATCH 2/4] Prepare the CHANGELOG for 0.5.0 Retitle `## Unreleased` to `## 0.5.0`, since cargo-dist builds the GitHub Release notes by matching that heading against the tag, and drop the reminder comment #45 left for whoever cut this release. Add entries for the other user-visible changes since v0.4.0: the recorded-violation matching fix in strict packs (#43), the stray `dbg!` in the privacy checker (#50), the inflector regex speedup (#54), and the switch to cargo-dist release artifacts (#33). --- CHANGELOG.md | 43 ++++++++++++++++++++++++++++++++++++------- 1 file changed, 36 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2ccec804..9c7048af 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,12 +1,6 @@ # Changelog - - -## Unreleased +## 0.5.0 ### Breaking Changes @@ -67,6 +61,41 @@ files are grandfathering: pks check --ignore-recorded-violations ``` +### Fixes + +#### Recorded violations in strict packs match their `package_todo.yml` entries + +`package_todo.yml` has no field for `strict`, so a recorded violation in a pack +with a strict checker never matched its entry. `check` reported it as a new +violation and reported its todo entry as stale. Neither happens now, and +`--ignore-recorded-violations` no longer prints a spurious stale-todo line for +those entries. + +#### Removed stray debug output from the privacy checker + +A leftover `dbg!` wrote two lines to stderr for every reference checked against +a pack's `private_constants`, in release builds too. + +### Performance + +#### `pks check` compiles the inflector's regexes once + +Constant-name inflection compiled its regexes on every call, roughly 50k times +per run on a large codebase. They're now compiled once, which cut total CPU time +for `pks check` by about 45% on a large application. + +### Distribution + +#### Releases are built by cargo-dist + +This is the first release built by cargo-dist. Each release now publishes +`pks-.tar.xz` archives for macOS and Linux, a `.zip` for Windows, and +`pks-installer.sh` and `pks-installer.ps1` installer scripts. The old asset names +(`pks-mac.tar.gz`, `x86_64-unknown-linux-gnu.tar.gz` and +`aarch64-unknown-linux-gnu.tar.gz`) and the dotslash `pks` file are no longer +published, so anything that downloads release assets by name needs updating. +See [INSTALLATION.md](https://github.com/rubyatscale/pks/blob/main/INSTALLATION.md). + ### Internal #### Replaced `serde_yaml` with `yaml_serde` From e8eb88efa8abe9d090b0cbccbabd1496ba03a2f8 Mon Sep 17 00:00:00 2001 From: Douglas Eichelberger Date: Sat, 26 Sep 2026 17:08:04 -0700 Subject: [PATCH 3/4] Restore the DotSlash file on releases #33 replaced ci.yml's release jobs with cargo-dist and dropped the generate-dotslash-files job along with them, so 0.5.0 would have been the first release without a DotSlash `pks` file. cargo-dist creates the GitHub Release with GITHUB_TOKEN, and events from GITHUB_TOKEN don't trigger other workflows, so this can't be a separate `on: release` workflow. Instead, publish-dotslash.yml is a reusable workflow that dist calls once the release is announced (`post-announce-jobs` in dist-workspace.toml), and release.yml is regenerated with `dist generate` to add that call. dotslash-config.json now matches cargo-dist's asset names exactly. The tarballs put the binary under a `pks-/` directory, the Windows zip is flat, and Windows is new. zizmor's secrets-inherit and self-repository findings come from dist's template for the call, so they're ignored for release.yml alongside the existing ones. Checked locally by running the action's process_config.py, at the pinned commit, against a real cargo-dist archive for aarch64-apple-darwin, then running the generated file with dotslash 0.5.9, which printed `pks 0.5.0`. --- .github/workflows/dotslash-config.json | 53 ++++++++++++++------------ .github/workflows/publish-dotslash.yml | 31 +++++++++++++++ .github/workflows/release.yml | 11 ++++++ .github/zizmor.yml | 10 +++++ CHANGELOG.md | 9 +++-- INSTALLATION.md | 14 ++++--- dist-workspace.toml | 5 +++ 7 files changed, 101 insertions(+), 32 deletions(-) create mode 100644 .github/workflows/publish-dotslash.yml diff --git a/.github/workflows/dotslash-config.json b/.github/workflows/dotslash-config.json index 054570e9..66b5884a 100644 --- a/.github/workflows/dotslash-config.json +++ b/.github/workflows/dotslash-config.json @@ -1,28 +1,33 @@ { - "outputs": { - "pks": { - "platforms": { - "macos-x86_64": { - "regex": "^pks-mac", - "path": "pks", - "format": "tar.gz" - }, - "macos-aarch64": { - "regex": "^pks-mac", - "path": "pks", - "format": "tar.gz" - }, - "linux-x86_64": { - "regex": "^x86_64-unknown-linux", - "path": "pks", - "format": "tar.gz" - }, - "linux-aarch64": { - "regex": "^aarch64-unknown-linux", - "path": "pks", - "format": "tar.gz" - } + "outputs": { + "pks": { + "platforms": { + "macos-aarch64": { + "name": "pks-aarch64-apple-darwin.tar.xz", + "path": "pks-aarch64-apple-darwin/pks", + "format": "tar.xz" + }, + "macos-x86_64": { + "name": "pks-x86_64-apple-darwin.tar.xz", + "path": "pks-x86_64-apple-darwin/pks", + "format": "tar.xz" + }, + "linux-aarch64": { + "name": "pks-aarch64-unknown-linux-gnu.tar.xz", + "path": "pks-aarch64-unknown-linux-gnu/pks", + "format": "tar.xz" + }, + "linux-x86_64": { + "name": "pks-x86_64-unknown-linux-gnu.tar.xz", + "path": "pks-x86_64-unknown-linux-gnu/pks", + "format": "tar.xz" + }, + "windows-x86_64": { + "name": "pks-x86_64-pc-windows-msvc.zip", + "path": "pks.exe", + "format": "zip" } } } - } \ No newline at end of file + } +} diff --git a/.github/workflows/publish-dotslash.yml b/.github/workflows/publish-dotslash.yml new file mode 100644 index 00000000..4aefc4b4 --- /dev/null +++ b/.github/workflows/publish-dotslash.yml @@ -0,0 +1,31 @@ +# Adds a DotSlash `pks` file to each GitHub Release. release.yml (generated by +# dist) calls this after the release is published, via `post-announce-jobs` in +# dist-workspace.toml. It can't be a separate `on: release` workflow: dist +# creates the release with GITHUB_TOKEN, and events from GITHUB_TOKEN don't +# trigger other workflows. +name: Publish DotSlash file + +on: + workflow_call: + inputs: + plan: + required: true + type: string + +permissions: {} + +jobs: + publish-dotslash: + name: Generate and upload the DotSlash file + runs-on: ubuntu-latest + permissions: + contents: write # `gh release upload` adds the DotSlash file to the release + steps: + # Reads .github/workflows/dotslash-config.json through the API at the + # released commit, so there's no checkout. + - uses: facebook/dotslash-publish-release@9c9ec027515c34db9282a09a25a9cab5880b2c52 # v2 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + config: .github/workflows/dotslash-config.json + tag: ${{ fromJson(inputs.plan).announcement_tag }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 78ccf1a5..adc94a2d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -302,3 +302,14 @@ jobs: with: persist-credentials: false submodules: recursive + + custom-publish-dotslash: + needs: + - plan + - announce + uses: ./.github/workflows/publish-dotslash.yml + with: + plan: ${{ needs.plan.outputs.val }} + secrets: inherit + permissions: + "contents": "write" diff --git a/.github/zizmor.yml b/.github/zizmor.yml index 19c0fdd4..49e74d90 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -31,3 +31,13 @@ rules: # This repo configures no custom container runners, so matrix.container is # always null and no image is ever pulled. - release.yml + secrets-inherit: + ignore: + # dist calls every custom job (`post-announce-jobs` in dist-workspace.toml) + # with `secrets: inherit`. The only one is publish-dotslash.yml in this + # repo, which uses nothing but GITHUB_TOKEN. + - release.yml + self-repository: + ignore: + # dist calls custom jobs as `./.github/workflows/.yml`. + - release.yml diff --git a/CHANGELOG.md b/CHANGELOG.md index 9c7048af..b104a674 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -92,9 +92,12 @@ This is the first release built by cargo-dist. Each release now publishes `pks-.tar.xz` archives for macOS and Linux, a `.zip` for Windows, and `pks-installer.sh` and `pks-installer.ps1` installer scripts. The old asset names (`pks-mac.tar.gz`, `x86_64-unknown-linux-gnu.tar.gz` and -`aarch64-unknown-linux-gnu.tar.gz`) and the dotslash `pks` file are no longer -published, so anything that downloads release assets by name needs updating. -See [INSTALLATION.md](https://github.com/rubyatscale/pks/blob/main/INSTALLATION.md). +`aarch64-unknown-linux-gnu.tar.gz`) are no longer published, so anything that +downloads release assets by name needs updating. + +The dotslash `pks` file is still published under the same name. It now points +at the new archives, and it covers Windows as well as macOS and Linux. See +[INSTALLATION.md](https://github.com/rubyatscale/pks/blob/main/INSTALLATION.md). ### Internal diff --git a/INSTALLATION.md b/INSTALLATION.md index 98d3fa71..8bb2784d 100644 --- a/INSTALLATION.md +++ b/INSTALLATION.md @@ -1,6 +1,14 @@ # Installation -## Option 1: Prebuilt binary +## Option 1: dotslash + +- Install [dotslash](https://dotslash-cli.com/docs/installation/). +- Download the `pks` DotSlash file from a release, for example https://github.com/rubyatscale/pks/releases/latest/download/pks, and save it to your Ruby project's `bin/` directory. +- Run `bin/pks`. + +The file pins that release's binaries by hash, so everyone working on the project runs the same version. It covers macOS, Linux (x86_64 and aarch64), and Windows (x86_64). + +## Option 2: Prebuilt binary From v0.5.0, every release publishes prebuilt binaries for macOS, Linux, and Windows, along with installer scripts that put `pks` in `$CARGO_HOME/bin` (usually `~/.cargo/bin`). @@ -18,10 +26,6 @@ powershell -ExecutionPolicy Bypass -c "irm https://github.com/rubyatscale/pks/re To pin a version, replace `latest/download` with `download/v0.5.0` (or whichever version you want). You can also download a `pks-.tar.xz` archive, or the `.zip` on Windows, straight from the [releases page](https://github.com/rubyatscale/pks/releases). -## Option 2: dotslash (v0.4.0 and earlier) - -Releases up to v0.4.0 include a [dotslash](https://dotslash-cli.com/docs/installation/) `pks` file, for example https://github.com/rubyatscale/pks/releases/download/v0.4.0/pks. Save it to your Ruby project's `bin/` directory and run `bin/pks`. Releases from v0.5.0 on don't publish a dotslash file. - ## Option 3: Build from source - Install Rust: https://www.rust-lang.org/tools/install diff --git a/dist-workspace.toml b/dist-workspace.toml index 138620e8..8e26eec0 100644 --- a/dist-workspace.toml +++ b/dist-workspace.toml @@ -24,6 +24,11 @@ install-path = "CARGO_HOME" install-updater = false # Link build artifacts to the process which created it github-attestations = true +# Add a DotSlash `pks` file to each release once it's published +post-announce-jobs = ["./publish-dotslash"] + +[dist.github-custom-job-permissions] +"publish-dotslash" = { contents = "write" } # Pin the GitHub Actions that dist generates into release.yml to exact commits # rather than floating tags, so a compromised or retagged upstream release can't From dc256adecbc53edd756ce8366ee78c7c2d9bcbc0 Mon Sep 17 00:00:00 2001 From: Douglas Eichelberger Date: Sat, 26 Sep 2026 17:29:08 -0700 Subject: [PATCH 4/4] Note DotSlash re-run recovery, pin the CHANGELOG link dotslash-publish-release uploads without --clobber, so re-running the job once the `pks` asset is on the release fails. Say how to clear it in the workflow's header. The 0.5.0 CHANGELOG section becomes the release body, so link the INSTALLATION.md that shipped with it rather than main's. --- .github/workflows/publish-dotslash.yml | 4 ++++ CHANGELOG.md | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish-dotslash.yml b/.github/workflows/publish-dotslash.yml index 4aefc4b4..34ff12d2 100644 --- a/.github/workflows/publish-dotslash.yml +++ b/.github/workflows/publish-dotslash.yml @@ -3,6 +3,10 @@ # dist-workspace.toml. It can't be a separate `on: release` workflow: dist # creates the release with GITHUB_TOKEN, and events from GITHUB_TOKEN don't # trigger other workflows. +# +# The action uploads without --clobber, so re-running this job after the `pks` +# asset is on the release fails. Delete it first: +# gh release delete-asset pks --yes name: Publish DotSlash file on: diff --git a/CHANGELOG.md b/CHANGELOG.md index b104a674..1e58b32b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -97,7 +97,7 @@ downloads release assets by name needs updating. The dotslash `pks` file is still published under the same name. It now points at the new archives, and it covers Windows as well as macOS and Linux. See -[INSTALLATION.md](https://github.com/rubyatscale/pks/blob/main/INSTALLATION.md). +[INSTALLATION.md](https://github.com/rubyatscale/pks/blob/v0.5.0/INSTALLATION.md). ### Internal