ci: fix silent no-op crates.io publish

[scarmuega]

Problem

The v1.1.0 release CI job ran green but published nothing to crates.io. The publish step (cargo release publish --workspace --execute ...) printed only its plan line (Publishing pallas-codec, …) and exited 0 without uploading a single crate.

Root cause: the workspace Cargo.toml carries

[workspace.metadata.release]
push = false
publish = false

publish = false is intentional — it lets a local cargo release <version> do bump + commit + tag only. But cargo-release reads that same config in CI, so cargo release publish treated every crate as do-not-publish and no-op'd while still exiting 0. The green check hid it.

Fix

• Add --isolated to the CI publish command so cargo-release ignores [workspace.metadata.release] and publish defaults back to true — CI only, the local tag-only flow is unchanged. Verified against the v1.1.0 tree: without it → silent no-op; with it → Uploading pallas-codec v1.1.0 ….
• Add a post-publish guard that polls the sparse index for the umbrella pallas crate at the tag's version and fails the job if it never appears, so a no-op publish can never report success again. Since all crates publish together pinned to =version, pallas being live implies the rest are.

Note

v1.1.0 has already been published manually to crates.io to unblock consumers; this PR prevents a recurrence on the next release.

Summary by CodeRabbit

• Chores
  • Enhanced release workflow reliability by adding verification that published versions are properly indexed on crates.io before workflow completion, reducing the risk of failed or incomplete releases going undetected.

[coderabbitai]

Warning

Review limit reached

@scarmuega, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 23 minutes and 54 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: af2e7086-c04d-4f09-a8e2-82aa782ab279

📥 Commits

Reviewing files that changed from the base of the PR and between 2fdf87e and 3c1bbb9.

📒 Files selected for processing (1)

• .github/workflows/release.yml

📝 Walkthrough

Walkthrough

The release workflow now isolates the cargo publish step from workspace metadata configuration and adds a post-publish verification loop. The new verification polls the crates.io index for the released pallas version derived from the git tag, failing explicitly if the version does not appear within the retry window.

Changes

Release workflow publish improvements

Layer / File(s)	Summary
Isolated publish with verification .github/workflows/release.yml	The cargo release publish command adds --isolated flag to avoid reliance on workspace.metadata.release behavior. A new verification step polls the crates.io index via curl and jq to confirm the released version appears, with explicit failure if retries are exhausted without finding the version.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰 A rabbit pushed packages with care,
Adding --isolated to be fair,
Then verifying each one finds its place,
On crates.io's index—the release race!
No silent failures for this hare! 🚀

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main fix: addressing a silent no-op in crates.io publishing via CI, which is the core issue resolved in this pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/fix-release-publish

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}