name: Release
on:
workflow_dispatch:
inputs:
commit_sha:
description: Exact main-branch commit to publish
required: true
type: string
version:
description: Exact crate version to publish
required: true
type: string
permissions:
actions: read
contents: write
concurrency:
group: release-${{ inputs.version }}
cancel-in-progress: false
jobs:
publish:
runs-on: macos-latest
timeout-minutes: 45
env:
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
EXPECTED_SHA: ${{ inputs.commit_sha }}
EXPECTED_VERSION: ${{ inputs.version }}
GH_TOKEN: ${{ github.token }}
steps:
- uses: actions/checkout@v4
with:
ref: ${{ inputs.commit_sha }}
fetch-depth: 0
- name: Verify immutable release identity
shell: bash
run: |
set -euo pipefail
actual_sha=$(git rev-parse HEAD)
test "$actual_sha" = "$EXPECTED_SHA"
git fetch origin main
test "$actual_sha" = "$(git rev-parse origin/main)"
actual_version=$(sed -n 's/^version = "\([^"]*\)"/\1/p' Cargo.toml | head -1)
test "$actual_version" = "$EXPECTED_VERSION"
test -n "$CARGO_REGISTRY_TOKEN"
git diff --exit-code
- name: Require successful exact-SHA CI
shell: bash
run: |
set -euo pipefail
successes=$(gh run list \
--commit "$EXPECTED_SHA" \
--workflow CI \
--json conclusion,event \
--jq '[.[] | select(.event == "push" and .conclusion == "success")] | length')
test "$successes" -ge 1
- name: Toolchain
uses: dtolnay/rust-toolchain@master
with:
toolchain: "1.88.0"
- name: Package exact source
shell: bash
run: |
set -euo pipefail
cargo package --locked
crate="target/package/hf2q-${EXPECTED_VERSION}.crate"
test -s "$crate"
shasum -a 256 "$crate" | tee "$RUNNER_TEMP/release-crate.sha256"
- name: Install and smoke-test packed artifact
shell: bash
run: |
set -euo pipefail
package_root="target/package/hf2q-${EXPECTED_VERSION}"
(
cd "$package_root"
cargo check --locked --all-targets --all-features
cargo test --locked --lib --all-features
cargo test --locked --test convert_integration --all-features
cargo test --locked --test lcp_registry_unit --all-features
cargo test --locked --bin hf2q --all-features convert::orchestrator::tests::
cargo test --locked --bin hf2q --all-features qwen35_bounded_prefill_watchdog_tests -- --test-threads=1
cargo test --locked --bin hf2q --all-features gemma4_bounded_prefill_tests -- --test-threads=1
cargo test --locked --bin hf2q --all-features slotaware_fail_stop_tests -- --test-threads=1
cargo test --locked --bin hf2q --all-features engine_supervisor::tests -- --test-threads=1
cargo test --locked --bin hf2q --all-features public_watchdog_fixture_bytes_are_stable_without_a_model -- --test-threads=1
cargo test --locked --bin hf2q --all-features readiness_guard_tests -- --test-threads=1
bash -n scripts/qwen36_watchdog_validate.sh \
scripts/test_qwen36_prefill_watchdog.sh \
scripts/test_qwen36_prefill_cancellation.sh \
scripts/test_qwen36_cumulative_release.sh \
scripts/test_deepseek4_agentic.sh \
scripts/test_deepseek4_cached_suffix.sh \
scripts/test_deepseek4_interactive_overlap.sh
bash scripts/test_qwen36_watchdog_harness_contract.sh
cargo test --locked --bin hf2q --all-features deepseek4 -- \
--skip attention_forward_tests \
--skip allocator_materializes_the_plan_as_zeroed_bf16_buffers \
--skip cache_steps_publish_only_complete_groups_and_commit_transactionally \
--skip partial_token_poison_requires_reset_before_replay \
--skip start_zero_prefill_span_counts_complete_groups_and_publishes_once \
--skip ffn_forward_tests \
--skip raw_matmul_accepts_quality_sensitive_f32_weights \
--skip embedding_forward_rejects_empty_input \
--skip q2_k_embeddings_expand_to_four_identical_hc_streams \
--skip native_model_load_keeps_weights_and_cache_on_one_device \
--skip native_output_head_produces_finite_vocab_logits_and_rejects_shape_drift \
--skip loader_preserves_raw_blocks_and_expands_only_elementwise_state \
--skip loader_rejects_catalog_and_i32_storage_before_residency
)
install_root="$RUNNER_TEMP/hf2q-install"
cargo install \
--path "$package_root" \
--locked \
--root "$install_root"
"$install_root/bin/hf2q" --help >/dev/null
- name: Publish exact package
shell: bash
run: |
set -euo pipefail
published="$RUNNER_TEMP/hf2q-${EXPECTED_VERSION}-published.crate"
if curl --fail --location --silent --show-error \
"https://static.crates.io/crates/hf2q/hf2q-${EXPECTED_VERSION}.crate" \
--output "$published"; then
echo "hf2q ${EXPECTED_VERSION} is already published; verifying exact bytes"
else
cargo publish --locked --token "$CARGO_REGISTRY_TOKEN"
fi
- name: Verify crates.io bytes
shell: bash
run: |
set -euo pipefail
expected=$(awk '{print $1}' "$RUNNER_TEMP/release-crate.sha256")
downloaded="$RUNNER_TEMP/hf2q-${EXPECTED_VERSION}.crate"
for _ in $(seq 1 24); do
if curl --fail --location --silent --show-error \
"https://static.crates.io/crates/hf2q/hf2q-${EXPECTED_VERSION}.crate" \
--output "$downloaded"; then
actual=$(shasum -a 256 "$downloaded" | awk '{print $1}')
test "$actual" = "$expected"
exit 0
fi
sleep 5
done
exit 1
- name: Tag and create GitHub release
shell: bash
run: |
set -euo pipefail
tag="v${EXPECTED_VERSION}"
git tag "$tag" "$EXPECTED_SHA"
git push origin "$tag"
gh release create "$tag" \
"target/package/hf2q-${EXPECTED_VERSION}.crate" \
"$RUNNER_TEMP/release-crate.sha256" \
--target "$EXPECTED_SHA" \
--title "hf2q ${EXPECTED_VERSION}" \
--generate-notes \
--verify-tag