Skip to content

chore: fix repo link (closed, accidental PR) - #37

Closed
eugencowie wants to merge 122 commits into
aptabase:mainfrom
eugencowie:chore/fix-repo-link
Closed

eugencowie wants to merge 122 commits into
aptabase:mainfrom
eugencowie:chore/fix-repo-link

Conversation

@eugencowie

@eugencowie eugencowie commented Oct 13, 2026 •

Copy link
Copy Markdown

Opened against wrong repo, sorry!

Framework-independent Rust SDK for constructing an Aptabase client,
enqueueing analytics events, managing sessions and metadata, selecting
hosted or self-hosted endpoints, and delivering queued events through
asynchronous Tokio-based batching and flushing.
## 🤖 New release

* `aptabase-rs`: 0.1.0

<details><summary><i><b>Changelog</b></i></summary><p>



</p></details>

---
This PR was generated with
[release-plz](https://github.com/release-plz/release-plz/).
## 🤖 New release

* `aptabase-rs`: 0.1.0 -> 0.1.1 (✓ API compatible changes)

<details><summary><i><b>Changelog</b></i></summary><p>



</p></details>

---
This PR was generated with
[release-plz](https://github.com/release-plz/release-plz/).
## 🤖 New release

* `aptabase-rs`: 0.1.1 -> 0.1.2

<details><summary><i><b>Changelog</b></i></summary><p>



</p></details>

---
This PR was generated with
[release-plz](https://github.com/release-plz/release-plz/).
Define caller-owned session ID support for applications that need to
persist or reuse Aptabase sessions across client construction.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added support for supplying a custom session ID when initialising the
client.
* Exposed a helper to generate a reusable session ID for app-managed
persistence.
  * Session IDs now continue to rotate automatically when not supplied.
* **Documentation**
* Expanded the README with guidance and an example for persisting and
reusing session IDs across restarts.
* **Bug Fixes**
* Empty session IDs are now treated as missing, so the SDK falls back to
automatic generation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
dependabot Bot and others added 24 commits October 11, 2026 15:26
Bumps [tokio](https://github.com/tokio-rs/tokio) from 1.53.1 to 1.53.2.
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-1.53.1...tokio-1.53.2)

---
updated-dependencies:
- dependency-name: tokio
  dependency-version: 1.53.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [tokio](https://github.com/tokio-rs/tokio) from 1.53.1 to 1.53.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tokio-rs/tokio/releases">tokio's
releases</a>.</em></p>
<blockquote>
<h2>Tokio v1.53.2</h2>
<h1>1.53.2 (October 3rd, 2026)</h1>
<h3>Fixed</h3>
<ul>
<li>fs: handle integer overflow in buffered relative seek (<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8574">#8574</a>)</li>
<li>io: revert &quot;always cleanup <code>AsyncFd</code> registration
list on deregister&quot; (<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8540">#8540</a>)</li>
<li>process: unregister Windows wait before closing child handle (<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8564">#8564</a>)</li>
<li>rt: drop blocking pool mutex before shutting down rejected task (<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8562">#8562</a>)</li>
<li>sync: fix mpsc index wraparound in block reclamation (<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8546">#8546</a>)</li>
<li>sync: forget mpsc <code>Permit</code> before sending value (<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8560">#8560</a>)</li>
<li>sync: validate <code>MAX_PERMITS</code> in
<code>Semaphore::acquire</code> (<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8548">#8548</a>)</li>
<li>sync: wake broadcast <code>Sender::closed</code> outside mutex (<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8558">#8558</a>)</li>
<li>task: drop replaced waker outside lock in <code>JoinSet</code> (<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8554">#8554</a>)</li>
<li>time: drop timer lock before dropping waker in
<code>clear_entry</code> (<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8552">#8552</a>)</li>
<li>time: expire timers directly on shutdown without rotating wheel (<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8570">#8570</a>)</li>
</ul>
<h3>Fixed (unstable)</h3>
<ul>
<li>fs: clamp <code>io_uring</code> read length to <code>u32::MAX</code>
(<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8572">#8572</a>)</li>
<li>rt: ignore <code>current_thread</code> task dumps from other
runtimes (<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8544">#8544</a>)</li>
<li>rt: preserve <code>io_uring</code> context if a completion waker
panics (<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8566">#8566</a>)</li>
<li>sync: fix semaphore use-after-free and permit leak on tracing panic
(<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8542">#8542</a>)</li>
<li>taskdump: restore deferred leaf wakes during capture (<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8445">#8445</a>)</li>
<li>time: drop stored waker when cancelling alt timer entry (<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8550">#8550</a>)</li>
</ul>
<p><a
href="https://redirect.github.com/tokio-rs/tokio/issues/8445">#8445</a>:
<a
href="https://redirect.github.com/tokio-rs/tokio/pull/8445">tokio-rs/tokio#8445</a>
<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8572">#8572</a>:
<a
href="https://redirect.github.com/tokio-rs/tokio/pull/8572">tokio-rs/tokio#8572</a>
<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8540">#8540</a>:
<a
href="https://redirect.github.com/tokio-rs/tokio/pull/8540">tokio-rs/tokio#8540</a>
<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8542">#8542</a>:
<a
href="https://redirect.github.com/tokio-rs/tokio/pull/8542">tokio-rs/tokio#8542</a>
<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8544">#8544</a>:
<a
href="https://redirect.github.com/tokio-rs/tokio/pull/8544">tokio-rs/tokio#8544</a>
<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8546">#8546</a>:
<a
href="https://redirect.github.com/tokio-rs/tokio/pull/8546">tokio-rs/tokio#8546</a>
<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8548">#8548</a>:
<a
href="https://redirect.github.com/tokio-rs/tokio/pull/8548">tokio-rs/tokio#8548</a>
<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8550">#8550</a>:
<a
href="https://redirect.github.com/tokio-rs/tokio/pull/8550">tokio-rs/tokio#8550</a>
<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8552">#8552</a>:
<a
href="https://redirect.github.com/tokio-rs/tokio/pull/8552">tokio-rs/tokio#8552</a>
<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8554">#8554</a>:
<a
href="https://redirect.github.com/tokio-rs/tokio/pull/8554">tokio-rs/tokio#8554</a>
<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8558">#8558</a>:
<a
href="https://redirect.github.com/tokio-rs/tokio/pull/8558">tokio-rs/tokio#8558</a>
<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8560">#8560</a>:
<a
href="https://redirect.github.com/tokio-rs/tokio/pull/8560">tokio-rs/tokio#8560</a>
<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8562">#8562</a>:
<a
href="https://redirect.github.com/tokio-rs/tokio/pull/8562">tokio-rs/tokio#8562</a>
<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8564">#8564</a>:
<a
href="https://redirect.github.com/tokio-rs/tokio/pull/8564">tokio-rs/tokio#8564</a>
<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8566">#8566</a>:
<a
href="https://redirect.github.com/tokio-rs/tokio/pull/8566">tokio-rs/tokio#8566</a>
<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8570">#8570</a>:
<a
href="https://redirect.github.com/tokio-rs/tokio/pull/8570">tokio-rs/tokio#8570</a>
<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8574">#8574</a>:
<a
href="https://redirect.github.com/tokio-rs/tokio/pull/8574">tokio-rs/tokio#8574</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/tokio-rs/tokio/commit/ff0c4068a4ba5f3af0fe3c5657ba42879b6ea599"><code>ff0c406</code></a>
chore: prepare Tokio v1.53.2 (<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8580">#8580</a>)</li>
<li><a
href="https://github.com/tokio-rs/tokio/commit/a762700e41bf027630ba4620cfd80d127b7c801d"><code>a762700</code></a>
Merge 'tokio-1.51.5' into 'tokio-1.53.x' (<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8577">#8577</a>)</li>
<li><a
href="https://github.com/tokio-rs/tokio/commit/ec31a9f62c9426cec415c8c79e0608dd2866bbf7"><code>ec31a9f</code></a>
chore: prepare Tokio v1.51.5 (<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8579">#8579</a>)</li>
<li><a
href="https://github.com/tokio-rs/tokio/commit/625c85108da5ad0d482702a21d7d58a56ea06a48"><code>625c851</code></a>
sync: assign semaphore permits before emitting tracing event (<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8542">#8542</a>)</li>
<li><a
href="https://github.com/tokio-rs/tokio/commit/832dd233293eaa59ba19cc6f5dc4753aab55ac13"><code>832dd23</code></a>
sync: avoid leaking semaphore permits on tracing panic (<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8542">#8542</a>)</li>
<li><a
href="https://github.com/tokio-rs/tokio/commit/826954a2f3b6f595121c38875a5d81ca3e5f6cc6"><code>826954a</code></a>
sync: unlink semaphore waiter before emitting tracing event (<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8542">#8542</a>)</li>
<li><a
href="https://github.com/tokio-rs/tokio/commit/9a479922501eb47102ab844fa40e4b28d1a3c250"><code>9a47992</code></a>
process: unregister Windows wait before closing child handle (<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8564">#8564</a>)</li>
<li><a
href="https://github.com/tokio-rs/tokio/commit/2fc5972b8bd6f51d1ad6df3bcc1a1927d1702663"><code>2fc5972</code></a>
fs: handle integer overflow in buffered relative seek (<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8574">#8574</a>)</li>
<li><a
href="https://github.com/tokio-rs/tokio/commit/85a6d13882e2ccf5c24131b282bab0214b0a493e"><code>85a6d13</code></a>
io: revert &quot;always cleanup AsyncFd registration list on
deregister&quot; (<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8540">#8540</a>)</li>
<li><a
href="https://github.com/tokio-rs/tokio/commit/436faa2da3970817653fef98c9abc6c8b4367f51"><code>436faa2</code></a>
rt: drop blocking pool mutex before shutting down rejected task (<a
href="https://redirect.github.com/tokio-rs/tokio/issues/8562">#8562</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/tokio-rs/tokio/compare/tokio-1.53.1...tokio-1.53.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tokio&package-manager=cargo&previous-version=1.53.1&new-version=1.53.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
mise's native mr-boxington integration wraps cargo in this project, so
builds and tests reuse compiler outputs across target directories and
worktrees. The Rust MSRV pin is unchanged.
The action caches the same pruned target/ and registry as rust-cache,
keyed on the rustc in use, and adds native link caching. It saves only
from pushes to main, so PRs stop adding entries to an Actions cache that
is already over its 10 GB limit.

The example job gets its own cache generation so it never restores the
root crate's target/.
## Summary

Cargo runs through mbx (mr-boxington) in this project, so builds and
tests reuse compiler outputs across target directories and worktrees.

```diff
 [tools]
+mr-boxington = "latest"
-rust = { version = "1.88", components = ["clippy", "rustfmt"] } # the MSRV
+rust = { version = "1.88", components = ["clippy", "rustfmt"], mr_boxington = true } # the MSRV
```

```text
cargo build / mise run test
  mise command wrapper (cargo)
    mbx            # cache lookup per compiler action
      cargo 1.88   # MSRV pin unchanged
```

CI swaps rust-cache for mr-boxington-action, which caches the pruned
`target/` and registry keyed on the rustc in use, adds native link
caching, and saves only from pushes to main.

```diff
 check / check-example
   mise-action
-    install_args: rust …
+    install_args: rust mr-boxington …
-  Swatinem/rust-cache
+  jdx/mr-boxington-action   # check-example: own working-directory and cache-generation
   mise run check / example:check
```

## Evidence

Plain `cargo build` into two fresh target directories, same toolchain,
profile and features:

- **Before (fresh dir 1, cold):** 0 hits, 505 not looked up, 12.5s
**After (fresh dir 2):** 324 hits, 179 misses, 6.1s (568 outputs
restored)

All 179 misses are C objects from aws-lc's build script that embed
absolute target paths (`mbx explain --last`); they hit when the path is
the same. `mbx doctor`: 0 failures. `mise run test`: 11 tests pass, 312
hits. `jactionlint` passes.

CI on this PR starts cold under the new cache keys; the first warm run
is the first PR after this merges to main.

## Merge Danger

**Door:** two-way

Revert the commits, or set `mr_boxington = false` and run `mise reshim`.
Old rust-cache entries age out of the Actions cache on their own.

**Blast Radius:** tooling

Changes how `cargo` is invoked for anyone using this repo's mise config,
and which Actions cache entries CI reads and writes. PRs no longer save
cache entries. No crate code or published artifacts change.
Cargo runs through mise's mbx wrapper, so without mr-boxington in
install_args mise installs it on demand partway through cargo publish.
Install it with the other tools instead.
Cargo runs through mise's mbx wrapper, so the release jobs already build
through mbx. Without `mr-boxington` in `install_args`, mise installs it
on demand partway through `cargo publish`.

This installs it in the mise-action setup step alongside the other
tools, so it's installed before release-plz runs and mise-action caches
it.

Follow-up to #31.
The release-pr job rebuilt the changelog with git-cliff-action and set
the version from its output, while `mise run release` ran `release-plz
update`. That leaves CHANGELOG.md alone (changelog_update = false) and
picks the version with release-plz's own rules over every commit,
upstream ones included, so a local run could pick a different version
than the release PR. And `mise run changelog` alone left CHANGELOG.md a
version ahead of Cargo.toml.

- release:prepare replaces the changelog, changelog:build-ignore-list
  and release tasks. It writes .cliffignore, updates CHANGELOG.md with
  `git cliff --bump`, and sets Cargo.toml to git-cliff's bumped version
- the release-pr job runs it in place of the ignore-list step,
  git-cliff-action and `set-version`, so CI uses mise.lock's git-cliff
  rather than the action's own download
- cliff.toml no longer sets `output`, so git-cliff writes CHANGELOG.md
  only when told to with `-o`. Before, every git-cliff run overwrote it,
  even `--bumped-version`
release-plz/action reinstalled release-plz with cargo-binstall on every
run, though mise had already installed mise.lock's version. Both jobs
now call it directly, with GIT_TOKEN for the token and the repo URL and
forge inferred from the checkout's remote. Of what else the action did:

- its git identity step stays, as release-plz/git-config with gh from
  mise.lock, but only in release-pr: release-plz commits locally when it
  updates an existing release PR, while release creates tags and
  releases through the API
- release-pr no longer gets CARGO_REGISTRY_TOKEN, as it never publishes

The action also installed cargo-semver-checks, which isn't carried over
as it never did anything here: release-plz skips its check because the
release-pr job has already set the new version, and cargo-semver-checks
0.51 needs Rust 1.93 to run, above our pinned 1.88.
Release PR and GitHub release bodies have always had an empty changelog.
git-cliff writes CHANGELOG.md, so release-plz runs with
changelog_update = false, and with that off it builds no changelog text
for either body. Both now get the release's `## <version>` section of
CHANGELOG.md, printed by a new release:notes task, which fails if the
section is missing rather than posting an empty changelog.

- release-pr: release-plz's default PR body renders an empty Changelog
  <details>, as its `{% if changes %}` sees leftover whitespace. The job
  reads the PR number and version from release-plz's JSON and puts the
  changelog before the block's closing </p></details>, failing if a
  release-plz upgrade drops it
- release-notes.yml: a new workflow runs on each published release and
  sets its notes, so a failure can be retried with a rerun, which the
  release job couldn't do once release-plz had published. It uses
  GitHub's own token with contents: write, and only fires because
  release-plz creates releases with RELEASE_PLZ_TOKEN, as its comment
  notes. It takes the version from the tag, so needn't install Rust
## Summary

Release PR and GitHub release bodies had an empty changelog: git-cliff
writes `CHANGELOG.md`, so release-plz runs with `changelog_update =
false` and has no changelog text for either. Both now get the release's
`## <version>` section of `CHANGELOG.md`.

```diff
 mise.toml tasks
-changelog                     # git cliff --bump (left Cargo.toml a version behind)
-changelog:build-ignore-list
-release                       # release-plz update (its own version rules)
+release:prepare               # .cliffignore + git cliff --bump + set-version
+release:notes <version>       # prints a version's CHANGELOG.md section, fails if missing

 release.yml
   release                     # on push to main
-    release-plz/action release
+    release-plz release       # mise.lock's release-plz, no reinstall
   release-pr
-    mise run changelog:build-ignore-list
-    git-cliff-action --bump
-    release-plz set-version
-    release-plz/action release-pr
+    mise run release:prepare
+    release-plz release-pr -o json
+    gh pr edit               # notes into the default body's empty Changelog <details>

+release-notes.yml             # on release published, so a failure can be rerun
+  gh release edit --notes "$(mise run release:notes <tag>)"
```

- `cliff.toml` no longer sets `output`, so git-cliff only writes
`CHANGELOG.md` when told to with `-o`. Before, even `git cliff
--bumped-version` overwrote it.
- release-plz/action's cargo-semver-checks isn't carried over:
release-plz skips the check once `release:prepare` has set the version,
and 0.51 needs Rust 1.93 against our pinned 1.88.

## Evidence

- **Before:** the 0.3.0 release PR (#13) has an empty
`<details><summary>Changelog</summary>` block, and `gh release view
v0.3.0` has an empty body.
**After:** filling #13's real body with `mise run release:notes 0.3.0`,
rendered through GitHub's Markdown API, shows the Features /
Documentation / Miscellaneous Tasks lists inside the Changelog block
(neither the PR nor the release was edited).
- **Before:** `mise run release` set the version by release-plz's rules,
and `mise run changelog` alone left `CHANGELOG.md` at a version
Cargo.toml didn't have.
**After:** in a scratch clone of main, `mise run release:prepare` writes
`## 0.3.1` and sets Cargo.toml to 0.3.1, matching `git cliff
--bumped-version`.
- `release:notes 9.9.9` and `release:notes` with no version both exit 1.
`release-plz release --dry-run -o json` against this repo infers the
forge from the remote and returns `{"releases":[]}`.
- `mise run check:workflows` (jactionlint + shellcheck) passes on each
commit.

## Merge Danger

**Door:** two-way

CI and task config only. Reverting restores the old workflow and tasks.

**Blast Radius:** releases

- Merging runs release-pr straight away, which will open or update the
0.3.1 release PR with the changelog filled in. That's the first real
test of `release-plz release-pr -o json`, the git-config identity, and
the body fill.
- `release-notes.yml` first runs on the next published release. It only
fires because release-plz creates releases with `RELEASE_PLZ_TOKEN`;
GitHub's own token wouldn't trigger it.
- 0.3.0 and earlier keep their empty notes. Backfill by hand: `gh
release edit v0.3.0 --notes "$(mise run release:notes 0.3.0)"`.
- `mise run release` and `mise run changelog` no longer exist locally;
use `mise run release:prepare`.
## 🤖 New release

* `aptabase-rs`: 0.3.0 -> 0.3.1

<details><summary><i><b>Changelog</b></i></summary><p>




### 🚜 Refactor

- Move fork-only code out of upstream-shared files
([#25](#25))

### 🧪 Testing

- Test event delivery against a local stand-in server
([#28](#28))

### ⚙️ Miscellaneous Tasks

- Stop tracking the example's lockfile
([#23](#23))
- Match upstream's Rust edition and require Rust 1.88
([#21](#21))
- Stop mise run from installing unused tools in CI
([#26](#26))
- Pin release-plz and git-cliff to mise.lock versions
([#27](#27))
- Switch to jactionlint and harden the workflows
([#29](#29))
- Cache builds with mbx
([#31](#31))
- Install mbx for release jobs
([#32](#32))
- Add the changelog to release PR and GitHub release bodies
([#33](#33))

</p></details>

---
This PR was generated with
[release-plz](https://github.com/release-plz/release-plz/).
Both release jobs shared one mise-action step through an anchor, so the
release job installed git-cliff and gh it never runs. Each job now has
its own step: prepare-release keeps all five tools, and release installs
only rust, mr-boxington and release-plz, which cargo publish needs.
release-plz creates the GitHub release through the API, and with
changelog_update = false it doesn't use git-cliff.

- the release-pr job is now prepare-release, and runs before release
- the checkout anchor goes too, as the two jobs no longer share steps
- one-line with and env blocks use flow style, and env follows run, to
  match ci.yml and release-notes.yml
- the PR-body script checks for the Changelog <details> before reading
  the notes
## Summary

The two release jobs shared one mise-action step through a YAML anchor,
so `release` installed tools it never runs. Each job now has its own
step.

```diff
 release.yml
-  release-pr                  # "Release PR"
+  prepare-release             # "Prepare release", now listed first
     install_args: rust mr-boxington release-plz git-cliff gh
   release
-    install_args: rust mr-boxington release-plz git-cliff gh   # *install-tools
+    install_args: rust mr-boxington release-plz
```

- `release` runs only `release-plz release`, which needs cargo for
`cargo publish`, so it needs `rust` and `mr-boxington`. release-plz
creates the GitHub release through the API itself, so it doesn't need
`gh`. With `changelog_update = false` it doesn't need `git-cliff`
either.
- `prepare-release` uses all five tools. `release:prepare` runs `git
cliff` and `release-plz set-version`, and `release-plz release-pr` runs
cargo. The PR-body fill uses `gh pr view` and `gh pr edit`.
- The `checkout` anchor is gone too, and both checkout steps are written
out.
- Style now matches `ci.yml`: single-line `with`/`env` blocks use flow
style, and `env` comes after `run` in all three workflows.
- The PR-body script now checks for the Changelog `</p></details>`
before it reads the notes.
- Three comments are removed:
  - `release-notes.yml`: why this workflow needs `RELEASE_PLZ_TOKEN`
  - `release.yml`: why the `release-plz/git-config` step is there
- `release.yml`: the "Fill the empty Changelog" note above the PR-body
script

## Evidence

- `mise run check:workflows` (jactionlint) passes.
- No `&install-tools` or `*install-tools` remains in the repo.
- The `release-plz.toml` comment now refers to the `prepare-release`
job.

## Merge Danger

**Door:** two-way

Only workflow config changes. Reverting restores the shared step.

**Blast Radius:** releases

- If `release-plz release` needs a tool that's no longer installed,
`release` fails on the next merge that publishes.
`MISE_TASK_RUN_AUTO_INSTALL: false` only covers `mise run`, and `mise
run` isn't used in that job. A missing tool would show up as an error or
an on-demand install.
- The check name changes from "Release PR" to "Prepare release". It only
runs on push to `main`, so no PR status check refers to it.
Steps pinned to a SHA showed up in the Actions UI as
"Run jdx/mise-action@2d8d4caf..." or as the first line of their script.
Each step now has a name, and with/env blocks use block style so the
${{ }} expressions no longer need quoting.
## Summary

Steps pinned to a SHA showed in the Actions UI as "Run
jdx/mise-action@2d8d4caf…", and `run:` steps showed their first script
line. Every step now has a name, and `with`/`env` use block style.

```diff
 steps:
-  - uses: jdx/mise-action@2d8d4caf… # v5.1.1
-    with: { install_args: rust mr-boxington }
+  - name: Install tools
+    uses: jdx/mise-action@2d8d4caf… # v5.1.1
+    with:
+      install_args: rust mr-boxington
+
```

| Step | Name |
|---|---|
| `actions/checkout` | Checkout |
| `jdx/mise-action` | Install tools |
| `jdx/mr-boxington-action` | Set up build cache |
| `mise run check` / `example:check` | Run checks |
| `release-plz/git-config` | Configure git |
| `mise run release:prepare` | Update changelog and version |
| `release-plz release-pr` and changelog fill | Create or update release
PR |
| `release-plz release` | Publish release |
| `gh release edit` | Set release notes |

- This reverses the flow-style rule from c751fd7. Named steps are
multi-line anyway, so the single-line `with`/`env` no longer saved much.
- Block style means `${{ }}` values no longer need quoting.
- A blank line now separates steps.

## Evidence

- **Before:** steps listed by action SHA or by the first script line.
**After:** every step named. `yq '[.jobs[].steps[] | select(has("name")
| not)] | length'` gives `0` for all three workflows.
- With step names removed, each workflow parses to identical JSON on
`main` and on this branch (`yq -o=json 'del(.jobs[].steps[].name)'`). So
actions, SHAs, inputs, env and scripts are unchanged.
- `mise run check:workflows` (jactionlint) passes.

## Merge Danger

**Door:** two-way

Only formatting and step names change. Reverting restores the previous
files.

**Blast Radius:** CI

- The workflows behave the same, as the parse comparison shows. Only the
step labels in the Actions UI change.
- Job names are unchanged, so required status checks are unaffected.
mise 2026.10 writes lockfile_version = 3, which records each tool's
version specifier from mise.toml and the GitHub repository ID of
mr-boxington's signed releases. Tool versions, URLs and checksums are
unchanged.
## Summary

mise 2026.10 writes `lockfile_version = 3`. It adds metadata only. Tool
versions, URLs and checksums stay the same.

```diff
+lockfile_version = 3
+
 [[tools.gh]]
 version = "2.96.0"
 backend = "aqua:cli/cli"
+specifiers = ["latest"]          # every tool: its version from mise.toml

 [tools.mr-boxington."platforms.linux-x64"]
 checksum = "sha256:4177…"
 signer = "sigstore-oidc:…/release.yml"
+repository_ids = { repository = "1340721957" }   # mr-boxington platforms only
```

## Evidence

- The diff is 15 insertions and 0 deletions, so no `version`, `url` or
`checksum` line changes.
- Running `mise lock` (mise 2026.10.3) on this branch leaves `mise.lock`
byte-identical.

## Merge Danger

**Door:** two-way

Reverting restores the old format. mise rewrites it on the next `mise
lock` anyway.

**Blast Radius:** tooling

- Older mise versions may not read lockfile v3. CI's `mise-action`
installs a current mise, so CI is unaffected. Contributors on an older
mise may need to update it.
The mise local config, agent/editor, Windows, macOS and Linux sections
ignore files that come from each contributor's setup rather than from
the project. Those belong in a global gitignore. The Rust, dotenv,
examples and git-cliff patterns stay.
## Summary

`.gitignore` now covers only what the project itself generates. Patterns
for each contributor's own setup belong in their global gitignore.

```diff
 .gitignore
   Rust            # target, *.rs.bk, *.pdb, mutants.out, rustc-ice
   dotenv          # .env
   Examples        # examples/*/Cargo.lock
   git-cliff       # .cliffignore
-  mise            # mise.local.toml and variants
-  Agents          # .claude/, CLAUDE.md, .cursor/, .codex/, .aider*, …
-  Windows         # Thumbs.db, desktop.ini, …
-  macOS           # .DS_Store, ._*, …
-  Linux           # *~, .directory, .Trash-*, …
```

## Evidence

- `git status --untracked-files=all` in this checkout shows no new
untracked files after the change.

## Merge Danger

**Door:** two-way

Reverting restores the removed sections.

**Blast Radius:** contributors

- Contributors without a global gitignore may see local files such as
`.DS_Store`, `mise.local.toml` or `.claude/` as untracked and could
commit them by accident.
.cliffignore already removes branch commits and main only takes PR
merges,
so the PR-number filter is redundant. Dropping it fixes scoped commits
being silently skipped and unrecognised types landing under Security,
and
adds an Other group so unknown types still show up.
## Summary

Uses the same `cliff.toml` as my other projects (only the repo name in
the PR links differs). Dropping the PR-number filter fixes two bugs
where commits were silently dropped or put under the wrong heading.

```diff
 [changelog]
-postprocessors = [ (#N) -> PR link ]
 [git]
-filter_commits = true
 tag_pattern = "^v[0-9]"
 commit_parsers = [
-  "^feat!?: .+ \(#[0-9]+\)"  -> Features      # no scope allowed
+  "^feat"                    -> Features
   ...same for fix/doc/perf/refactor/style/test/chore|ci/revert
-  message "^[a-z]+!?: .+ \(#N\)" + body ".*security" -> Security
+  body ".*security"          -> Security
+  ".*"                       -> Other
 ]
+commit_preprocessors = [ (#N) -> PR link ]
 [bump]
 breaking_always_bump_major = false
```

The PR-number filter isn't needed. `.cliffignore` (from `mise run
release:prepare`) already removes branch commits, and main's ruleset
only takes PR merges, so every commit left already ends in `(#N)`.

## Evidence

Test commits run through `git cliff --unreleased` with the old and new
config:

| Commit | Before | After |
|---|---|---|
| `feat(cli): Scoped feature (#1000)` | dropped | Features, `*(cli)*
Scoped feature` |
| `build: Unknown type (#1001)` | 🛡️ Security | 💼 Other |

- **Before:** the scope regex doesn't allow `(cli)`, and git-cliff
ignored the Security rule's `body` condition once `message` matched.
  **After:** both are handled as shown above.
- Regenerating the whole changelog with `.cliffignore` leaves every
released section of `CHANGELOG.md` unchanged.

## Merge Danger

**Door:** two-way

Changelog config only. Reverting restores the old parsers.

**Blast Radius:** changelog

- The next release PR's changelog will include PRs with scoped or
non-standard types that the old config dropped. None exist in the
history so far.
- Running plain `git cliff` without regenerating `.cliffignore` would
now list branch commits. `mise run release:prepare` always regenerates
it.
@eugencowie eugencowie closed this Oct 13, 2026
@eugencowie eugencowie changed the title chore: Fix repo link chore: fix repo link (closed, wrong repo) Oct 13, 2026
@eugencowie
eugencowie deleted the chore/fix-repo-link branch October 13, 2026 12:15
@eugencowie
eugencowie restored the chore/fix-repo-link branch October 13, 2026 12:18
@eugencowie
eugencowie deleted the chore/fix-repo-link branch October 13, 2026 12:19
@eugencowie eugencowie changed the title chore: fix repo link (closed, wrong repo) chore: fix repo link (closed, accidental PR) Oct 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant