chore: add release-please for semantic versioning#1
Merged
Conversation
todie
added a commit
that referenced
this pull request
Apr 7, 2026
…4+ schema Two pre-existing issues on main that were silently breaking CI on every open PR (#1 release-please, #2 screenshot fix, #3 editorconfig) via the Format and Deny jobs. Neither was introduced by the open PRs — they landed in the CI/CD overhaul commit 'ea74fa4 feat: CI/CD overhaul + process restart loop + zero clippy warnings' (the 'zero clippy warnings' part was true; the 'cargo fmt --check passes' part apparently wasn't). ## 1. rustfmt violations across 17 files `cargo fmt --check` on main produces 86 diff hunks across: crates/reach-cli/src/commands/{connect,create,destroy,exec,list,screenshot,serve,vnc}.rs crates/reach-cli/src/{config,docker,mcp}.rs crates/reach-cli/tests/{docker_types,e2e_container,mcp_types}.rs crates/reach-supervisor/src/{main,processes,signals}.rs Applied `cargo fmt --all` with the project's rustfmt.toml (max_width=100). No behavioral changes — pure whitespace/alignment/import-grouping edits. ## 2. deny.toml schema migration (cargo-deny 0.14+) cargo-deny 0.14 removed or changed several schema keys: - `[advisories] vulnerability = "deny"` → REMOVED (cargo-deny now always denies vulnerabilities in its pipeline). - `[advisories] unmaintained = "warn"` → REJECTED. The field's semantics changed from severity ("deny"/"warn") to scope ("all"/"workspace"/"transitive"/"none"). Migrated to "workspace" — we only care about crates we directly depend on being marked unmaintained, not transitives we don't control. - `[licenses] unlicensed = "deny"` → REMOVED (see EmbarkStudios/cargo-deny#611 for the migration note). cargo-deny now handles unlicensed crates as deny-by-default in the licenses pipeline without the explicit key. ## 3. RUSTSEC-2024-0437 ignore (protobuf 2.28 stack overflow) After the schema migration, `cargo deny check` surfaces a real vulnerability: protobuf 2.28.0 is transitively pulled in by `prometheus 0.13.4 → reach-supervisor`. RUSTSEC-2024-0437 is a stack overflow caused by unbounded recursion when PARSING untrusted protobuf input. reach-supervisor uses prometheus to EXPORT metrics (serialise to the Prometheus text format, served over an HTTP endpoint on port 8400). It never parses protobuf input from the network or from untrusted sources, so the vector does not apply. Added an explicit `[advisories] ignore` with a detailed justification comment so the rationale is preserved inline. Follow-up: upgrade to a prometheus version that uses protobuf 3.x, or drop the prometheus crate in favour of a pure-text-format exporter. ## Verification Local CI parity: `cargo fmt --check` clean `cargo deny check` advisories ok, bans ok, licenses ok, sources ok `cargo clippy --workspace -- -D warnings` zero warnings `cargo build --workspace --release` clean After this lands on main, the Format + Deny jobs will start passing on open PRs #1, #2, #3 without any per-branch rebasing (the fixes are on main, not downstream). Worthwhile to cascade-rebase the three so they pick up the fmt-normalised line-lengths in docker.rs (which PR #2 touches).
2 tasks
todie
added a commit
that referenced
this pull request
Apr 7, 2026
…4+ schema Two pre-existing issues on main that were silently breaking CI on every open PR (#1 release-please, #2 screenshot fix, #3 editorconfig) via the Format and Deny jobs. Neither was introduced by the open PRs — they landed in the CI/CD overhaul commit 'ea74fa4 feat: CI/CD overhaul + process restart loop + zero clippy warnings' (the 'zero clippy warnings' part was true; the 'cargo fmt --check passes' part apparently wasn't). ## 1. rustfmt violations across 17 files `cargo fmt --check` on main produces 86 diff hunks across: crates/reach-cli/src/commands/{connect,create,destroy,exec,list,screenshot,serve,vnc}.rs crates/reach-cli/src/{config,docker,mcp}.rs crates/reach-cli/tests/{docker_types,e2e_container,mcp_types}.rs crates/reach-supervisor/src/{main,processes,signals}.rs Applied `cargo fmt --all` with the project's rustfmt.toml (max_width=100). No behavioral changes — pure whitespace/alignment/import-grouping edits. ## 2. deny.toml schema migration (cargo-deny 0.14+) cargo-deny 0.14 removed or changed several schema keys: - `[advisories] vulnerability = "deny"` → REMOVED (cargo-deny now always denies vulnerabilities in its pipeline). - `[advisories] unmaintained = "warn"` → REJECTED. The field's semantics changed from severity ("deny"/"warn") to scope ("all"/"workspace"/"transitive"/"none"). Migrated to "workspace" — we only care about crates we directly depend on being marked unmaintained, not transitives we don't control. - `[licenses] unlicensed = "deny"` → REMOVED (see EmbarkStudios/cargo-deny#611 for the migration note). cargo-deny now handles unlicensed crates as deny-by-default in the licenses pipeline without the explicit key. ## 3. RUSTSEC-2024-0437 ignore (protobuf 2.28 stack overflow) After the schema migration, `cargo deny check` surfaces a real vulnerability: protobuf 2.28.0 is transitively pulled in by `prometheus 0.13.4 → reach-supervisor`. RUSTSEC-2024-0437 is a stack overflow caused by unbounded recursion when PARSING untrusted protobuf input. reach-supervisor uses prometheus to EXPORT metrics (serialise to the Prometheus text format, served over an HTTP endpoint on port 8400). It never parses protobuf input from the network or from untrusted sources, so the vector does not apply. Added an explicit `[advisories] ignore` with a detailed justification comment so the rationale is preserved inline. Follow-up: upgrade to a prometheus version that uses protobuf 3.x, or drop the prometheus crate in favour of a pure-text-format exporter. ## Verification Local CI parity: `cargo fmt --check` clean `cargo deny check` advisories ok, bans ok, licenses ok, sources ok `cargo clippy --workspace -- -D warnings` zero warnings `cargo build --workspace --release` clean After this lands on main, the Format + Deny jobs will start passing on open PRs #1, #2, #3 without any per-branch rebasing (the fixes are on main, not downstream). Worthwhile to cascade-rebase the three so they pick up the fmt-normalised line-lengths in docker.rs (which PR #2 touches).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
How it works
On every push to , release-please inspects conventional commits and either opens/updates a release PR (bumping versions in and updating ). Merging that PR creates a GitHub Release with a version tag.
Test plan
🤖 Generated with Claude Code