[Medium] publish.yml publishes crates with no test gate and risks index race

[Kingvic300]

Severity: Medium — publish.yml publishes two crates with no test gate and risks an index race

# .github/workflows/publish.yml
- run: cargo publish --package txio-api
- run: cargo publish --package txio

(.github/workflows/publish.yml).

Problems

1. No verification before publishing — no cargo build/cargo test runs first, so a tag can publish a broken release to crates.io (which is immutable; you can only yank).
2. Index propagation race — the CLI (txio) depends on txio-api (it imports txio_api). If txio's dependency on txio-api is a version dependency, publishing txio immediately after txio-api can fail because the new txio-api version may not yet be available in the registry index. Publishing also requires path deps to carry a version.

Fix

• Add cargo test --workspace (and a dry-run cargo publish --dry-run) as a prerequisite.
• Publish txio-api first, then wait/retry for it to be queryable before publishing txio, and ensure the inter-crate dependency declares a published version.

---

Migrated from Kingvic300/txio#48

[devfoma]

Hellp, I would love to take on this issue. I'm a software engineer with over 4 years experience. and i'm confident I can resolve this issue

[grantfox-oss]

🦊 GrantFox — @devfoma has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes Txio-labs/txio-cli#7)
2. Your PR will be reviewed by the Txio-labs maintainers

Good luck! Track your progress on GrantFox.

[Kingvic300]

@devfoma what's the status on this? This issue will be unassigned from you in the next 8 hours if there's no update.

[Kingvic300]

Closed by PR Txio-labs/txio#235 - Fixed in commit(s) on branch test-191

[Kingvic300]

Reopening — no test gate was ever added

Re-verified against latest main (commit cd6834e). .github/workflows/publish.yml (31 lines, whole file) still goes straight from actions/checkout → dtolnay/rust-toolchain → cargo publish --package txio-api → cargo publish --package txio, with zero build/test step in between.

crates.io publishes are immutable (yank-only, no overwrite), so a broken tag still ships a broken release to anyone who cargo installs it. Compounding factor found in this sweep: tag-push (on: push: tags: "v*") never triggers ci.yml either (its push trigger is branch-scoped, not tag-scoped) — so there's currently no path that requires lint/test/clippy to pass before a tagged commit gets published to crates.io. Reopening rather than filing a duplicate since the exact fix this issue asked for (cargo test --workspace / cargo publish --dry-run before the real publish) was never added.

Timeframe

Claim window: 96 hours. If this issue is claimed/assigned, please submit a fix within 96 hours of assignment — after that window it may be released back up for grabs.

Community

Questions about this issue or the campaign? Join https://t.me/txioCommunity