[M3gA-Mind]

Summary

The release.yml dispatch for v0.9.0 (bump=minor, run 39998476560) failed at "Update crate version" before anything was committed, tagged or published:

error: failed to select a version for the requirement `tinyflows = "^0.8.0"`
candidate versions found which didn't match: 0.9.0
required by package `tinyflows-drivers v0.1.0`

The step rewrites only crates/tinyflows/Cargo.toml. The root workspace dependency that tinyflows-catalog, -copilot, -drivers and -module inherit also pins a version: tinyflows = { version = "0.8.0", path = "crates/tinyflows" } (Cargo.toml:33). A patch bump still satisfies ^0.8.0, which is why every 0.8.x release worked. A minor or major bump does not.

The fix is in the release step, which every future bump goes through. It now:

• rewrites that workspace requirement to the new version in the same step;
• asserts the rewrite took, with grep -qx on the exact line, so a reformatted manifest fails loudly instead of silently skipping;
• adds the root Cargo.toml to the release commit.

Related issue

None.

API or behavior changes

None to the crate. Release commits now also touch the root Cargo.toml.

Validation

• Dry-ran the new perl substitution with NEXT_VERSION=0.9.0 on a copy of main's root Cargo.toml. Line 33 becomes tinyflows = { version = "0.9.0", path = "crates/tinyflows" }, and the grep -qx assertion matches it.
• The workflow YAML parses.
• The real proof is the next release.yml dispatch after this merges.

Tests

None. This is a CI workflow change.

Documentation

Not needed.

Checklist

• The change is focused on one logical change
• No new #[allow(...)], #[ignore], or relaxed lints
• No secrets, tokens, or .env contents in the diff or the description

[tinysweeper]

Tiny Sweeper review

Reviewed head: 846f198fd6ef42ba4e43abe3dcadbb27a2be488c

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 1 of 1 files.
Pull request purpose (title): ci(release): bump th…

Diagnostics and supporting details

Full summary

Pull request purpose (title): ci(release): bump the workspace tinyflows requirement with the crate version. The release workflow now bumps the root workspace `tinyflows` dependency requirement along with the crate version, asserts the rewrite landed, and stages the root manifest in the release commit. No findings are recorded in any lane.

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	0
Tests	0	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	1	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

In `.github/workflows/release.yml`, the "Update crate version" step gains a `perl` substitution rewriting the root `[workspace.dependencies]` `tinyflows = { version = ..., path = "crates/tinyflows" }` requirement to `${NEXT_VERSION}` alongside the existing crate-manifest bump, plus a `grep -qx` assertion on the exact rewritten line. The subsequent commit step's `git add` now includes the root `Cargo.toml` so the manifest change is part of the release commit. No permissions or action pins are widened.

Features

• Added — Bump the root workspace `tinyflows` dependency version in the release step: A minor or major release no longer leaves the workspace requirement pinned to the previous version, which is what caused `cargo update --precise` to fail to select a version for sibling crates inheriting `tinyflows`. (.github/workflows/release.yml jobs:)
• Added — Assert the root-manifest rewrite with `grep -qx`: If the manifest is reformatted such that the substitution no longer matches, the step fails loudly instead of silently skipping the rewrite and proceeding to a failing `cargo update`. (.github/workflows/release.yml jobs:)
• Modified — Stage the root `Cargo.toml` in the release commit: Release commits now also touch the root manifest, so the version requirement change is persisted and tagged rather than left as an uncommitted working-tree change. (.github/workflows/release.yml jobs:)

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Critique lane answered with no findings: the regex matches the current root manifest line, the staged file matches the grep, and per-file failures under the runner's `set -e`-style behavior fail the job rather than silently proceeding.
• Lane summary: The change adds a perl rewrite of the root workspace dependency `tinyflows = { version = ..., path = "crates/tinyflows" }` alongside the existing crate-version bump, a grep assertion that it landed, and stages `Cargo.toml` in the release commit. The regex matches the current root manifest line and the staged file matches the grep, and the per-file failures under `set -e`-style runner behaviour fail the job rather than silently proceeding; I found no defect worth blocking on. _The code index is behind this pull request (indexed at `efad74adf763`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Security lane answered with no findings: the substitution pattern and `grep -qx` guard match the actual `[workspace.dependencies]` line format, no permissions or action pins are widened, and no untrusted context is interpolated into a shell.
• Lane summary: The change extends the release workflow's version-bump step to also rewrite the `tinyflows` workspace dependency version in the root `Cargo.toml` and to stage that file. The perl substitution pattern and the `grep -qx` guard match the actual `[workspace.dependencies]` line format, no permissions or action pins are widened, and no untrusted context is interpolated into a shell. I found no security defect introduced by this diff. _The code index is behind this pull request (indexed at `efad74adf763`), so retrieved context may be out of date._

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Commits lane answered with no sensitive content in committed files.
• Lane summary: No sensitive content in committed files. _The code index is behind this pull request (indexed at `efad74adf763`), so retrieved context may be out of date._

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Description lane answered with no findings: the regex, the assertion and the `git add` line agree with the actual manifest line, and the permissions/action pinning in the touched step are unchanged.
• Lane summary: The release workflow now rewrites the root workspace `tinyflows = { version = ... }` requirement alongside the crate manifest, asserts the rewrite with `grep -qx`, and stages the root manifest in the release commit; the regex, the assertion and the `git add` line agree with the actual manifest line 33, and the permissions/action pinning in the touched step are unchanged. Nothing in the diff breaks the described path, so it looks safe to merge. _The code index is behind this pull request (indexed at `efad74adf763`), so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.004887
• Tokens: 128028 input · 2750 output · 26624 cached · 58 embedding
• Updated: 2026-10-23T17:58:55Z

Head	State	Pass summary
846f198fd6ef	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-23T17:58:55Z)

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 66cab072-18f4-4b48-a836-fa7b0673e8ea

📥 Commits

Reviewing files that changed from the base of the PR and between 41fffb8 and 846f198.

📒 Files selected for processing: 1

• .github/workflows/release.yml

+---------------------------------+
| My bunny whiskers are tingling. |
+---------------------------------+
  \
   \     /)/)
        ( '')
        /  |
      o(___)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0049