Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Release Process

The bac-rules workspace uses a two-phase release system managed by contrib/release/release.py. Releases are split into prepare (changelog generation, version bump, tag) and publish (upload to crates.io) so that the changelog commit can be reviewed via a pull request before anything is published.

Prerequisites

  • Python 3.10+
  • cargo login with a valid crates.io token (for publishing)
  • GPG key configured (for signed tags; use --no-sign if unavailable)

Typical release flow

Phase 1 — prepare

# Preview changelog and version changes (no files written):
./contrib/release/release.py

# Preview a version bump:
./contrib/release/release.py 0.2.0

# Execute: commit changelogs, bump version, and tag:
./contrib/release/release.py --do-run 0.2.0

# Push and open a PR:
git push origin <branch> --tags

The script runs cargo check --workspace and scripts/local-ci.sh before committing. Pass --skip-ci if CI is already known green.

Phase 2 — publish

After the release PR is merged:

git checkout main && git pull

# Preview (dry-run publish check):
./contrib/release/release.py --publish-only

# Publish all crates to crates.io:
./contrib/release/release.py --do-run --publish-only

Crates are published in dependency order (acls-rs before hbac-rs and abac-rs) with a 30-second delay between calls for crates.io index propagation.

Crate publish order

The file contrib/release/publish-order defines the publication sequence. Each line is a workspace-relative crate path. The order must respect dependency constraints — each crate must appear after all workspace crates it depends on.

Changelogs

Each publishable crate has its own CHANGELOG.md following the Keep a Changelog format. The release script auto-generates entries from git commit history using keyword scoring. Commits below a relevance threshold (style fixes, CI tweaks) are excluded automatically.

Version strategy

All crates in the workspace share a single version defined in [workspace.package] in the root Cargo.toml. Member crates inherit it via version.workspace = true. The [workspace.dependencies] table carries version specs (e.g. version = "0.1") that are also updated on every version bump.

See contrib/release/README.md for the full option reference, commit scoring rules, and first-release checklist.