Verification builds fail fetching dev dependency that isn't published yet

[dignifiedquire]

I am publishing https://github.com/n0-computer/iroh using cargo-release@0.24 but unfortunately it determines an incorrect order and aborts half way through: iroh-resolver is attempted to be published before iroh-store, which fails due to their dependency.

[epage]

I'm not seeing why iroh-resolver being published before iroh-store is a problem. For me, the publish order looks correct.

I ran

$ cargo release publish --all -v
warning: disabled due to previous publish (0.1.3), skipping iroh-car
warning: disabled due to previous publish (0.1.3), skipping iroh-util
warning: disabled due to previous publish (0.1.3), skipping iroh-metrics
warning: disabled due to previous publish (0.1.3), skipping iroh-rpc-types
warning: disabled due to previous publish (0.1.3), skipping iroh-rpc-client
warning: disabled due to previous publish (0.1.3), skipping iroh-resolver
warning: disabled due to previous publish (0.1.3), skipping iroh-store
warning: disabled due to previous publish (0.1.3), skipping iroh-api
warning: disabled due to previous publish (0.1.3), skipping iroh-localops
warning: disabled due to previous publish (0.1.3), skipping iroh
warning: disabled due to previous publish (0.1.3), skipping iroh-bitswap
warning: disabled due to previous publish (0.1.3), skipping iroh-gateway
warning: disabled due to previous publish (0.1.3), skipping iroh-p2p
warning: disabled due to previous publish (0.1.3), skipping iroh-one
warning: disabled due to previous publish (0.1.3), skipping iroh-share

Those warnings should represent the publish order.

I then compared it with the output from cargo depgraph: and the ordering seems correct.

[dignifiedquire]

Thank you for the detailed response! Looks like this is my own fault https://github.com/n0-computer/iroh/blob/main/iroh-store/benches/store.rs#L7 uses iroh-store, but it is not listed in dev-dependencies Will try to add, which should fix the issue hopefully.

[dignifiedquire]

Actually my previous comment was wrong, it is a dev-dependency already: https://github.com/n0-computer/iroh/blob/main/iroh-resolver/Cargo.toml#L51 which I guess is the issue for this?

[epage]

Ah, yes. This case broke in #422.

From the comment in the change

                // Ignore dev dependencies. This breaks dev dependency cyles and allows for
                // correct publishing order when a workspace package depends on the root package.

                // It would be more correct to ignore only dev dependencies without a version
                // field specified. However, cargo_metadata exposes only the resolved version of
                // a package, and not what semver range (if any) is requested in Cargo.toml.

A workaround is to leave out the version field in you dev-dependency. The only downside is that people won't be able to run tests on your crate from crates.io, which really only affects crater. This is the default behavior if you ran cargo add iroh-store --dev.