Release Process
Relevant source files
The following files were used as context for generating this wiki page:
The release process for cargo-cooldown involves a structured lifecycle that encompasses versioning, artifact generation, provenance verification, and distribution through registry and binary installers. As a Cargo wrapper, the project ensures supply chain security by enforcing cooldown windows on dependencies during the development and CI phases.
Sources: README.md:1-12, Cargo.toml:1-12
Artifact Generation and Distribution
cargo-cooldown is distributed primarily as a Rust crate via crates.io and as prebuilt binary artifacts for various platforms. The project utilizes cargo-binstall to facilitate the installation of these prebuilt binaries, which are hosted as GitHub release artifacts.
Supported Installation Methods
| Method | Command | Description |
|---|---|---|
| Source Install | cargo install --locked cargo-cooldown | Compiles from source using the local Rust toolchain. |
| Binary Install | cargo binstall cargo-cooldown | Downloads prebuilt binaries based on the binstall metadata. |
Sources: README.md:16-25, Cargo.toml:14-20
Binary Provenance
Release artifacts include SHA256SUMS and GitHub Artifact Attestations to ensure integrity. Users can verify the provenance of a downloaded archive using the GitHub CLI:
gh attestation verify cargo-cooldown-x86_64-unknown-linux-gnu-vX.Y.Z.tgz \
-R dertin/cargo-cooldown
Sources: README.md:27-31
Versioning and Metadata
The project follows semantic versioning, managed within the Cargo.toml file. Metadata for binary installation is explicitly defined to map release URLs and binary directories for different targets.
[package]
name = "cargo-cooldown"
version = "0.3.0"
edition = "2024"
[package.metadata.binstall]
pkg-url = "{ repo }/releases/download/v{ version }/{ name }-{ target }-v{ version }{ archive-suffix }"
bin-dir = "{ name }-{ target }-v{ version }/{ bin }{ binary-ext }"
pkg-fmt = "tgz"
Sources: Cargo.toml:1-5, Cargo.toml:14-18
Internal Release Management
The release lifecycle involves updating the CHANGELOG.md to document new features, fixes, and breaking changes. Release 0.3.0 marked a significant transition to a multi-registry support architecture and a single cooldown.toml configuration format.
Release Workflow Flowchart
The following diagram illustrates the high-level steps involved in a typical project release:
Sources: CHANGELOG.md:11-40, README.md:27-31
Development and Testing Cycle
Before a release is finalized, the code undergoes extensive testing, including end-to-end integration tests using deterministic local sparse registries. The executor module validates lockfile pinning and ensures that Cargo-accepted graphs are maintained.
Validation Sequence
The sequence diagram below shows how the system validates a release candidate during the cooldown process, which is critical for ensuring the stability of released versions.
User-Facing Initialization
To support new releases, the cargo cooldown init command provides an interactive setup wizard that assists users in migrating to new configuration formats or initializing new projects.
- Logic: Detects project root (crate or workspace), builds a plan, and prompts for confirmation before writing
cooldown.toml. - Key Function:
src/init::run()manages the interactive loop and file generation.
Sources: src/init.rs:32-52, CHANGELOG.md:26-28
Conclusion
The cargo-cooldown release process is designed to provide secure, verifiable, and easy-to-install tooling for Rust developers. By combining GitHub Artifact Attestations with automated binary distribution and strict lockfile validation, the project maintains high standards for supply chain security and technical reliability.
Sources: README.md:126-130, src/executor.rs:341-360