chore: release ic(x)-asset 0.28.1 and overhaul CI workflows by lwshang · Pull Request #4508 · dfinity/sdk

lwshang · 2026-03-25T18:32:35Z

Summary

Bump ic-asset and icx-asset to 0.28.1
Add trusted publishing workflow (publish.yml) for publishing crates to crates.io via OIDC, replacing the manual local publish process
Rename the old publish.yml (dfx binary release) to release.yml
Standardize CI runner images, unify Rust toolchain installation/caching, and simplify the release build matrix across workflows
Drop macOS Intel runners from CI workflows
Share Rust cache across workflows on the same runner
Skip flaky canister_http_config_on_local_network test on macOS
Guard cargo-audit uninstall with existence check in CI provisioning
Disable slow config-change-detection e2e tests (multiple dfx start/stop cycles per test)
Install ic-wasm via installer script instead of cargo-binstall
Document why Rust cache is disabled in the fmt workflow
Remove prepare-dfx-assets stub workflow
Rename publishable:required to build-dfx:required in the release workflow

Branch protection rule changes

Remove prepare-dfx-assets:required
Add build-dfx:required (replaces the previously unenforced publishable:required check)

Test plan

Verify CI workflows pass on this PR
Admin updates branch protection rules before/after merge
After merge, trigger the publish.yml workflow with ic-asset and icx-asset selected to publish 0.28.1
Confirm crates appear on crates.io

🤖 Generated with Claude Code

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Replace manual actions/cache@v4 blocks with actions-rust-lang/setup-rust-toolchain@v1 in unit.yml, lint.yml, fmt.yml, and e2e.yml. The old cache keys were all different across workflows so caches were never actually shared between them. Also stub out prepare-dfx-assets.yml: its original intent was to pre-warm Cargo caches for other workflows, but mismatched keys meant the caches were never reused. It also excluded the dfx-assets directory (the expensive downloaded binaries) from the cache, defeating its own purpose. The workflow is kept as a no-op stub because "prepare-dfx-assets:required" is a branch protection rule. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Use explicit, up-to-date runner images across all workflows: - macOS: macos-15 (arm64) and macos-15-intel (x86_64) - Linux: ubuntu-24.04 and ubuntu-24.04-arm - Windows: windows-2025 Also drop the redundant ubuntu-22.04 / ubuntu-22.04-arm matrix entries in e2e.yml — they compiled the same Rust targets as their ubuntu-24.04 counterparts, so were just duplicating CI time. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Remove the redundant top-level target list — each target was already fully specified in the include entries, so the list was pure duplication. Using include-only matrix is sufficient and cleaner. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Use OIDC-based authentication via rust-lang/crates-io-auth-action to publish dfx-core, ic-asset, icx-asset, and ic-certified-assets from CI instead of locally. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Sort both actual and expected library lists through the same `sort` so locale differences across runner images cannot cause a mismatch. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Only release.yml retains macos-15-intel for building the precompiled binary. All other workflows (e2e, unit, lint) no longer run on Intel macOS since the repo will be deprecated soon. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Set cache-shared-key: rust so that lint, unit, e2e, release, and publish workflows share compiled dependency artifacts. Disable caching for fmt since it doesn't compile anything. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

The test fails on macOS CI runners because creating nested directories under dot-prefixed temp paths results in "Invalid argument" errors. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Each of these tests runs multiple dfx start/stop cycles (~1 min each), making them very expensive in CI. The config-change detection logic is stable and this project is approaching deprecation. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Replaces the two-step cargo-binstall + ic-wasm install with a direct curl of the ic-wasm installer script, which is faster and avoids needing cargo-binstall as an intermediate dependency. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/fmt.yml

.github/workflows/prepare-dfx-assets.yml

fmt doesn't produce target/ artifacts, so its cache would evict the real one shared by other workflows on the same runner. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

This was a no-op stub kept only because "prepare-dfx-assets:required" was a branch protection rule. The admin will remove the required check. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Better reflects that this check gates dfx building on all platforms, not the release itself. The old branch protection rule will be updated by the admin. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Remove windows-2025 from e2e and lint matrices (unused) - Split Rust cache by build profile: debug for lint/unit, release for e2e/release - Disable cache for publish (cargo publish rebuilds from scratch) - Remove cargo clean from release build (incremental compilation already disabled) - Remove redundant --target flag and binary_path matrix variables (build for host) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Resolve Node.js 20 deprecation warnings by bumping: - actions/checkout v4 → v6 - actions/upload-artifact v4 → v7 - actions/download-artifact v4 → v8 - actions/cache v4 → v5 - actions/setup-python v5 → v6 - actions/github-script v6 → v8 - actions/create-github-app-token v2 → v3 - JamesIves/github-pages-deploy-action releases/v3 → v4 - dorny/paths-filter v3 → v4 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lwshang and others added 14 commits March 25, 2026 13:44

chore: rename publish workflow to release

c83d437

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

chore: add trusted publishing workflow for crates.io

2c64009

Use OIDC-based authentication via rust-lang/crates-io-auth-action to publish dfx-core, ic-asset, icx-asset, and ic-certified-assets from CI instead of locally. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

chore: bump ic-asset and icx-asset to 0.28.1

562de9e

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix: make macOS dynamic library check sort-order independent

b388923

Sort both actual and expected library lists through the same `sort` so locale differences across runner images cannot cause a mismatch. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

chore: show only OS in build_dfx matrix job names

1cde4ad

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix: skip canister_http_config_on_local_network test on macOS

09f6f34

The test fails on macOS CI runners because creating nested directories under dot-prefixed temp paths results in "Invalid argument" errors. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix: guard cargo-audit uninstall with existence check in CI provisioning

11819a9

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lwshang marked this pull request as ready for review March 25, 2026 20:39

lwshang requested a review from a team as a code owner March 25, 2026 20:39

viviveevee approved these changes Mar 26, 2026

View reviewed changes

.github/workflows/fmt.yml Outdated Show resolved Hide resolved

.github/workflows/prepare-dfx-assets.yml Outdated Show resolved Hide resolved

lwshang and others added 5 commits March 26, 2026 08:57

chore: document why Rust cache is disabled in fmt workflow

692697c

fmt doesn't produce target/ artifacts, so its cache would evict the real one shared by other workflows on the same runner. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

chore: remove prepare-dfx-assets stub workflow

3f5a4f9

This was a no-op stub kept only because "prepare-dfx-assets:required" was a branch protection rule. The admin will remove the required check. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

chore: rename publishable:required to build-dfx:required

d634770

Better reflects that this check gates dfx building on all platforms, not the release itself. The old branch protection rule will be updated by the admin. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lwshang merged commit aa09658 into master Mar 26, 2026
195 of 197 checks passed

lwshang deleted the lwshang/trusted-publishing branch March 26, 2026 15:14

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: release ic(x)-asset 0.28.1 and overhaul CI workflows#4508

chore: release ic(x)-asset 0.28.1 and overhaul CI workflows#4508
lwshang merged 19 commits intomasterfrom
lwshang/trusted-publishing

lwshang commented Mar 25, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

lwshang commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Branch protection rule changes

Test plan

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

lwshang commented Mar 25, 2026 •

edited

Loading