From 7982d16225e2a0bd9552e4f09bb13027565e95c7 Mon Sep 17 00:00:00 2001
From: Matthew Jackson <1085847+MattJackson@users.noreply.github.com>
Date: Tue, 23 Jun 2026 08:20:51 -0700
Subject: [PATCH] =?UTF-8?q?ci:=20fast-release=20=E2=80=94=20verify=20Cargo?=
 =?UTF-8?q?.lock=20libfreemkv=20resolves=20to=20the=20release=20git=20tag?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/release.yml | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6f7f298..bd2cc8b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,26 +22,34 @@ jobs:
           fi
           echo "Version match: $CARGO_VER"
 
+  # Tests run as a PARALLEL TRIPWIRE: they fail the run if they fail, but the
+  # release job does NOT `needs:` this job. The tag decision was already gated by
+  # the local precommit (same Rust 1.86, same commit).
+  #
+  # freemkv-keysources is a library — Cargo.lock isn't tracked, so --locked
+  # would always fail (no lockfile to lock against on a fresh runner). Its
+  # libfreemkv dep resolves from crates.io (the dev .cargo/config.toml patch is
+  # gitignored and absent on the runner), so libfreemkv must already be published
+  # at this version — the release script enforces that ordering before tagging.
   test:
     needs: verify
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@1.86.0
-      # freemkv-keysources is a library — Cargo.lock isn't tracked, so --locked
-      # would always fail (no lockfile to lock against on a fresh runner). Its
-      # libfreemkv dep resolves from crates.io (the dev .cargo/config.toml patch
-      # is gitignored and absent on the runner), so libfreemkv must already be
-      # published at this version — the release script enforces that ordering.
       - run: cargo test
 
   # NOTE: the crates.io publish is driven by the maintainer's release tooling
   # from local credentials, not from CI — this repo has no CARGO_REGISTRY_TOKEN
-  # secret. CI here only verifies the version/tag match, runs tests, and cuts
-  # the GitHub Release.
+  # secret. release.sh runs `cargo publish --no-verify` locally. CI here only
+  # verifies the version/tag match, runs tests (tripwire), and cuts the GitHub
+  # Release. The binaries git-tag-pin keysources, so they don't wait on the
+  # crates.io publish — it serves external consumers in parallel.
 
   release:
-    needs: test
+    # Only needs `verify`; the GitHub Release is cut as soon as the version
+    # check passes, in parallel with the test tripwire.
+    needs: verify
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5