chore: fix publish workflow and bump crate versions

.github/workflows/publish.yml

@@ -3,6 +3,18 @@ on:
   push:
     branches:
       - main
+    paths:
+      - 'Cargo.toml'
+      - 'fastcrypto-derive/Cargo.toml'
+      - 'fastcrypto/Cargo.toml'
+      - 'fastcrypto-zkp/Cargo.toml'
+  workflow_dispatch:
+    inputs:
+      commit_sha:
+        description: Optional explicit commit SHA to tag and publish (defaults to latest main)
+        type: string
+        required: false
+        default: ""
 env:
   CARGO_TERM_COLOR: always
   # Disable incremental compilation.
@@ -32,54 +44,95 @@ jobs:
   publish:
     name: Publish to crates.io
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        package:
-          - fastcrypto-derive
-          - fastcrypto
-          - fastcrypto-zkp
     steps:
       - name: Checkout
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # Pin v4.1.1
-      - name: Install Rust toolchain
-        uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f # pin@v1.0.7
         with:
-          profile: minimal
-          toolchain: stable
-          override: true
-      - id: check
+          fetch-depth: 2
+          ref: ${{ inputs.commit_sha || github.ref_name }}
+
+      - name: Publish crates
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
         run: |
-          set +e
-          ./scripts/is_version_already_uploaded.sh ${{ matrix.package }}
-          export EXIT_CODE="$?"
-          set -e
-          if [[ "$EXIT_CODE" == "7" ]]; then
-            echo '::set-output name=is_new_version::no'
-          elif [[ "$EXIT_CODE" == "0" ]]; then
-            echo '::set-output name=is_new_version::yes'
-          else
-            # Unexpected outcome, indicates a bug.
-            exit "$EXIT_CODE"
+          set -euo pipefail
+
+          commit="${{ inputs.commit_sha }}"
+          if [[ -z "${commit}" ]]; then
+            commit="$(git rev-parse HEAD)"
           fi
-      # Disabled when API feels more stable 
-      # - name: Check semver
-      #   # Only run the semver script if the version changed, otherwise it errors out
-      #   if: steps.check.outputs.is_new_version == 'yes'
-      #   uses: obi1kenobi/cargo-semver-checks-action@v1
-      #   with:
-      #     crate-name: ${{ matrix.package }}
-      #     version-tag-prefix: ${{ matrix.package }}-v
-      - name: Tag the version
-        if: steps.check.outputs.is_new_version == 'yes'
-        run: |
-          set -euxo pipefail
-          export CURRENT_VERSION="$(./scripts/get_current_version.sh ${{ matrix.package }})"
-          git tag "${{ matrix.package }}-v$CURRENT_VERSION"
-          git push origin "${{ matrix.package }}-v$CURRENT_VERSION"
-      - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # pin@v1
-        if: steps.check.outputs.is_new_version == 'yes'
-      - name: Login
-        run: cargo login ${{ secrets.CARGO_REGISTRY_TOKEN }}
-      - name: Publish fastcrypto
-        if: steps.check.outputs.is_new_version == 'yes'
-        run: cargo publish -p ${{ matrix.package }} --token ${{ secrets.CARGO_REGISTRY_TOKEN }}
+
+          packages=(
+            fastcrypto-derive
+            fastcrypto
+            fastcrypto-zkp
+          )
+
+          ensure_tag() {
+            local tag="$1"
+
+            if git ls-remote --tags origin | grep -q "refs/tags/${tag}$"; then
+              echo "Tag ${tag} already exists; skipping tag creation"
+            else
+              echo "Creating tag ${tag} at ${commit}"
+              gh api repos/${{ github.repository }}/git/refs \
+                --method POST \
+                -f ref="refs/tags/${tag}" \
+                -f sha="${commit}"
+            fi
+          }
+
+          publish_package() {
+            local package="$1"
+            local attempts=6
+
+            for attempt in $(seq 1 "${attempts}"); do
+              if cargo publish -p "${package}" --token "${CARGO_REGISTRY_TOKEN}"; then
+                return 0
+              fi
+
+              if [[ "${attempt}" == "${attempts}" ]]; then
+                return 1
+              fi
+
+              echo "Publishing ${package} failed; retrying in 30 seconds"
+              sleep 30
+            done
+          }
+
+          ensure_release() {
+            local tag="$1"
+
+            if gh release view "${tag}" >/dev/null 2>&1; then
+              echo "Release ${tag} already exists; skipping release creation"
+            else
+              echo "Creating release ${tag}"
+              gh release create "${tag}" \
+                --title "${tag}" \
+                --generate-notes \
+                --target "${commit}"
+            fi
+          }
+
+          for package in "${packages[@]}"; do
+            version="$(./scripts/get_current_version.sh "${package}")"
+            tag="${package}-v${version}"
+            ensure_tag "${tag}"
+
+            set +e
+            ./scripts/is_version_already_uploaded.sh "${package}"
+            exit_code="$?"
+            set -e
+
+            if [[ "${exit_code}" == "7" ]]; then
+              echo "${package} is already published; skipping"
+            elif [[ "${exit_code}" != "0" ]]; then
+              exit "${exit_code}"
+            else
+              publish_package "${package}"
+            fi
+
+            ensure_release "${tag}"
+          done

fastcrypto-derive/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "fastcrypto-derive"
-version = "0.1.3"
+version = "0.1.4"
 edition = "2021"
 license = "Apache-2.0"
 authors = ["Mysten Labs <build@mystenlabs.com>"]

fastcrypto-zkp/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "fastcrypto-zkp"
-version = "0.1.3"
+version = "0.1.4"
 license = "Apache-2.0"
 authors = ["Mysten Labs <build@mystenlabs.com>"]
 edition = "2021"
@@ -30,7 +30,7 @@ ark-serialize = "0.4.1"
 ark-snark = "0.4.0"
 bcs.workspace = true
 byte-slice-cast = "1.2.2"
-fastcrypto = { path = "../fastcrypto", version = "0.1.5" }
+fastcrypto = { path = "../fastcrypto", version = "0.1.10" }
 derive_more = "0.99.16"
 num-bigint = { version = "0.4", default-features = false, features = ["rand"] }
 schemars = "0.8.10"

fastcrypto/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "fastcrypto"
-version = "0.1.9"
+version = "0.1.10"
 license = "Apache-2.0"
 authors = ["Mysten Labs <build@mystenlabs.com>"]
 edition = "2021"
@@ -50,7 +50,7 @@ ark-ec = "0.4.1"
 ark-ff = "0.4.1"
 ark-serialize = "0.4.1"
 lazy_static = "1.4.0"
-fastcrypto-derive = { path = "../fastcrypto-derive", version = "0.1.3" }
+fastcrypto-derive = { path = "../fastcrypto-derive", version = "0.1.4" }
 serde_json = "1.0.93"
 num-bigint = "0.4.4"
 bech32 = "0.9.1"

scripts/is_version_already_uploaded.sh

@@ -35,11 +35,14 @@ echo >&2 "Crate $CRATE_NAME current version: $CURRENT_VERSION"
 # The leading whitespace is important! With it, we know that every version is both
 # preceded by and followed by whitespace. We use this fact to avoid matching
 # on substrings of versions.
-EXISTING_VERSIONS="
-$( \
-    curl 2>/dev/null "https://crates.io/api/v1/crates/$CRATE_NAME" | \
-    jq --exit-status -r 'try .versions[].num' \
+CRATE_RESPONSE="$( \
+    curl --fail --silent --show-error --location \
+        --header "User-Agent: MystenLabs/fastcrypto publish workflow" \
+        "https://crates.io/api/v1/crates/$CRATE_NAME" \
 )"
+EXISTING_VERSIONS="
+$(jq -r '.versions // [] | .[].num' <<< "$CRATE_RESPONSE")
+"
 echo >&2 -e "Versions on crates.io:$EXISTING_VERSIONS\n"
 
 # Use version sort (sort -V) to get all versions in ascending order, then use grep to:
@@ -54,4 +57,4 @@ OUTPUT="$( \
 if [[ "$OUTPUT" == "$CURRENT_VERSION" ]]; then
     echo >&2 "The current version $CURRENT_VERSION is already on crates.io"
     exit 7
-fi
+fi