fix(s2n-quic): pin jobserver in more places and run cargo package in …

…CI (#2009)

* fix(s2n-quic): pin jobserver in more places

* add end of file newlines back

* add detect-new-release and run cargo package only for already released, published crates

* fix workflow

* add exceptions for udeps

* strip pwd

* back to one line

* add newlines and simplify published crates command

* rename package step

* combine into one step

* update comment

.github/workflows/ci.yml

@@ -37,6 +37,7 @@ jobs:
       msrv: ${{ steps.definitions.outputs.msrv }}
       examples: ${{ steps.definitions.outputs.examples }}
       crates: ${{ steps.definitions.outputs.crates }}
+      new-release: ${{ steps.definitions.outputs.new-release }}
     steps:
       - uses: actions/checkout@v4
       # examples is populated by
@@ -63,9 +64,12 @@ jobs:
           export EXAMPLES=$(find examples/ -maxdepth 1 -mindepth 1 -type d | jq -R | jq -sc)
           echo "examples=$EXAMPLES"
           echo "examples=$EXAMPLES" >> $GITHUB_OUTPUT
-          export CRATES=$(find quic common -name *Cargo.toml | jq -R | jq -s | jq '. += ["tools/xdp/s2n-quic-xdp/Cargo.toml"]' | jq -c)
+          export CRATES=$(cargo metadata --no-deps --format-version 1 | jq --arg PWD "$PWD/" '.packages[] | select(.publish == null).manifest_path | sub($PWD; "")' | jq -s | jq '. += ["tools/xdp/s2n-quic-xdp/Cargo.toml"]' | jq -c)
           echo "crates=$CRATES"
           echo "crates=$CRATES" >> $GITHUB_OUTPUT
+          export NEW_RELEASE=$(if $(./scripts/detect-new-release); then echo "true"; else echo "false"; fi)
+          echo "new-release=$NEW_RELEASE"
+          echo "new-release=$NEW_RELEASE" >> $GITHUB_OUTPUT
 
   rustfmt:
     runs-on: ubuntu-latest
@@ -390,10 +394,12 @@ jobs:
           status: "success"
           url: "${{ steps.s3.outputs.URL }}"
 
-  # This CI step will directly build each crate in common/ and quic/ which is
+  # This CI step will directly build each published crate in common/ and quic/ which is
   # useful because it sidesteps the feature resolution that normally occurs in a
   # workspace build. We make sure that the crates build with default features,
-  # otherwise release to crates.io will be blocked
+  # otherwise release to crates.io will be blocked. If the current PR is not for a new
+  # release, the cargo package command is used instead of cargo build, as this more closely
+  # matches the verification command that cargo publish executes.
   crates:
     needs: env
     runs-on: ubuntu-latest
@@ -414,11 +420,19 @@ jobs:
           override: true
 
       - name: build
+        if: ${{ needs.env.outputs.new-release == 'true' }}
         uses: actions-rs/cargo@v1.0.3
         with:
           command: build
           args: --manifest-path ${{ matrix.crate }}
 
+      - name: package
+        if: ${{ needs.env.outputs.new-release == 'false' }}
+        uses: actions-rs/cargo@v1.0.3
+        with:
+          command: package
+          args: --manifest-path ${{ matrix.crate }}
+
   examples:
     needs: env
     runs-on: ubuntu-latest

quic/s2n-quic-tls-default/Cargo.toml

@@ -15,3 +15,14 @@ s2n-quic-tls = { version = "=0.30.0", path = "../s2n-quic-tls" }
 
 [target.'cfg(not(unix))'.dependencies]
 s2n-quic-rustls = { version = "=0.30.0", path = "../s2n-quic-rustls" }
+
+[target.'cfg(unix)'.dev-dependencies]
+# newer versions require rust 1.66, see https://github.com/aws/s2n-quic/issues/1991
+# this version pin is only needed to prevent verification failures when using
+# cargo package / cargo publish, as those commands do not respect the version pin
+# in downstream dev-dependencies (in s2n-quic-tls, in this case)
+jobserver = "=0.1.26"
+
+# jobserver is just here to pin
+[package.metadata.cargo-udeps.ignore]
+development = [ "jobserver" ]

quic/s2n-quic/Cargo.toml

@@ -78,9 +78,18 @@ zeroize = { version = "1", optional = true, default-features = false }
 [dev-dependencies]
 backtrace = { version = "=0.3.68" } # pin backtrace to avoid bumping MSRV
 bolero = { version = "0.10" }
+# newer versions of jobserver require rust 1.66, see https://github.com/aws/s2n-quic/issues/1991
+# this version pin is only needed to prevent verification failures when using
+# cargo package / cargo publish, as those commands do not respect the version pin
+# in downstream dev-dependencies (in s2n-quic-tls, in this case)
+jobserver = "=0.1.26"
 regex = "=1.9.6" # newer versions require rust 1.65, see https://github.com/aws/s2n-quic/issues/1993
 s2n-quic-core = { path = "../s2n-quic-core", features = ["testing", "event-tracing"] }
 s2n-quic-platform = { path = "../s2n-quic-platform", features = ["testing"] }
 tokio = { version = "1", features = ["full"] }
 tracing = { version = "0.1" }
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+
+# jobserver is just here to pin
+[package.metadata.cargo-udeps.ignore]
+development = [ "jobserver" ]

scripts/detect-new-release

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+#
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+
+set -e
+
+LOCAL_VERSION=$(cargo metadata --no-deps --format-version 1 | jq --raw-output -c '.packages[] | select(.name == "s2n-quic").version')
+CRATES_IO_VERSION=$(cargo search "s2n-quic" --limit 1 | head -n 1 | cut -d'"' -f2)
+
+# Exits with 0 if the local version has not been published to crates.io yet, otherwise exits with 1
+[[ "$LOCAL_VERSION" != "$CRATES_IO_VERSION" ]]