ci(release): run the full CI on the tag before building a release

ci.yml is now callable with a ref to test. The release workflow calls it on the prepared tag and both build jobs wait for it, so a tag whose sources fail tests, lint or the build publishes nothing. A called run gets its own concurrency group and is never cancelled. The release steps now push main and wait for green CI before pushing the tag.

.github/workflows/ci.yml

@@ -4,13 +4,23 @@ on:
   push:
     branches: [main, feat/tauri-port]
   pull_request:
+  # The release workflow runs this on the tag before it builds anything.
+  workflow_call:
+    inputs:
+      ref:
+        description: 'Git ref to check out and test (defaults to the triggering commit)'
+        type: string
+        required: false
 
 permissions:
   contents: read
 
+# A called run takes the caller's workflow name and the ref it was given, so
+# it never shares a group with a push or PR run. It is never cancelled
+# either: a newer push must not abort the checks a release waits on.
 concurrency:
-  group: ci-${{ github.ref }}
-  cancel-in-progress: true
+  group: ci-${{ github.workflow }}-${{ inputs.ref || github.ref }}
+  cancel-in-progress: ${{ !inputs.ref }}
 
 jobs:
   build:
@@ -22,6 +32,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.ref || github.sha }}
 
       - uses: dtolnay/rust-toolchain@stable
         with:
@@ -88,6 +100,8 @@ jobs:
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.ref || github.sha }}
 
       - uses: dtolnay/rust-toolchain@stable
 

.github/workflows/release.yml

@@ -73,9 +73,19 @@ jobs:
             exit 1
           fi
 
+  # Nothing is built for release from a tag whose sources fail CI.
+  verify:
+    name: CI on the tag
+    needs: prepare
+    permissions:
+      contents: read
+    uses: ./.github/workflows/ci.yml
+    with:
+      ref: ${{ needs.prepare.outputs.tag }}
+
   win-x64:
     name: Windows x64
-    needs: prepare
+    needs: [prepare, verify]
     runs-on: windows-latest
     # The updater signing key decides what every installed client will
     # install, so only the steps that check or use it see it: never
@@ -135,7 +145,7 @@ jobs:
 
   linux-x64:
     name: Linux x64
-    needs: prepare
+    needs: [prepare, verify]
     runs-on: ubuntu-22.04
     # As on Windows, only the steps that check or use the signing key see it.
     steps:

docs/release-process.md

@@ -48,15 +48,19 @@ update again.
 1. Bump `Cargo.toml` `version` (`X.Y.Z`).
 2. Run `cargo build` locally to refresh `Cargo.lock`.
 3. Commit: `chore: bump version to X.Y.Z`.
-4. Tag and push:
+4. Push `main`, wait for its "CI" run to pass, then tag and push the
+   tag:
 
    ```powershell
-   git tag -a vX.Y.Z -m "vX.Y.Z"
    git push origin main
+   # wait for the CI run on main to go green
+   git tag -a vX.Y.Z -m "vX.Y.Z"
    git push origin vX.Y.Z
    ```
 
-5. Watch the "Release" workflow run. It creates a non-draft,
+5. Watch the "Release" workflow run. It first runs the full CI
+   (`ci.yml`) on the tag and builds nothing unless that passes. It then
+   creates a non-draft,
    non-prerelease GitHub Release marked latest, with auto-generated
    notes and the assets listed below, then fails if
    `/releases/latest` does not return the new tag.