From 739cee30d972b99cd0ad99b54709435edf1c69b1 Mon Sep 17 00:00:00 2001
From: Lindsay Holmwood <lindsay@holmwood.id.au>
Date: Sat, 3 Oct 2026 07:21:41 +1000
Subject: [PATCH] fix(release): opt the unreleased crates out of publishing in
 release-plz.toml

The first release-crates run after #1009 failed before publishing anything:

    Package `stack-kms` has `publish = false` or `publish = []` in the
    Cargo.toml, but it has `publish = true` in the release-plz configuration.

The workspace table sets `publish = true`, and release-plz applies it to
every package that does not set its own, including the seven members whose
Cargo.toml says `publish = false`. Each of those now repeats
`publish = false` beside its `release = false`.

`release-plz release --dry-run` on this commit reports stack-auth and
stack-profile 0.42.3 as already published, and does nothing else. A new
test in release-plz-root-config.test.mjs fails on the old file.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PaY5xYydZUWhv8Nex9Sw8a
---
 release-plz.toml                              | 11 ++++++++++-
 .../release-plz-root-config.test.mjs          | 19 +++++++++++++++++++
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/release-plz.toml b/release-plz.toml
index 37f233226..81d56c07b 100644
--- a/release-plz.toml
+++ b/release-plz.toml
@@ -9,7 +9,9 @@
 # `cipherstash-client`, which stays there. Every other workspace member is
 # `publish = false` in its Cargo.toml and is also listed below with
 # `release = false`, so `release-plz update` does not bump its version or
-# write its changelog either.
+# write its changelog either. Each also repeats `publish = false`: the
+# workspace `publish = true` applies to every package that does not override
+# it, and release-plz refuses to run when that contradicts the Cargo.toml.
 #
 # Tags are release-plz's default, `stack-auth-v<semver>` and
 # `stack-profile-v<semver>`. No workflow triggers on either.
@@ -33,27 +35,34 @@ version_group = "stack-auth"
 [[package]]
 name = "stack-kms"
 release = false
+publish = false
 
 [[package]]
 name = "stack-encrypt"
 release = false
+publish = false
 
 [[package]]
 name = "stack-encrypt-derive"
 release = false
+publish = false
 
 [[package]]
 name = "stack-guest-abi"
 release = false
+publish = false
 
 [[package]]
 name = "stack-auth-node"
 release = false
+publish = false
 
 [[package]]
 name = "stack-profile-node"
 release = false
+publish = false
 
 [[package]]
 name = "stack-auth-wasm"
 release = false
+publish = false
diff --git a/scripts/__tests__/release-plz-root-config.test.mjs b/scripts/__tests__/release-plz-root-config.test.mjs
index 949c48889..c01852bcb 100644
--- a/scripts/__tests__/release-plz-root-config.test.mjs
+++ b/scripts/__tests__/release-plz-root-config.test.mjs
@@ -15,6 +15,13 @@ import { readWorkflow } from './lib/workflows.mjs'
  * `release = false`. A member added to the workspace without a line here would
  * be versioned on the next release-plz run.
  *
+ * Each of those members also carries `publish = false`. The workspace table
+ * sets `publish = true`, and release-plz applies it to every package that
+ * does not set its own. `release-plz release` then exits before publishing
+ * anything: "Package `stack-kms` has `publish = false` or `publish = []` in
+ * the Cargo.toml, but it has `publish = true` in the release-plz
+ * configuration."
+ *
  * `cargo-publish-opt-out.test.mjs` pins which members may publish; this pins
  * that the release-plz configuration agrees with it.
  */
@@ -46,6 +53,7 @@ function configuredPackages(source) {
     packages.set(name, {
       versionGroup: /^version_group\s*=\s*"([^"]+)"/m.exec(body)?.[1] ?? null,
       release: !/^release\s*=\s*false$/m.test(body),
+      publish: !/^publish\s*=\s*false$/m.test(body),
     })
   }
   return packages
@@ -90,6 +98,17 @@ describe('root release-plz.toml', () => {
     expect([...groups][0]).toBeTruthy()
   })
 
+  it('opts every unpublished member out of publishing here too', () => {
+    const unpublished = members.filter((member) => !member.publish)
+    expect(unpublished.length).toBeGreaterThan(0)
+    for (const { name } of unpublished) {
+      expect(packages.get(name)?.publish, name).toBe(false)
+    }
+    for (const name of PUBLISHED) {
+      expect(packages.get(name)?.publish, name).toBe(true)
+    }
+  })
+
   it('points the changelog at a file that exists', () => {
     const changelog = /^changelog_config\s*=\s*"([^"]+)"/m.exec(source)?.[1]
     expect(changelog).toBeTruthy()