fix(release): opt the unreleased crates out of publishing in release-plz.toml

release-plz.toml

@@ -9,7 +9,9 @@
 # `cipherstash-client`, which stays there. Every other workspace member is
 # `publish = false` in its Cargo.toml and is also listed below with
 # `release = false`, so `release-plz update` does not bump its version or
-# write its changelog either.
+# write its changelog either. Each also repeats `publish = false`: the
+# workspace `publish = true` applies to every package that does not override
+# it, and release-plz refuses to run when that contradicts the Cargo.toml.
 #
 # Tags are release-plz's default, `stack-auth-v<semver>` and
 # `stack-profile-v<semver>`. No workflow triggers on either.
@@ -33,27 +35,34 @@ version_group = "stack-auth"
 [[package]]
 name = "stack-kms"
 release = false
+publish = false
 
 [[package]]
 name = "stack-encrypt"
 release = false
+publish = false
 
 [[package]]
 name = "stack-encrypt-derive"
 release = false
+publish = false
 
 [[package]]
 name = "stack-guest-abi"
 release = false
+publish = false
 
 [[package]]
 name = "stack-auth-node"
 release = false
+publish = false
 
 [[package]]
 name = "stack-profile-node"
 release = false
+publish = false
 
 [[package]]
 name = "stack-auth-wasm"
 release = false
+publish = false

scripts/__tests__/release-plz-root-config.test.mjs

@@ -15,6 +15,13 @@ import { readWorkflow } from './lib/workflows.mjs'
  * `release = false`. A member added to the workspace without a line here would
  * be versioned on the next release-plz run.
  *
+ * Each of those members also carries `publish = false`. The workspace table
+ * sets `publish = true`, and release-plz applies it to every package that
+ * does not set its own. `release-plz release` then exits before publishing
+ * anything: "Package `stack-kms` has `publish = false` or `publish = []` in
+ * the Cargo.toml, but it has `publish = true` in the release-plz
+ * configuration."
+ *
  * `cargo-publish-opt-out.test.mjs` pins which members may publish; this pins
  * that the release-plz configuration agrees with it.
  */
@@ -46,6 +53,7 @@ function configuredPackages(source) {
     packages.set(name, {
       versionGroup: /^version_group\s*=\s*"([^"]+)"/m.exec(body)?.[1] ?? null,
       release: !/^release\s*=\s*false$/m.test(body),
+      publish: !/^publish\s*=\s*false$/m.test(body),
     })
   }
   return packages
@@ -90,6 +98,17 @@ describe('root release-plz.toml', () => {
     expect([...groups][0]).toBeTruthy()
   })
 
+  it('opts every unpublished member out of publishing here too', () => {
+    const unpublished = members.filter((member) => !member.publish)
+    expect(unpublished.length).toBeGreaterThan(0)
+    for (const { name } of unpublished) {
+      expect(packages.get(name)?.publish, name).toBe(false)
+    }
+    for (const name of PUBLISHED) {
+      expect(packages.get(name)?.publish, name).toBe(true)
+    }
+  })
+
   it('points the changelog at a file that exists', () => {
     const changelog = /^changelog_config\s*=\s*"([^"]+)"/m.exec(source)?.[1]
     expect(changelog).toBeTruthy()