Bump to 0.19.1-sudo.5 and teach the release helper the sudo serial

The helper still only accepted `-djbclark.N`, which is why 0.19.1-sudo.4 was
cut by hand and picked up the defects 5d30740 repaired. It now derives the
serial from a DOWNSTREAM_SUFFIX constant, and its formula-restamp regex
recognizes both spellings so a formula carried across the rename is not left
naming a stale version.

Preflight gains the guard that would have caught 0.19.1-sudo.4: `cargo
metadata --locked` must succeed, so a lockfile that disagrees with the
manifest fails before a tag exists rather than after it is published.

Release helper tests 19 -> 21.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: djbclark

CHANGELOG.md

@@ -131,7 +131,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `Cargo.lock` now matches the workspace version. The `0.19.1-sudo.4` bump
   updated `Cargo.toml` but not the lockfile, and because the formula builds
   with `cargo install --locked`, an install from that tag aborted before
-  compiling anything.
+  compiling anything. `v0.19.1-sudo.4` is superseded and should not be
+  installed; use `v0.19.1-sudo.5` or later. The release helper now refuses to
+  cut a version whose lockfile disagrees with the manifest, and it understands
+  the `-sudo.N` serial that `0.19.1-sudo.4` renamed to.
 
 - Corrected the documented tamper-evidence of the audit ledger, in
   `AI-GUIDANCE.md` and in the library's own notes. Both said truncating the

Cargo.lock

@@ -11,7 +11,7 @@ members = [
 resolver = "2"
 
 [workspace.package]
-version = "0.19.1-sudo.4"
+version = "0.19.1-sudo.5"
 edition = "2024"
 
 [workspace.dependencies]

Cargo.toml

@@ -46,9 +46,18 @@
 FORMULA = ROOT / FORMULA_REL
 DEFAULT_TAP = Path.home() / "src" / "homebrew-sudo-secretspec"
 FORMULA_NAME = "djbclark/sudo-secretspec/sudo-secretspec"
-VERSION_RE = re.compile(rf"^{re.escape(UPSTREAM_VERSION)}-djbclark\.([1-9][0-9]*)$")
+# The downstream serial's prefix. Releases through 0.19.1-djbclark.3 used
+# "djbclark"; everything from 0.19.1-sudo.4 on uses "sudo".
+DOWNSTREAM_SUFFIX = "sudo"
+VERSION_RE = re.compile(
+    rf"^{re.escape(UPSTREAM_VERSION)}-{DOWNSTREAM_SUFFIX}\.([1-9][0-9]*)$"
+)
 # Any downstream version, anywhere in a file. Used to restamp the formula.
-ANY_VERSION_RE = re.compile(rf"{re.escape(UPSTREAM_VERSION)}-djbclark\.[0-9]+")
+# Both spellings, because a formula carried over from before the rename still
+# names the old one and has to be restamped rather than silently left behind.
+ANY_VERSION_RE = re.compile(
+    rf"{re.escape(UPSTREAM_VERSION)}-(?:{DOWNSTREAM_SUFFIX}|djbclark)\.[0-9]+"
+)
 # Places the formula names its own version: the source `url`, the explicit
 # `version` stanza, and both `brew test` assertions. Pinned as a count so that
 # adding a fifth site fails this script loudly instead of shipping a formula
@@ -74,7 +83,7 @@ class Release:
 
     @property
     def version(self) -> str:
-        return f"{UPSTREAM_VERSION}-djbclark.{self.serial}"
+        return f"{UPSTREAM_VERSION}-{DOWNSTREAM_SUFFIX}.{self.serial}"
 
     @property
     def tag(self) -> str:
@@ -122,8 +131,8 @@ def parse_release(version: str) -> Release:
     match = VERSION_RE.fullmatch(version)
     if not match:
         raise ReleaseError(
-            f"downstream version must be {UPSTREAM_VERSION}-djbclark.N with N >= 1, "
-            f"got {version!r}"
+            f"downstream version must be {UPSTREAM_VERSION}-{DOWNSTREAM_SUFFIX}.N "
+            f"with N >= 1, got {version!r}"
         )
     return Release(serial=int(match.group(1)))
 
@@ -188,6 +197,21 @@ def preflight(release: Release, *, allow_dirty: bool) -> None:
         in (ROOT / "Cargo.toml").read_text(encoding="utf-8"),
         f"workspace is not stamped {release.version}; bump Cargo.toml first",
     )
+    # Cargo.lock records every workspace member's version, so bumping Cargo.toml
+    # without regenerating the lock leaves the two disagreeing. The formula
+    # builds with `cargo install --locked`, which refuses that tree outright, so
+    # the tag installs nowhere. This is exactly how v0.19.1-sudo.4 shipped
+    # broken; catch it here, before a tag exists to be un-published.
+    _require(
+        run(
+            ["cargo", "metadata", "--locked", "--format-version", "1"],
+            check=False,
+        ).returncode
+        == 0,
+        f"Cargo.lock is out of date for {release.version}; run `cargo check` to "
+        "regenerate it and commit the result, or the published tag will fail "
+        "`cargo install --locked`",
+    )
     # Catch a re-used serial here rather than after the test suite has run and
     # a local tag already exists. The remote is the authority: a serial can be
     # published from another checkout.
@@ -477,7 +501,7 @@ def parse_args(argv: list[str] | None = None) -> argparse.Namespace:
     parser.add_argument(
         "--version",
         required=True,
-        help=f"downstream version to cut, e.g. {UPSTREAM_VERSION}-djbclark.2",
+        help=f"downstream version to cut, e.g. {UPSTREAM_VERSION}-{DOWNSTREAM_SUFFIX}.5",
     )
     parser.add_argument("--dry-run", action="store_true")
     parser.add_argument("--allow-dirty", action="store_true")

packaging/release.py

@@ -47,7 +47,7 @@ def workspace_release(release):
     tests that are not about the version.
     """
     text = (ROOT / "Cargo.toml").read_text(encoding="utf-8")
-    match = re.search(r'version = "(\d+\.\d+\.\d+-djbclark\.\d+)"', text)
+    match = re.search(r'version = "(\d+\.\d+\.\d+-sudo\.\d+)"', text)
     assert match, "workspace Cargo.toml is not stamped with a downstream version"
     return release.parse_release(match.group(1))
 
@@ -75,27 +75,31 @@ def workspace_release(release):
 
 
 def test_release_identity_is_derived_from_the_serial(release, cut):
-    cut = release.parse_release("0.19.1-djbclark.2")
-    assert cut.serial == 2
-    assert cut.version == "0.19.1-djbclark.2"
-    assert cut.tag == "v0.19.1-djbclark.2"
-    assert cut.title == "SecretSpec 0.19.1 — sudo-secretspec downstream 2"
+    cut = release.parse_release("0.19.1-sudo.5")
+    assert cut.serial == 5
+    assert cut.version == "0.19.1-sudo.5"
+    assert cut.tag == "v0.19.1-sudo.5"
+    assert cut.title == "SecretSpec 0.19.1 — sudo-secretspec downstream 5"
     assert cut.archive_url == (
         "https://github.com/djbclark/sudo-secretspec/archive/refs/tags/"
-        "v0.19.1-djbclark.2.tar.gz"
+        "v0.19.1-sudo.5.tar.gz"
     )
 
 
 def test_only_downstream_versions_on_the_pinned_upstream_base_are_accepted(release):
     # The upstream base stays a constant: rebasing onto a new upstream tag is a
     # separate decision, not something a --version argument may do implicitly.
     for bad in (
-        "0.20.0-djbclark.1",
+        "0.20.0-sudo.1",
         "0.19.1",
-        "v0.19.1-djbclark.1",
-        "0.19.1-djbclark.0",
-        "0.19.1-djbclark.01",
+        "v0.19.1-sudo.1",
+        "0.19.1-sudo.0",
+        "0.19.1-sudo.01",
         "0.19.1-other.1",
+        # The pre-rename spelling is no longer a version this script may cut.
+        # It still has to be *recognized* when restamping a formula, which is
+        # ANY_VERSION_RE's job, not parse_release's.
+        "0.19.1-djbclark.4",
         "",
     ):
         with pytest.raises(release.ReleaseError):
@@ -104,7 +108,7 @@ def test_only_downstream_versions_on_the_pinned_upstream_base_are_accepted(relea
 
 def test_https_release_url_guard(release):
     release.validate_release_url(
-        "https://github.com/djbclark/sudo-secretspec/archive/refs/tags/v0.19.1-djbclark.1.tar.gz"
+        "https://github.com/djbclark/sudo-secretspec/archive/refs/tags/v0.19.1-sudo.1.tar.gz"
     )
     for url in ("http://github.com/x", "file:///tmp/x", "https://example.com/x"):
         with pytest.raises(release.ReleaseError):
@@ -127,13 +131,15 @@ def test_formula_rewrite_restamps_every_version_site(tmp_path: Path, release, cu
         "  end\n",
         encoding="utf-8",
     )
-    cut = release.parse_release("0.19.1-djbclark.2")
+    cut = release.parse_release("0.19.1-sudo.5")
 
     release.rewrite_formula(formula, cut, "a" * 64)
 
     text = formula.read_text(encoding="utf-8")
+    # The fixture is deliberately on the pre-rename spelling: a formula carried
+    # across the djbclark -> sudo rename must be restamped, not left behind.
     assert "0.19.1-djbclark.1" not in text, text
-    assert text.count("0.19.1-djbclark.2") == release.FORMULA_VERSION_SITES
+    assert text.count("0.19.1-sudo.5") == release.FORMULA_VERSION_SITES
     assert f'url "{cut.archive_url}"' in text
     assert f'sha256 "{"a" * 64}"' in text
 
@@ -150,7 +156,7 @@ def test_formula_rewrite_refuses_an_unexpected_number_of_version_sites(
     )
     with pytest.raises(release.ReleaseError, match="version references"):
         release.rewrite_formula(
-            formula, release.parse_release("0.19.1-djbclark.2"), "a" * 64
+            formula, release.parse_release("0.19.1-sudo.5"), "a" * 64
         )
 
 
@@ -226,7 +232,7 @@ def test_preflight_refuses_a_serial_that_is_already_published(monkeypatch, relea
 
     def fake_run(argv, **kwargs):
         if argv[:2] == ["git", "ls-remote"]:
-            return completed(argv, "9f4c…\trefs/tags/v0.19.1-djbclark.9\n")
+            return completed(argv, "9f4c…\trefs/tags/v0.19.1-sudo.9\n")
         if argv[:4] == ["gh", "repo", "view", "djbclark/sudo-secretspec"]:
             return completed(
                 argv,
@@ -263,7 +269,50 @@ def fake_run(argv, **kwargs):
     monkeypatch.setattr(release, "run", fake_run)
     # A serial nobody will ever cut, so it cannot match the real Cargo.toml.
     with pytest.raises(release.ReleaseError, match="bump Cargo.toml"):
-        release.preflight(release.parse_release("0.19.1-djbclark.999"), allow_dirty=False)
+        release.preflight(release.parse_release("0.19.1-sudo.999"), allow_dirty=False)
+
+
+def test_preflight_refuses_a_lockfile_that_disagrees_with_the_manifest(
+    monkeypatch, release
+):
+    """The guard that v0.19.1-sudo.4 shipped without.
+
+    That release bumped Cargo.toml and left Cargo.lock naming the previous
+    version. The formula builds with `cargo install --locked`, so the published
+    tag aborted before compiling anything. `cargo metadata --locked` is the
+    cheapest way to ask, and asking in preflight means the failure lands before
+    a tag exists rather than after it is public.
+    """
+
+    def fake_run(argv, **kwargs):
+        if argv[:2] == ["cargo", "metadata"]:
+            assert "--locked" in argv
+            assert kwargs.get("check") is False, "must not raise past the guard"
+            return completed(argv, returncode=101)
+        if argv[:4] == ["gh", "repo", "view", "djbclark/sudo-secretspec"]:
+            return completed(
+                argv,
+                json.dumps(
+                    {
+                        "nameWithOwner": "djbclark/sudo-secretspec",
+                        "parent": {"nameWithOwner": "cachix/secretspec"},
+                        "defaultBranchRef": {"name": "sudo-main"},
+                    }
+                ),
+            )
+        return completed(argv, PREFLIGHT_GIT_OUTPUTS.get(tuple(argv), ""))
+
+    monkeypatch.setattr(release, "run", fake_run)
+    with pytest.raises(release.ReleaseError, match="Cargo.lock is out of date"):
+        release.preflight(workspace_release(release), allow_dirty=False)
+
+
+def test_any_version_re_matches_both_downstream_spellings(release):
+    """Restamping must recognize the pre-rename spelling as well as the current
+    one, or a formula carried across the rename keeps its stale version."""
+    assert release.ANY_VERSION_RE.findall(
+        'url ".../v0.19.1-djbclark.3.tar.gz"\nversion "0.19.1-sudo.4"\n'
+    ) == ["0.19.1-djbclark.3", "0.19.1-sudo.4"]
 
 
 def test_parent_slug_accepts_every_gh_parent_shape(release):