CI/release: verify isolated publish on manifest changes, and publish workspace in one step

.github/workflows/release.yml

@@ -25,28 +25,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-        # The crates need to be published in order.
-      - name: Publish utils
-        run: cargo publish --token ${CRATES_TOKEN}
-        env:
-          CRATES_TOKEN: ${{ secrets.CRATES_IO_TOKEN }}
-        working-directory: utils
-      - name: wait for utils to finish publishing
-        # If we try to publish the next crate too quickly, it will fail to
-        # publish because it's not up on crates.io fully yet. We need to wait a
-        # bit until the previous crate is done publishing.
-        run: sleep 20s
-      - name: Publish impl
-        run: cargo publish --token ${CRATES_TOKEN}
-        env:
-          CRATES_TOKEN: ${{ secrets.CRATES_IO_TOKEN }}
-        working-directory: impl
-      - name: wait for impl to finish publishing
-        # If we try to publish the next crate too quickly, it will fail to
-        # publish because it's not up on crates.io fully yet. We need to wait a
-        # bit until the previous crate is done publishing.
-        run: sleep 20s
-      - name: Publish main crate
-        run: cargo publish --token ${CRATES_TOKEN}
+      - name: Publish all crates
+        # cargo publish --workspace packages and verifies every crate before
+        # uploading any of them, in dependency order, waiting for the index
+        # between crates. If any crate fails verification nothing is uploaded,
+        # so a broken crate can't leave a partial release behind (which is what
+        # happened in 11.4.0). Replaces the old publish-one-by-one + sleep hack.
+        run: cargo publish --workspace --token ${CRATES_TOKEN}
         env:
           CRATES_TOKEN: ${{ secrets.CRATES_IO_TOKEN }}

.github/workflows/test.yml

@@ -29,3 +29,29 @@ jobs:
           files: lcov.info
           fail_ci_if_error: true
           token: ${{ secrets.CODECOV_TOKEN }}
+  publish-dry-run:
+    name: publish dry-run
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Detect manifest changes
+        uses: dorny/paths-filter@v3
+        id: changes
+        with:
+          filters: |
+            manifests:
+              - '**/Cargo.toml'
+      - name: Install Rust
+        if: steps.changes.outputs.manifests == 'true'
+        run: rustup toolchain install stable
+      - uses: Swatinem/rust-cache@v2
+        if: steps.changes.outputs.manifests == 'true'
+      - name: Verify crates publish in isolation
+        # cargo publish compiles each packaged crate on its own, catching
+        # missing per-crate features that workspace feature unification hides
+        # during a normal build (e.g. syn's "printing" feature). --workspace
+        # resolves inter-crate deps from the locally packaged versions, so this
+        # passes before the bumped versions are on crates.io. Only runs when a
+        # Cargo.toml changed, since that's the only thing that affects it.
+        if: steps.changes.outputs.manifests == 'true'
+        run: cargo publish --workspace --dry-run --all-features