LeeroyHannigan · Nov 10, 2026
@@ -105,13 +105,36 @@ jobs:
         if: failure()
         run: cat moto.log || true
 
+  # crates.io accepts only what `cargo package` can write. Each dependency
+  # needs a version, and the dev-dependency cycle between extenddb-engine and
+  # extenddb-storage-sqlite must stay out of the published manifests.
+  # --no-verify writes the packages without compiling them, in seconds, and
+  # runs no build script. devtools/check-crate-packages then checks the pins,
+  # the LICENSE and NOTICE files, the metadata and crates.io's size limits.
+  # Compiling each package from its tarball takes minutes. That build belongs
+  # to the crates.io release workflow (follow-up work), before the upload, and
+  # not to each PR.
+  package:
+    runs-on: extenddb_ubuntu-2404_4-core
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
+        with:
+          toolchain: stable
+      - run: cargo package --workspace --no-verify --locked
+      - run: devtools/check-crate-packages
+
   test:
     runs-on: extenddb_ubuntu-2404_4-core
     timeout-minutes: 15
-    needs: run-tests
+    needs: [run-tests, package]
     if: always()
     steps:
       - run: |
-          if [ "${{ needs.run-tests.result }}" != "success" ]; then
+          if [ "${{ needs.run-tests.result }}" != "success" ] \
+              || [ "${{ needs.package.result }}" != "success" ]; then
             exit 1
           fi
@@ -82,6 +82,22 @@ cargo clippy -- -W clippy::pedantic -W clippy::unwrap_used -W clippy::expect_use
 - Address all clippy warnings or add `#[allow(...)]` with a justification comment.
 - Avoid `.unwrap()` and `.expect()` in library crates — use `?` or explicit error handling.
 
+### Dependencies between workspace crates
+
+A crate depends on another workspace crate with `{ workspace = true }`. The
+root `[workspace.dependencies]` pins each workspace crate to the workspace
+version exactly (`=X.Y.Z`), because the crates publish to crates.io together
+([ADR-0029](docs/adr/0029-crates-io-packaging.md)). Declare a dev-dependency
+on a workspace crate by path with no version, for example
+`extenddb-storage = { path = "../storage", features = ["test-util"] }`, so
+that cargo drops it from the published manifest. The `package` job of the
+Test workflow checks both rules. To run the same check locally, on a tree
+with uncommitted changes too (the script needs Python 3.11 or later):
+
+```bash
+cargo package --workspace --no-verify --locked --allow-dirty && devtools/check-crate-packages
+```
+
 ## When you need an ADR or an RFC
 
 ExtendDB uses two lightweight processes to keep core decisions reviewable:

@@ -1,7 +1,12 @@
 # Copyright 2026 ExtendDB contributors
 # SPDX-License-Identifier: Apache-2.0
 [workspace]
-resolver = "2"
+# Resolver 3 prefers dependency versions whose rust-version fits ours. The
+# published crates use it too. (With resolver 2, cargo writes
+# `resolver = "2"` into each of them.) Without `--locked`, `cargo install`
+# then resolves for Rust 1.88 and does not fail on a dependency that needs a
+# newer Rust.
+resolver = "3"
 members = [
     "crates/core",
     "crates/cache",
@@ -24,22 +29,32 @@ version = "0.1.14"
 edition = "2024"
 rust-version = "1.88"
 license = "Apache-2.0"
+repository = "https://github.com/ExtendDB/extenddb"
+homepage = "https://extenddb.org/"
 
 [workspace.dependencies]
-# Internal crates
-extenddb-core = { path = "crates/core" }
-extenddb-cache = { path = "crates/cache" }
-extenddb-backup-store = { path = "crates/backup-store" }
-extenddb-engine = { path = "crates/engine" }
-extenddb-storage = { path = "crates/storage" }
-extenddb-config = { path = "crates/config" }
-extenddb-storage-cassandra = { path = "crates/storage-cassandra" }
-extenddb-storage-mongodb = { path = "crates/storage-mongodb" }
-extenddb-storage-postgres = { path = "crates/storage-postgres" }
-extenddb-storage-sqlite = { path = "crates/storage-sqlite" }
-extenddb-auth = { path = "crates/auth" }
-extenddb-server = { path = "crates/server" }
-extenddb-app = { path = "crates/app" }
+# Internal crates. crates.io needs a version on each of them. Each version is
+# an exact pin to the workspace version, because the crates change their APIs
+# between patch releases. A crate of one release must never resolve against a
+# crate of another. A release bump changes each pin together with `version`
+# above. A pin left at the old version makes every cargo command that
+# resolves dependencies fail, and `devtools/check-crate-packages` fails on a
+# pin that is not exact.
+# Internal dev-dependencies are declared by path in each crate instead, with
+# no version, so that cargo drops them from the published manifests.
+extenddb-core = { path = "crates/core", version = "=0.1.14" }
+extenddb-cache = { path = "crates/cache", version = "=0.1.14" }
+extenddb-backup-store = { path = "crates/backup-store", version = "=0.1.14" }
+extenddb-engine = { path = "crates/engine", version = "=0.1.14" }
+extenddb-storage = { path = "crates/storage", version = "=0.1.14" }
+extenddb-config = { path = "crates/config", version = "=0.1.14" }
+extenddb-storage-cassandra = { path = "crates/storage-cassandra", version = "=0.1.14" }
+extenddb-storage-mongodb = { path = "crates/storage-mongodb", version = "=0.1.14" }
+extenddb-storage-postgres = { path = "crates/storage-postgres", version = "=0.1.14" }
+extenddb-storage-sqlite = { path = "crates/storage-sqlite", version = "=0.1.14" }
+extenddb-auth = { path = "crates/auth", version = "=0.1.14" }
+extenddb-server = { path = "crates/server", version = "=0.1.14" }
+extenddb-app = { path = "crates/app", version = "=0.1.14" }
 
 # Serialization
 serde = { version = "1", features = ["derive"] }
@@ -70,7 +85,13 @@ urlencoding = { version = "2.1" }
 moka = { version = "0.12", features = ["future"] }
 
 # Database
-cdrs-tokio = { version = "9.0", features = ["derive"] }
+# cdrs-tokio stays on 9.0.x and cassandra-protocol on 4.0.x. cassandra-protocol
+# 4.1.0 moved its public BigInt to num-bigint 0.5, while bigdecimal 0.4 uses
+# num-bigint 0.4. extenddb-storage-cassandra then fails to compile. The pins
+# keep a fresh resolution, such as `cargo install` without `--locked`, on
+# versions that build.
+cdrs-tokio = { version = "~9.0.2", features = ["derive"] }
+cassandra-protocol = "~4.0.1"
 sqlx = { version = "0.8", default-features = false, features = ["runtime-tokio", "tls-rustls-aws-lc-rs", "postgres", "json", "time", "uuid", "bigdecimal", "derive"] }
 # SQLite's C API, for the online backup API that sqlx does not expose. The
 # version is the one sqlx-sqlite depends on: the crate declares