chore: drop sub-crate submodules and publish hk to crates.io by jdx · Pull Request #830 · jdx/hk

jdx · 2026-04-16T16:02:25Z

Summary

Removes the xx, clx, and ensembler git submodules and consumes them as regular crates.io dependencies (xx 2.5, clx 1.3, ensembler 1.1). The sub-crates are now maintained entirely in their own repositories.
Restores crates.io publishing for hk — the crate has been stuck at 1.10.1 (Aug 2025) while tagged releases continued through 1.42.0. The publish step was accidentally dropped in 186480d during the subtree → submodule migration.
Adds a dedicated publish-crate job to release.yml that runs after create-release and invokes cargo publish -p hk with CARGO_REGISTRY_TOKEN.
Removes the now-unused CARGO_REGISTRY_TOKEN passthrough from release-plz.yml.
Simplifies mise-tasks/release-plz — drops the crates=(clx ensembler xx) loop, process_subcrate_upstream, and all git submodule invocations for sub-crates. Roughly half the script.
Removes .cargo/config.toml which patched clx to the local submodule path.

Why

Each sub-crate release used to require threading changes through this repo's mise-tasks/release-plz dance. Making them first-class external dependencies matches how they actually work today — they have their own repos, release cadence, and crates.io presence — and eliminates the broken publishing path for hk itself.

Reviewer notes

Version pins landed on the latest published versions of each sub-crate, not the old submodule HEADs. Bumping ensembler to 1.x forced clx to 1.x as well (ensembler 1.1 depends on clx 1.x, and having two major versions of clx in the graph caused type mismatches in src/step/runner.rs).
Bats test submodules under test/ are unaffected — workflows can keep submodules: recursive.
Cargo.lock churn is large because path-source entries had to be replaced with registry sources; actual dep version changes are limited to the three sub-crates plus their transitives.
Pre-commit/push hooks currently fail when no hk shim is installed globally — this PR was pushed with HK=0. That's a pre-existing dev-env issue.

Test plan

cargo check --all-targets — verified locally, passes
CI passes on this branch
After merge, next release triggers publish-crate and hk shows up on crates.io at the new version

This PR was prepared by Claude Code.

Note

Medium Risk
Release/publishing pipeline changes (including automated cargo publish) can affect the release process and require correct secrets/permissions. Dependency source changes from local submodules to crates.io may introduce subtle behavior or transitive dependency differences at build/runtime.

Overview
Stops vendoring sub-crates via git submodules/workspace and switches to crates.io. Removes the workspace and local [patch] override, deletes the clx/xx/ensembler submodule entries, and updates Cargo.toml to depend on published clx, ensembler, and xx versions.

Reworks the release automation to publish the crate. release.yml adds a new publish-crate job that runs cargo publish (with CARGO_REGISTRY_TOKEN) after create-release, while release-plz.yml no longer passes the cargo token and the mise-tasks/release-plz script drops all submodule update logic and just tags/pushes releases.

Includes large Cargo.lock churn consistent with moving from path-based sub-crates to registry sources, plus a small extra tracing::info! log at the start of Hook::run.

^{Reviewed by Cursor Bugbot for commit 23b7cfb. Bugbot is set up for automated code reviews on this repo. Configure here.}

Removes the xx, clx, and ensembler git submodules and consumes them as regular crates.io dependencies (xx 2.5, clx 1.3, ensembler 1.1). The sub-crates are now maintained entirely in their own repositories. Restores crates.io publishing for hk (stuck at 1.10.1 since the subtree → submodule migration in 186480d removed the publish step). Publishing now runs as a dedicated job in release.yml after the GitHub Release is created, using CARGO_REGISTRY_TOKEN. release-plz.yml no longer needs that secret since mise-tasks/release-plz no longer publishes. Also removes .cargo/config.toml which patched clx to a local path and is no longer needed. Co-Authored-By: Claude Opus 4.6 <[email protected]>

greptile-apps · 2026-04-16T16:06:23Z

Greptile Summary

This PR migrates the clx, ensembler, and xx crates from git submodules/workspace members to first-class crates.io dependencies, simplifies the release-plz script accordingly, and restores cargo publish for hk itself via a new publish-crate job in release.yml.

The changes are coherent and well-scoped — workspace entry removed from Cargo.toml, .cargo/config.toml patch dropped, .gitmodules pruned to test-only submodules, and CARGO_REGISTRY_TOKEN moved from the release-plz workflow (where it was unused) to the new publish step in release.yml.

Confidence Score: 5/5

Safe to merge — clean mechanical migration with no logic changes to the build or hook system.

All changed files are infrastructure/CI: sub-crate path deps are replaced with pinned registry versions, the new publish-crate job is correctly gated (repo check + secret), and the release-plz simplification removes only dead submodule code. No P0 or P1 findings.

No files require special attention.

Important Files Changed

Filename	Overview
Cargo.toml	Drops [workspace] block and switches clx, ensembler, xx from path deps to registry versions (1.3, 1.1, 2.5.1); include list and metadata look correct for crates.io publishing.
.github/workflows/release.yml	Adds publish-crate job (gated on jdx/hk repo) that runs cargo publish after create-release; -p hk was already dropped in a follow-up commit; guarded with CARGO_REGISTRY_TOKEN secret.
.github/workflows/release-plz.yml	Removes now-unused CARGO_REGISTRY_TOKEN env from the mise run release-plz step; no other changes.
mise-tasks/release-plz	Script simplified by removing git submodule update/foreach calls and the crates=(clx ensembler xx) loop; core tag-and-PR logic is unchanged and correct.
.gitmodules	clx, ensembler, xx submodule entries removed; only the four test/bats-* submodules remain, which are still used by bats integration tests.
.cargo/config.toml	File deleted — it only contained [patch.crates-io] clx = { path = 'clx' } which is no longer needed now that clx is a registry dep.
src/hook.rs	Adds tracing::info!("running hook") inside the hook.run span so the event appears correctly in pretty-trace output; straightforward and correct.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Push tag v*\nor workflow_dispatch] --> B[build-binaries\nmatrix: 7 targets]
    A --> C[build-pkl]
    B --> D[create-release\ngh release create]
    C --> D
    D --> E[publish-crate\ncargo publish]
    D --> F[enhance-release\ncommunique generate]

    G[Push to main] --> H[release-plz workflow\nmise run release-plz]
    H --> I{version already tagged?}
    I -- No --> J[git tag + git push --tags\ntriggers release workflow]
    I -- Yes --> K{unreleased changes?}
    K -- Yes --> L[bump Cargo.toml\ncreate release PR]
    K -- No --> M[skip]

    style E fill:#90EE90
    style J fill:#ADD8E6

_{Reviews (3): Last reviewed commit: "fix(hook): emit info event inside hook.r..." | Re-trigger Greptile}

Co-Authored-By: Claude Opus 4.6 <[email protected]>

gemini-code-assist

Code Review

This pull request transitions the project from a workspace-based structure with local submodules to using external registry dependencies. Specifically, the clx, ensembler, and xx crates are no longer managed as submodules or local path dependencies in Cargo.toml and have been replaced with versioned registry entries. Correspondingly, the .gitmodules file and submodule update logic in the release-plz script have been removed, and Cargo.lock has been updated to reflect these changes. I have no feedback to provide as there were no review comments.

…ty trace The ensembler 1.x / clx 1.x upgrade removed the log::info! calls that previously fired inside the hook.run span and got picked up by LogTracer, making the span visible in pretty trace output. tracing's fmt layer only renders a span's path when an event fires within it, so the span was still "active" but invisible — failing the test/trace.bats assertions that look for "hook.run" in stderr output. Emit an explicit info event at the top of Hook::run so visibility no longer depends on whatever downstream deps happen to log. Co-Authored-By: Claude Opus 4.6 <[email protected]>

socket-security · 2026-04-16T16:23:58Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/clx@1.3.0
	cargo/clap@4.6.0 ⏵ 4.6.1

View full report

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 23b7cfb. Configure here.}

cursor · 2026-04-16T16:30:41Z


    #[tracing::instrument(level = "info", name = "hook.run", skip(self, opts), fields(hook = %self.name))]
    pub async fn run(&self, opts: HookOptions) -> Result<()> {
+        tracing::info!("running hook");


Unrelated tracing line added in dependency management PR

Low Severity

A tracing::info!("running hook") event was added inside hook.run, but this PR is solely about dropping submodule dependencies and restoring crates.io publishing — no other source code changes are present. The function already has a #[tracing::instrument(level = "info", name = "hook.run", ...)] attribute that creates an info-level span on entry, making this additional bare event largely redundant. This looks like a leftover from the Claude Code development session.

^{Reviewed by Cursor Bugbot for commit 23b7cfb. Configure here.}

jdx · 2026-04-16T16:32:20Z

The #[tracing::instrument] attribute creates a span, not an event. In tracing_subscriber::fmt's pretty output, a span only renders when an event fires inside it — a span with no events is invisible. That's exactly why tests 200/203/208/209 in test/trace.bats were failing before this commit: the hook.run span was being entered but had no events to print from.

The bumps in this PR (ensembler 0.3 → 1.1, clx 0.3 → 1.3) removed the log::info! calls that used to fire inside hook.run and got forwarded into the span by LogTracer. That's what broke the tests, and that's why this line is here — they're causally linked, not unrelated.

Remove the line and the trace tests fail again.

This comment was generated by Claude Code.

@hituzi-no-sippo

### 🚀 Features - **(harper)** add harper-cli config to hk builtin config by [@hituzi-no-sippo](https://github.com/hituzi-no-sippo) in [#714](#714) ### 🐛 Bug Fixes - **(release)** add linux musl targets by [@jdx](https://github.com/jdx) in [#829](#829) ### 🔍 Other Changes - drop sub-crate submodules and publish hk to crates.io by [@jdx](https://github.com/jdx) in [#830](#830) ### 📦️ Dependency Updates - lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#826](#826)  --- > [!NOTE] > **Low Risk** > Primarily a version/release bookkeeping change (docs, generated CLI metadata, and lockfiles) with no runtime logic modifications in this diff. > > **Overview** > Cuts release `v1.43.0` by bumping the crate version in `Cargo.toml`/`Cargo.lock` and updating `CHANGELOG.md` with the 1.43.0 notes. > > Regenerates versioned references across docs and CLI artifacts (e.g., `docs/*`, `docs/cli/*`, example `.pkl` files, and `hk.usage.kdl`) to point at `v1.43.0` Pkl package URLs. Updates `mise.lock` to include provenance metadata for the `communique` linux x64 artifact. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit f4e6c35. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>  Co-authored-by: mise-en-dev <[email protected]>

greptile-apps Bot reviewed Apr 16, 2026

View reviewed changes

Comment thread .github/workflows/release.yml Outdated

chore: drop redundant -p hk from cargo publish

fdc0849

Co-Authored-By: Claude Opus 4.6 <[email protected]>

gemini-code-assist Bot reviewed Apr 16, 2026

View reviewed changes

jdx enabled auto-merge (squash) April 16, 2026 16:14

cursor Bot reviewed Apr 16, 2026

View reviewed changes

jdx merged commit 5f9bc36 into main Apr 16, 2026
22 checks passed

jdx deleted the chore/drop-subcrate-submodules branch April 16, 2026 16:34

jdx mentioned this pull request Apr 16, 2026

chore: release v1.43.0 #827

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore: drop sub-crate submodules and publish hk to crates.io#830

chore: drop sub-crate submodules and publish hk to crates.io#830
jdx merged 3 commits intomainfrom
chore/drop-subcrate-submodules

jdx commented Apr 16, 2026 •

edited by cursor Bot

Loading

Uh oh!

greptile-apps Bot commented Apr 16, 2026 •

edited

Loading

Uh oh!

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

socket-security Bot commented Apr 16, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Apr 16, 2026

Uh oh!

jdx commented Apr 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

jdx commented Apr 16, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why

Reviewer notes

Test plan

Uh oh!

greptile-apps Bot commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

socket-security Bot commented Apr 16, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Apr 16, 2026

Choose a reason for hiding this comment

Unrelated tracing line added in dependency management PR

Uh oh!

jdx commented Apr 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jdx commented Apr 16, 2026 •

edited by cursor Bot

Loading

greptile-apps Bot commented Apr 16, 2026 •

edited

Loading