[rubas-agent]

Before

AGENTS.md ends the release with a manual step:

5. Run `mix hex.publish` from a clean tree. `mix.exs` puts `checksum-*.exs` in the Hex tarball.

No agent has a Hex credential, so every release waits for a person who runs mix hex.publish from the right tree.

Problem

A release stops at that manual step, and nothing checks that the published tree carries the checksums of the release's tarballs.

After

The merge of the checksum PR publishes, like rubas/cloaked_req#89. The workflow keeps no Hex key: Hex trades the job's GitHub OIDC token for a short token that can only publish whisper_cpp.

flowchart LR
  A[PR bumps @version] -->|merge| B[release.yml: build 6 NIFs, tag, GitHub release]
  B --> C[checksum PR]
  C -->|merge| D[release.yml: publish job, environment hex]
  D --> E[Hex holds the release]
  E -->|owner approves with 2FA| F[hex.pm and HexDocs]

Loading

The publish job:

1. runs only for a push to main that changes checksum-Elixir.WhisperCpp.Native.exs for a version that already has its tag,
2. compares that file with the release's SHA256SUMS, and stops when they differ, because a Hex version is immutable,
3. runs mix hex.publish --yes in the GitHub environment hex, which only main can use. Staged publishing holds the release until an owner approves it on hex.pm.

Setup, design, and checks

Setup outside the repo:

• GitHub: the environment hex exists on rubas/whisper_cpp, with a deployment branch policy of main only.
• hex.pm: the package has a workload identity for owner rubas, repository whisper_cpp, workflow release.yml, environment hex.

Design:

• release.yml:detect sets should_publish from git diff --name-only "$BEFORE" "$GITHUB_SHA". A workflow_dispatch never publishes.
• No --wait, as in release: publish to Hex when the checksum PR merges cloaked_req#89: with staged publishing it blocks until the approval, up to 7 days, and a hosted job stops after 6 hours. AGENTS.md says to read the end of the log, because a failed docs upload leaves the job green.
• config/config.exs forced a source build whenever CI=true. The publish job runs on a runner with CI=true, so its docs compile would have built whisper.cpp from source and needed Rust and cmake. We drop the config, and ci.yml and integration.yml set WHISPER_CPP_BUILD=1 instead, which WhisperCpp.Native already reads. The publish job now downloads the precompiled x86_64 NIF and checks it against the checksum file, a second check of the file. Users never saw the config: Mix does not load the config of a dependency.

Checks:

• zizmor 1.32.0 --persona=pedantic passes.
• The comparison step against v0.5.0 and the checksum file on main prints no difference, and it fails for a changed file.
• mix hex.publish --dry-run --yes on this branch, without CI, downloads the precompiled NIF, builds the docs, and builds the package.