Remove package step from binary build workflow for releases (#1950)

Author: leighmcculloch

.github/workflows/binaries.yml

@@ -54,21 +54,9 @@ jobs:
         echo "VERSION=${version}" >> $GITHUB_ENV
         echo "NAME=${{ matrix.crate.name }}-${version}-${{ matrix.sys.target }}" >> $GITHUB_ENV
 
-    - name: Package (release only)
-      if: github.event_name == 'release'
-      run: cargo package --no-verify --package ${{ matrix.crate.name }}
-
-    - name: Package Extract (release only)
-      if: github.event_name == 'release'
-      run: |
-        cd target/package
-        tar xvfz ${{ matrix.crate.name }}-$VERSION.crate
-        echo "BUILD_WORKING_DIR=target/package/${{ matrix.crate.name }}-$VERSION" >> $GITHUB_ENV
-
     - name: Build
-      working-directory: ${{ env.BUILD_WORKING_DIR }}
       run: |
-        cargo build --target-dir="$GITHUB_WORKSPACE/target" --package ${{ matrix.crate.name }} --features opt --release --target ${{ matrix.sys.target }}
+        cargo build --package ${{ matrix.crate.name }} --features opt --release --target ${{ matrix.sys.target }}
 
     - name: Build provenance for attestation (release only)
       if: github.event_name == 'release'

.github/workflows/rust.yml

@@ -17,7 +17,7 @@ jobs:
 
   complete:
     if: always()
-    needs: [fmt, cargo-deny, check-generated-full-help-docs, build-and-test, publish-dry-run]
+    needs: [fmt, cargo-deny, check-generated-full-help-docs, build-and-test, disallow-git-deps, publish-dry-run]
     runs-on: ubuntu-latest
     steps:
     - if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
@@ -98,6 +98,23 @@ jobs:
         CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
         CARGO_BUILD_TARGET: ${{ matrix.sys.target }}
 
+  disallow-git-deps:
+    # This job fails if a release is being prepared and there are still crate
+    # dependencies in the Cargo.toml files that reference dependencies via git.
+    # Git dependencies should not be set when releasing because the binary
+    # builds that happen based on the local source, and the published crate,
+    # may not build to be the same. This is because when the crate is published
+    # the git dependencies are stripped out automatically, but when building
+    # locally they'd still be present. The presence of git dependencies at
+    # release time in any case is probably a bug.
+    if: github.event_name == 'push' || startsWith(github.head_ref, 'release/')
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: Check that Cargo.tomls do not contain git dependencies for release
+      run: |
+        ! git --no-pager grep 'git\s*=' -- Cargo.toml **/Cargo.toml
+
   publish-dry-run:
     if: github.event_name == 'push' || startsWith(github.head_ref, 'release/')
     strategy: