Fix release workflow: GitHub token permissions and deprecated actions

[rz1989s]

Problem

The release workflow is FAILING due to GitHub token permission issues and deprecated actions.

Latest run: https://github.com/getlumos/lumos/actions/runs/19602113902 (v0.1.1 tag)

Error: Resource not accessible by integration

Root Cause:

1. GITHUB_TOKEN lacks write permissions (Contents: read, needs: write)
2. Using deprecated actions/create-release@v1 (unmaintained since 2021)
3. Using deprecated actions/upload-release-asset@v1 (unmaintained)

---

Current Workflow Issues

Problems in .github/workflows/release.yml:

1. Missing Permissions Block - Workflow does not explicitly grant write permissions
2. Deprecated Actions - actions/create-release@v1 and actions/upload-release-asset@v1 are no longer maintained
3. Missing Secret Validation - CARGO_REGISTRY_TOKEN used but not validated

---

Proposed Solution

1. Add Permissions Block

Add after env block: permissions with contents write

2. Replace Deprecated Actions

Use softprops/action-gh-release@v1 or ncipollo/release-action@v1

3. Validate Secrets

Add validation step to check CARGO_REGISTRY_TOKEN exists before publishing

---

Benefits

• Release workflow works without permission errors
• Modern maintained actions
• Better error messages
• Automated multi-platform binaries
• Auto-publish to crates.io

---

Implementation Plan

Phase 1 Quick Fix:

• Add permissions: contents: write to release.yml
• Test with next version tag

Phase 2 Modernize Actions:

• Replace deprecated create-release and upload-release-asset actions
• Simplify workflow

Phase 3 Robustness:

• Add secret validation step
• Add dry-run mode for testing

---

Testing Checklist

After fixing test with patch release:

• GitHub release created successfully
• Binaries uploaded for all platforms
• lumos-core published to crates.io
• lumos-cli published to crates.io
• lumos-lsp published to crates.io
• Release notes generated

---

Required Secrets

Verify CARGO_REGISTRY_TOKEN exists at:
https://github.com/getlumos/lumos/settings/secrets/actions

Generate token at: https://crates.io/me/tokens
Scopes needed: publish-update permission

---

References

• GitHub Actions permissions docs
• softprops/action-gh-release
• cargo publish documentation
• Previous failed run: https://github.com/getlumos/lumos/actions/runs/19602113902

[rz1989s]

Additional Issue: lumos-lsp Missing from Release Workflow

The release workflow currently does NOT include lumos-lsp package automation.

Current State:

• ✅ lumos-core - automated (but broken)
• ✅ lumos-cli - automated (but broken)
• ❌ lumos-lsp - MISSING from workflow

Evidence:

# lumos-lsp has separate manual tags:
lumos-lsp-v0.1.0
lumos-lsp-v0.1.1

# Main workflow ignores lumos-lsp
grep -r 'lumos-lsp' .github/workflows/release.yml
# No matches found

Impact:

• lumos-lsp must be published manually to crates.io
• No automated binaries for lumos-lsp server
• Inconsistent release process across packages

---

Proposed Addition to Release Workflow

After fixing the permission issues, add lumos-lsp publishing:

- name: Publish lumos-lsp
  run: cargo publish --package lumos-lsp --token ${{ secrets.CARGO_REGISTRY_TOKEN }}

Tag Strategy Options:

Option A: Unified Tags (Recommended)

• Single tag: v0.1.2 releases ALL packages (core, cli, lsp)
• Simpler workflow, synchronized versions
• Matches most Rust monorepo practices

Option B: Separate Tags

• Keep current: v0.1.2 (core+cli), lumos-lsp-v0.1.2 (lsp)
• More complex but allows independent versioning
• Requires separate workflow or conditional logic

---

Updated Testing Checklist

When fixed, verify:

• lumos-core published to crates.io
• lumos-cli published to crates.io
• lumos-lsp published to crates.io ← Currently missing
• lumos-lsp binary included in release assets
• All binaries available: lumos (CLI) + lumos-lsp (LSP server)

cc: Should we use unified tags or keep separate versioning for lumos-lsp?

[rz1989s]

Fixed in commit ec190ae on dev branch.

Changes Made

1. Added permissions block - contents: write to fix GitHub token issues
2. Replaced deprecated actions - Using softprops/action-gh-release@v2 instead of unmaintained actions
3. Added secret validation - New validate-secrets job checks CARGO_REGISTRY_TOKEN before builds
4. Added lumos-lsp support - Both binary builds (all 5 platforms) and crates.io publishing
5. Unified versioning - Single tag releases all packages together
6. Professional release notes - Auto-generated with installation instructions

Testing

The workflow will be tested on next version tag (e.g., v0.1.2).

Checklist

• permissions: contents: write
• softprops/action-gh-release@v2
• Secret validation step
• lumos-lsp in build matrix (5 platforms)
• lumos-lsp in publish-crates
• Release notes generation