feat: synchronize Cargo locks during versioning

.github/workflows/changeset-release-pr.yml

@@ -18,6 +18,23 @@ on:
         required: false
         type: string
         default: "chore: version packages"
+      sync-cargo-inherited-lock:
+        description: >-
+          Validate and synchronize Cargo.lock entries for workspace packages
+          that inherit workspace.package.version.
+        required: false
+        type: boolean
+        default: false
+      cargo-manifest:
+        description: Repo-relative root Cargo workspace manifest.
+        required: false
+        type: string
+        default: Cargo.toml
+      cargo-lockfile:
+        description: Repo-relative Cargo lockfile.
+        required: false
+        type: string
+        default: Cargo.lock
     secrets:
       CHANGELOG_APP_ID:
         description: GitHub App ID used to maintain the version PR.
@@ -45,6 +62,49 @@ jobs:
 
       - run: bun install --frozen-lockfile
 
+      - if: inputs.sync-cargo-inherited-lock
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
+
+      # rust-toolchain only prepends the toolchain when it installs one. Keep
+      # Cargo available when the runner already has the requested toolchain.
+      - if: inputs.sync-cargo-inherited-lock
+        name: Add Cargo to PATH
+        run: echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+
+      - if: inputs.sync-cargo-inherited-lock
+        name: Validate inherited Cargo lock versions
+        id: cargo-sync
+        uses: stella/.github/.github/actions/sync-cargo-workspace-lock@095a0d8b2b05d5892c76c48866ad9eab54bd8dee
+        with:
+          mode: check
+          manifest: ${{ inputs.cargo-manifest }}
+          lockfile: ${{ inputs.cargo-lockfile }}
+
+      - name: Prepare version command
+        id: version-command
+        shell: bash
+        run: |
+          set -euo pipefail
+          version_command="$RUNNER_TEMP/stella-changeset-version.sh"
+          cat > "$version_command" <<'EOF'
+          #!/usr/bin/env bash
+          set -euo pipefail
+
+          bun run changeset:version
+          if [[ "$SYNC_CARGO_INHERITED_LOCK" == "true" ]]; then
+            if [[ -z "$CARGO_SYNC_SCRIPT" ]]; then
+              echo "::error::Cargo synchronizer path is unavailable"
+              exit 1
+            fi
+            node "$CARGO_SYNC_SCRIPT" \
+              --mode write \
+              --manifest "$CARGO_MANIFEST_PATH" \
+              --lockfile "$CARGO_LOCKFILE_PATH"
+          fi
+          EOF
+          chmod 0700 "$version_command"
+          printf 'path=%s\n' "$version_command" >> "$GITHUB_OUTPUT"
+
       # Install hooks run before a write-capable credential exists in the job.
       - name: Mint version PR token
         id: app-token
@@ -60,8 +120,12 @@ jobs:
       - name: Create or update version packages PR
         uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
         with:
-          version: bun run changeset:version
+          version: bash ${{ steps.version-command.outputs.path }}
           title: ${{ inputs.title }}
           commit: ${{ inputs.commit }}
         env:
+          CARGO_LOCKFILE_PATH: ${{ inputs.cargo-lockfile }}
+          CARGO_MANIFEST_PATH: ${{ inputs.cargo-manifest }}
+          CARGO_SYNC_SCRIPT: ${{ steps.cargo-sync.outputs.script }}
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
+          SYNC_CARGO_INHERITED_LOCK: ${{ inputs.sync-cargo-inherited-lock }}

README.md

@@ -207,15 +207,19 @@ jobs:
 jobs:
   version:
     uses: stella/.github/.github/workflows/changeset-release-pr.yml@<commit-sha>
+    with:
+      sync-cargo-inherited-lock: true
     secrets: inherit
 ```
 
 The caller must provide `changeset`, `changeset:version`, and a `.changeset/config.json`.
 For hybrid repositories, `changeset:version` must synchronize the selected package
-version into every npm, Cargo, Python, and central `VERSION` surface before the
-generated PR is committed. The version command must preserve the committed Bun
-lockfile: deleting `bun.lock`/`bun.lockb` or running an unfrozen `bun install` is
-rejected by the shared policy.
+version into every npm, Cargo manifest, Python, and central `VERSION` surface. With
+`sync-cargo-inherited-lock` enabled, the shared workflow validates the incoming
+lockfile and updates inherited local Cargo package entries inside the same Changesets
+transaction, before the generated PR is committed. The version command must preserve
+the committed Bun lockfile: deleting `bun.lock`/`bun.lockb` or running an unfrozen
+`bun install` is rejected by the shared policy.
 
 Repositories whose Cargo packages use `version.workspace = true` can validate or
 repair the corresponding local `Cargo.lock` entries without maintaining a package