Verification builds fail fetching dev dependency that isn't published yet

[dignifiedquire]

I am publishing https://github.com/n0-computer/iroh using cargo-release@0.24 but unfortunately it determines an incorrect order and aborts half way through: iroh-resolver is attempted to be published before iroh-store, which fails due to their dependency.

[dignifiedquire]

Actually my previous comment was wrong, it is a dev-dependency already: https://github.com/n0-computer/iroh/blob/main/iroh-resolver/Cargo.toml#L51 which I guess is the issue for this?

[epage]

Ah, yes. This case broke in #422.

From the comment in the change

                // Ignore dev dependencies. This breaks dev dependency cyles and allows for
                // correct publishing order when a workspace package depends on the root package.

                // It would be more correct to ignore only dev dependencies without a version
                // field specified. However, cargo_metadata exposes only the resolved version of
                // a package, and not what semver range (if any) is requested in Cargo.toml.

A workaround is to leave out the version field in you dev-dependency. The only downside is that people won't be able to run tests on your crate from crates.io, which really only affects crater. This is the default behavior if you ran cargo add iroh-store --dev.