Improve CI around docbuilds

[aaronjeline]

Describe the improvement you'd like to request

4.2.0 launch accidentally had a build error in our docs that CI didn't catch. It would be nice to catch this.

Describe alternatives you've considered

No response

Additional context

No response

Is this something that you'd be interested in working on?

• 👋 I may be able to implement this internal improvement
• ⚠️ This feature might incur a breaking change

[john-h-kastner-aws]

Problematic line was here (still a problem on main at time of comment):

cedar/cedar-policy-validator/src/entity_manifest.rs

Line 71 in 1729f98

#[doc = include_str!("../../cedar-policy/experimental_warning.md")]

To detect this we would need to build the validator crate in an environment without the cedar-policy directory. I don't believe it would be enough to just cd into the validator crate and build docs from there.

[john-h-kastner-aws]

Just found this PR to clippy rust-lang/rust-clippy#13638 that looks like it could resolve this issue

[john-h-kastner-aws]

A similar issue reoccurred with this 4.3.0 release. This time it is due to protobuf schema trying to depend on schema located in other crates using a relative path.

[INFO] [stderr] error: failed to run custom build command for `cedar-policy-validator v4.3.0`
[INFO] [stderr] 
[INFO] [stderr] Caused by:
[INFO] [stderr]   process didn't exit successfully: `/opt/rustwide/target/debug/build/cedar-policy-validator-291fc8248da8e0f8/build-script-build` (exit status: 101)
[INFO] [stderr]   --- stderr
[INFO] [stderr] 
[INFO] [stderr]   thread 'main' panicked at /opt/rustwide/cargo-home/registry/src/index.crates.io-1949cf8c6b5b557f/cedar-policy-validator-4.3.0/build.rs:44:10:
[INFO] [stderr]   failed to compile `.proto` schema files: Custom { kind: Other, error: "protoc failed: AST.proto: File not found.\nValidator.proto:20:1: Import \"AST.proto\" was not found or had errors.\nValidator.proto:29:5: \"cedar_policy_core.EntityType\" is not defined.\nValidator.proto:34:5: \"cedar_policy_core.EntityUid\" is not defined.\nValidator.proto:39:5: \"cedar_policy_core.EntityType\" is not defined.\nValidator.proto:40:14: \"cedar_policy_core.EntityType\" is not defined.\nValidator.proto: \"cedar_policy_core.Expr\" is not defined.\nValidator.proto:47:5: \"cedar_policy_core.EntityUid\" is not defined.\nValidator.proto:49:14: \"cedar_policy_core.EntityUid\" is not defined.\nValidator.proto:57:14: \"cedar_policy_core.EntityType\" is not defined.\nValidator.proto:58:14: \"cedar_policy_core.EntityType\" is not defined.\nValidator.proto:66:9: \"cedar_policy_core.Name\" is not defined.\nValidator.proto:96:9: \"cedar_policy_core.EntityType\" is not defined.\nValidator.proto:99:9: \"cedar_policy_core.EntityType\" is not defined.\n" }
[INFO] [stderr]   note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
[INFO] [stderr] warning: build failed, waiting for other jobs to finish...

Offending line is here

cedar/cedar-policy-validator/build.rs

Line 42 in ab8aef0

&["./protobuf_schema", "../cedar-policy-core/protobuf_schema"],

This effects actual builds with the protobufs feature rather than just doc builds. Depending on how we address this and the original issue the fix might be the same. This clippy PR I linked above would not address this variant of the issue unless the clippy code were changed to have a special case for protobuf.

[john-h-kastner-aws]

Rust 1.90.0 might have feature that helps here

Cargo adds native support for workspace publishing

cargo publish --workspace is now supported, automatically publishing all of the crates in a workspace in the right order (following any dependencies between them).

This has long been possible with external tooling or manual ordering of individual publishes, but this brings the functionality into Cargo itself.

Native integration allows Cargo's publish verification to run a build across the full set of to-be-published crates as if they were published, including during dry-runs. Note that publishes are still not atomic -- network errors or server-side failures can still lead to a partially published workspace.

https://blog.rust-lang.org/2025/09/18/Rust-1.90.0/#cargo-adds-native-support-for-workspace-publishing

Specifically: "allows Cargo's publish verification to run a build across the full set of to-be-published crates as if they were, including during dry-runs". We should check if this would catch the docs error we encountered here. If so we can update our release process to use this new option and resolve this issue.