release: harden data path and publish 0.8.1

.github/workflows/ci.yml

@@ -4,6 +4,7 @@ on:
   pull_request:
   push:
     branches: [main]
+    tags: ["v*.*.*"]
 
 permissions:
   contents: read
@@ -17,5 +18,169 @@ jobs:
       - uses: azure/setup-helm@v4
         with:
           version: v3.17.3
+      - name: Verify release metadata
+        if: startsWith(github.ref, 'refs/tags/')
+        run: ./scripts/verify-release-version.sh "${GITHUB_REF_NAME#v}"
       - name: Core, compatibility, fuzz and packaging gates
         run: FULL=1 K8S_ACCEPTANCE=0 FUZZ_SECONDS=1 ./scripts/release-gate.sh
+
+  release-context:
+    needs: release-gate
+    runs-on: ubuntu-24.04
+    outputs:
+      publish: ${{ steps.release.outputs.publish }}
+      tag: ${{ steps.release.outputs.tag }}
+      version: ${{ steps.release.outputs.version }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - id: release
+        name: Resolve unpublished release
+        run: |
+          if [[ "$GITHUB_EVENT_NAME" == "pull_request" ]]; then
+            echo "publish=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
+            version="${GITHUB_REF_NAME#v}"
+          else
+            version="$(awk '
+              /^\[workspace\.package\]$/ { workspace = 1; next }
+              /^\[/ { workspace = 0 }
+              workspace && $1 == "version" {
+                gsub(/"/, "", $3)
+                print $3
+                exit
+              }
+            ' Cargo.toml)"
+          fi
+          ./scripts/verify-release-version.sh "$version"
+
+          tag="v$version"
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          if [[ "$GITHUB_REF" == refs/tags/* ]] ||
+            ! git ls-remote --exit-code --tags origin "refs/tags/$tag" >/dev/null 2>&1
+          then
+            echo "publish=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "publish=false" >> "$GITHUB_OUTPUT"
+          fi
+
+  release-binaries:
+    if: needs.release-context.outputs.publish == 'true'
+    needs: release-context
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-24.04
+            arch: x86_64
+          - runner: ubuntu-24.04-arm
+            arch: aarch64
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v4
+      - name: Verify release metadata
+        env:
+          RELEASE_VERSION: ${{ needs.release-context.outputs.version }}
+        run: ./scripts/verify-release-version.sh "$RELEASE_VERSION"
+      - name: Build native binaries and Console UI
+        run: make release-bin operator-release-bin console-ui-build
+      - name: Package native bundle
+        env:
+          RELEASE_VERSION: ${{ needs.release-context.outputs.version }}
+        run: ./scripts/package-release.sh binaries "$RELEASE_VERSION" release "${{ matrix.arch }}"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: rustqueue-${{ matrix.arch }}
+          path: release/rustqueue-*-linux-${{ matrix.arch }}.tar.gz
+          if-no-files-found: error
+          retention-days: 1
+
+  publish-release:
+    if: needs.release-context.outputs.publish == 'true'
+    needs: [release-context, release-binaries]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: azure/setup-helm@v4
+        with:
+          version: v3.17.3
+      - name: Require the release commit on main
+        run: |
+          git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
+          git merge-base --is-ancestor "$GITHUB_SHA" refs/remotes/origin/main
+      - uses: actions/download-artifact@v4
+        with:
+          path: release
+          merge-multiple: true
+      - name: Package source and Helm Chart
+        env:
+          RELEASE_VERSION: ${{ needs.release-context.outputs.version }}
+        run: ./scripts/package-release.sh common "$RELEASE_VERSION" release
+      - name: Create and verify checksums
+        env:
+          RELEASE_VERSION: ${{ needs.release-context.outputs.version }}
+        run: |
+          version="$RELEASE_VERSION"
+          cd release
+          sha256sum \
+            "rustqueue-$version-linux-aarch64.tar.gz" \
+            "rustqueue-$version-linux-x86_64.tar.gz" \
+            "rustqueue-$version-source.tar.gz" \
+            "rustqueue-$version.tgz" \
+            > "SHA256SUMS-$version"
+          sha256sum --check "SHA256SUMS-$version"
+      - name: Ensure release tag
+        env:
+          RELEASE_TAG: ${{ needs.release-context.outputs.tag }}
+          RELEASE_VERSION: ${{ needs.release-context.outputs.version }}
+        run: |
+          git fetch --tags origin
+          if git rev-parse --verify --quiet "refs/tags/$RELEASE_TAG" >/dev/null; then
+            test "$(git rev-list -n 1 "$RELEASE_TAG")" = "$GITHUB_SHA"
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git tag -a "$RELEASE_TAG" -m "RustQueue $RELEASE_VERSION" "$GITHUB_SHA"
+          git push origin "refs/tags/$RELEASE_TAG"
+      - name: Publish GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ needs.release-context.outputs.tag }}
+          RELEASE_VERSION: ${{ needs.release-context.outputs.version }}
+        run: |
+          version="$RELEASE_VERSION"
+          notes="docs/releases/$RELEASE_TAG.md"
+          assets=(
+            "release/rustqueue-$version-linux-aarch64.tar.gz"
+            "release/rustqueue-$version-linux-x86_64.tar.gz"
+            "release/rustqueue-$version-source.tar.gz"
+            "release/rustqueue-$version.tgz"
+            "release/SHA256SUMS-$version"
+          )
+          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
+            gh release upload "$RELEASE_TAG" "${assets[@]}" --clobber
+          else
+            gh release create "$RELEASE_TAG" \
+              --draft \
+              --verify-tag \
+              --title "RustQueue $version" \
+              --notes-file "$notes"
+            gh release upload "$RELEASE_TAG" "${assets[@]}"
+          fi
+          gh release edit "$RELEASE_TAG" \
+            --title "RustQueue $version" \
+            --notes-file "$notes" \
+            --draft=false \
+            --latest

Cargo.toml

@@ -16,7 +16,7 @@ members = [
 exclude = ["fuzz"]
 
 [workspace.package]
-version = "0.8.0"
+version = "0.8.1"
 edition = "2021"
 license = "Apache-2.0"
 rust-version = "1.88"
@@ -37,7 +37,7 @@ libc = "0.2.186"
 hdrhistogram = "7.5.4"
 parking_lot = "0.12.3"
 rand = "0.8.5"
-regex = "1.11.1"
+regex-automata = "0.4.16"
 reqwest = { version = "0.12.12", default-features = false, features = ["http2", "json", "rustls-tls"] }
 rustls = "0.23.21"
 rustls-pemfile = "2.2.0"