v0.8.4

.github/dependabot.yml

@@ -5,7 +5,6 @@ updates:
   # Rust dependencies
   - package-ecosystem: "cargo"
     directory: "/"
-    target-branch: "develop"
     schedule:
       interval: "weekly"
       day: "monday"
@@ -32,7 +31,6 @@ updates:
   # Fuzzing dependencies
   - package-ecosystem: "cargo"
     directory: "/fuzz"
-    target-branch: "develop"
     schedule:
       interval: "weekly"
       day: "monday"
@@ -47,7 +45,6 @@ updates:
   # GitHub Actions
   - package-ecosystem: "github-actions"
     directory: "/"
-    target-branch: "develop"
     schedule:
       interval: "weekly"
       day: "monday"

.github/workflows/ci.yml

@@ -2,9 +2,9 @@ name: CI
 
 on:
   push:
-    branches: [ master, develop ]
+    branches: [ master ]
   pull_request:
-    branches: [ master, develop ]
+    branches: [ master ]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}

.github/workflows/release.yml

@@ -1,26 +1,60 @@
 name: Release and Publish
 
+# Publishing is driven by publishing a GitHub release, not by pushing to a
+# branch. Create the release and its tag when you intend to ship; until then
+# nothing reaches crates.io, so merging to any branch is always safe.
 on:
-  push:
-    branches: [ main, master ]
-    paths-ignore:
-      - '**.md'
-      - 'docs/**'
-      - '.github/**'
-      - '!.github/workflows/release.yml'
+  release:
+    types: [published]
 
 env:
   CARGO_TERM_COLOR: always
 
 jobs:
-  # First ensure all tests pass
+  # Derive the version from the release tag and hold it against Cargo.toml, so a
+  # mistyped tag fails here rather than shipping under the wrong version.
+  version:
+    name: Resolve Version
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v7
+      with:
+        ref: ${{ github.event.release.tag_name }}
+
+    - name: Resolve and verify version
+      id: version
+      run: |
+        TAG="${{ github.event.release.tag_name }}"
+        VERSION="${TAG#v}"
+        FAILED=0
+        for MANIFEST in dotscope/Cargo.toml dotscope-cli/Cargo.toml; do
+          DECLARED=$(grep '^version = ' "$MANIFEST" | head -1 | cut -d '"' -f 2)
+          if [ "$VERSION" != "$DECLARED" ]; then
+            echo "::error::Release tag ${TAG} implies version ${VERSION}, but ${MANIFEST} declares ${DECLARED}"
+            FAILED=1
+          fi
+        done
+        if [ "$FAILED" -ne 0 ]; then
+          exit 1
+        fi
+        echo "version=$VERSION" >> $GITHUB_OUTPUT
+        echo "Releasing v${VERSION}"
+
+  # Then ensure all tests pass
   test:
     name: Pre-Release Tests
     runs-on: ubuntu-latest
+    needs: version
 
     steps:
     - name: Checkout code
       uses: actions/checkout@v7
+      with:
+        ref: ${{ github.event.release.tag_name }}
 
     - name: Install Rust toolchain
       uses: dtolnay/rust-toolchain@stable
@@ -57,111 +91,11 @@ jobs:
     - name: Check documentation
       run: cargo doc --no-deps
 
-  # Create GitHub release
-  create-release:
-    name: Create Release
-    runs-on: ubuntu-latest
-    needs: test
-    outputs:
-      version: ${{ steps.version.outputs.version }}
-      release_created: ${{ steps.check_release.outputs.created }}
-
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v7
-      with:
-        fetch-depth: 0
-
-    - name: Get version from Cargo.toml
-      id: version
-      run: |
-        VERSION=$(grep '^version = ' dotscope/Cargo.toml | head -1 | cut -d '"' -f 2)
-        echo "version=$VERSION" >> $GITHUB_OUTPUT
-        echo "Version: $VERSION"
-
-    - name: Check if release exists
-      id: check_release
-      run: |
-        if gh release view "v${{ steps.version.outputs.version }}" >/dev/null 2>&1; then
-          echo "created=false" >> $GITHUB_OUTPUT
-          echo "Release v${{ steps.version.outputs.version }} already exists, skipping"
-        else
-          echo "created=true" >> $GITHUB_OUTPUT
-        fi
-      env:
-        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-    - name: Generate changelog
-      id: changelog
-      if: steps.check_release.outputs.created == 'true'
-      run: |
-        LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
-
-        if [ -z "$LATEST_TAG" ]; then
-          CHANGELOG=$(git log --pretty=format:"- %s (%h)" --no-merges)
-        else
-          CHANGELOG=$(git log ${LATEST_TAG}..HEAD --pretty=format:"- %s (%h)" --no-merges)
-        fi
-
-        if [ -z "$CHANGELOG" ]; then
-          CHANGELOG="- Initial release"
-        fi
-
-        echo "CHANGELOG<<EOF" >> $GITHUB_OUTPUT
-        echo "$CHANGELOG" >> $GITHUB_OUTPUT
-        echo "EOF" >> $GITHUB_OUTPUT
-
-    - name: Create Release
-      if: steps.check_release.outputs.created == 'true'
-      run: |
-        VERSION="v${{ steps.version.outputs.version }}"
-        cat <<BODY > release_body.md
-        ## Changes in ${VERSION}
-
-        ${{ steps.changelog.outputs.CHANGELOG }}
-
-        ## Installation
-
-        ### Library
-
-        Add this to your \`Cargo.toml\`:
-
-        \`\`\`toml
-        [dependencies]
-        dotscope = "${{ steps.version.outputs.version }}"
-        \`\`\`
-
-        Or install via cargo:
-
-        \`\`\`bash
-        cargo add dotscope
-        \`\`\`
-
-        ### CLI Tool
-
-        Download the pre-built binary for your platform from the assets below and extract it.
-
-        | Platform | Asset |
-        |----------|-------|
-        | Linux (x86_64) | \`dotscope-${VERSION}-x86_64-unknown-linux-gnu.zip\` |
-        | macOS (Apple Silicon) | \`dotscope-${VERSION}-aarch64-apple-darwin.zip\` |
-        | Windows (x86_64) | \`dotscope-${VERSION}-x86_64-pc-windows-msvc.zip\` |
-
-        > **Note:** Z3 is an optional compile-time dependency used only for the \`z3\` feature (CFF reconstruction). The pre-built CLI binaries do **not** require Z3 at runtime.
-        BODY
-
-        gh release create "$VERSION" \
-          --title "Release ${VERSION}" \
-          --notes-file release_body.md
-      env:
-        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-  # Build CLI binaries for all platforms
+  # Build CLI binaries for all platforms and attach them to the release
   build-cli:
     name: Build CLI (${{ matrix.name }})
     runs-on: ${{ matrix.os }}
-    needs: create-release
-    if: needs.create-release.outputs.release_created == 'true'
+    needs: [version, test]
     strategy:
       fail-fast: false
       matrix:
@@ -182,6 +116,8 @@ jobs:
     steps:
     - name: Checkout code
       uses: actions/checkout@v7
+      with:
+        ref: ${{ github.event.release.tag_name }}
 
     - name: Install Rust toolchain
       uses: dtolnay/rust-toolchain@stable
@@ -200,31 +136,32 @@ jobs:
       if: runner.os != 'Windows'
       run: |
         cd target/${{ matrix.target }}/release
-        zip dotscope-v${{ needs.create-release.outputs.version }}-${{ matrix.target }}.zip ${{ matrix.artifact }}
-        mv dotscope-v${{ needs.create-release.outputs.version }}-${{ matrix.target }}.zip ${{ github.workspace }}/
+        zip dotscope-v${{ needs.version.outputs.version }}-${{ matrix.target }}.zip ${{ matrix.artifact }}
+        mv dotscope-v${{ needs.version.outputs.version }}-${{ matrix.target }}.zip ${{ github.workspace }}/
 
     - name: Package binary (Windows)
       if: runner.os == 'Windows'
       run: |
         cd target/${{ matrix.target }}/release
-        Compress-Archive -Path ${{ matrix.artifact }} -DestinationPath "${{ github.workspace }}\dotscope-v${{ needs.create-release.outputs.version }}-${{ matrix.target }}.zip"
+        Compress-Archive -Path ${{ matrix.artifact }} -DestinationPath "${{ github.workspace }}\dotscope-v${{ needs.version.outputs.version }}-${{ matrix.target }}.zip"
       shell: pwsh
 
     - name: Upload release asset
-      run: gh release upload "v${{ needs.create-release.outputs.version }}" "dotscope-v${{ needs.create-release.outputs.version }}-${{ matrix.target }}.zip" --clobber
+      run: gh release upload "${{ github.event.release.tag_name }}" "dotscope-v${{ needs.version.outputs.version }}-${{ matrix.target }}.zip" --clobber
       env:
         GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   # Publish to crates.io
   publish:
     name: Publish to crates.io
     runs-on: ubuntu-latest
-    needs: [test, create-release]
-    if: needs.create-release.outputs.release_created == 'true'
+    needs: [version, test]
 
     steps:
     - name: Checkout code
       uses: actions/checkout@v7
+      with:
+        ref: ${{ github.event.release.tag_name }}
 
     - name: Install Rust toolchain
       uses: dtolnay/rust-toolchain@stable
@@ -244,12 +181,13 @@ jobs:
   verify-docs:
     name: Verify Documentation
     runs-on: ubuntu-latest
-    needs: [test, create-release]
-    if: needs.create-release.outputs.release_created == 'true'
+    needs: [version, test]
 
     steps:
     - name: Checkout code
       uses: actions/checkout@v7
+      with:
+        ref: ${{ github.event.release.tag_name }}
 
     - name: Install Rust toolchain
       uses: dtolnay/rust-toolchain@stable

.gitlab-ci.yml

@@ -94,4 +94,3 @@ pages:
       - public
   only:
     - master
-    - develop