mq-bridge-basic 0.4.20__tar.gz → 1.0.0__tar.gz

mq_bridge_basic-1.0.0/.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

{mq_bridge_basic-0.4.20 → mq_bridge_basic-1.0.0}/.github/workflows/app.yml

@@ -266,18 +266,14 @@ jobs:
           path: docker-suite
           retention-days: 1
 
-  # One backend per runner, so the servers never compete for memory or for the
-  # fixed host ports the test URIs use. `run_docker_tests.sh` does the same loop
-  # locally, one at a time.
+  # One backend at a time on one runner, so the servers never compete for memory
+  # or for the fixed host ports the test URIs use. `run_docker_tests.sh` does the
+  # same loop locally. Nine runners for ~20 s of tests each held slots the rest
+  # of the workflows were queuing for.
   docker:
-    name: App docker (${{ matrix.backend }})
+    name: App docker
     runs-on: ubuntu-latest
     needs: docker-build
-    strategy:
-      fail-fast: false
-      matrix:
-        backend:
-          [postgres, mysql, mariadb, kafka, nats, mongodb, redis, amqp, mqtt]
     steps:
       - uses: actions/checkout@v7
 
@@ -303,24 +299,39 @@ jobs:
 
       # The engine's own integration stacks, so there is one definition per
       # service rather than a second copy that can drift.
-      - name: Start ${{ matrix.backend }}
-        run: docker compose -f tests/integration/docker-compose/${{ matrix.backend }}.yml up -d --wait --wait-timeout 300
-
+      #
       # The backend name filters the test names as well as MQB_TEST_BACKEND:
       # `backend!` skips by returning, so without the name filter every excluded
       # test still reports `ok` and a broken service would look green.
-      - name: Run ${{ matrix.backend }} tests
+      #
+      # A failing backend does not stop the loop; the step fails at the end and
+      # names every backend that failed.
+      - name: Run the backends one after another
+        timeout-minutes: 45
         # `shell: bash` for pipefail: the default shell would take `tee`'s exit
         # status and report a failing test run as a pass.
         shell: bash
-        env:
-          MQB_TEST_BACKEND: ${{ matrix.backend }}
         run: |
-          ./docker-suite/test-binary \
-            --ignored --test-threads=1 ${{ matrix.backend }} 2>&1 | tee result.log
-          grep -qE 'test result: ok\. [1-9]' result.log \
-            || { echo "no ${{ matrix.backend }} tests ran"; exit 1; }
-
-      - name: Service logs
-        if: failure()
-        run: docker compose -f tests/integration/docker-compose/${{ matrix.backend }}.yml logs --tail 200
+          failed=()
+          for backend in postgres mysql mariadb kafka nats mongodb redis amqp mqtt; do
+            compose="tests/integration/docker-compose/$backend.yml"
+            echo "::group::$backend"
+            ok=1
+            docker compose -f "$compose" up -d --wait --wait-timeout 300 || ok=0
+            if [ "$ok" = 1 ]; then
+              MQB_TEST_BACKEND="$backend" ./docker-suite/test-binary \
+                --ignored --test-threads=1 "$backend" 2>&1 | tee result.log || ok=0
+              grep -qE 'test result: ok\. [1-9]' result.log \
+                || { echo "no $backend tests ran"; ok=0; }
+            fi
+            if [ "$ok" = 0 ]; then
+              failed+=("$backend")
+              docker compose -f "$compose" logs --tail 200 || true
+            fi
+            docker compose -f "$compose" down -v --remove-orphans || true
+            echo "::endgroup::"
+          done
+          if [ "${#failed[@]}" -gt 0 ]; then
+            echo "::error::failed backends: ${failed[*]}"
+            exit 1
+          fi

{mq_bridge_basic-0.4.20 → mq_bridge_basic-1.0.0}/.github/workflows/benchmark.yml

@@ -1,8 +1,9 @@
 name: Benchmark
 
 on:
+  # Not on `dev`: benchmarks are no gate, and the nightly run records the trend.
   push:
-    branches: [main, dev]
+    branches: [main]
   schedule:
     # Nightly full benchmark run (04:00 UTC)
     - cron: '0 4 * * *'

{mq_bridge_basic-0.4.20 → mq_bridge_basic-1.0.0}/.github/workflows/ci.yml

@@ -86,6 +86,32 @@ jobs:
             exit 1
           fi
 
+  # The Rust versions the README promises, with the checked-in lock.
+  msrv:
+    name: MSRV (${{ matrix.toolchain }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - toolchain: "1.89.0"
+            features: "file,dir-spool,middleware,yaml,plugin,mongodb,kafka,amqp,nats,mqtt,http,zeromq,redis-streams,sled,grpc,clickhouse,http-bulk,websocket,object-store,parquet,avro,rustls-aws-lc,ibm-mq"
+          - toolchain: "1.94.1"
+            features: "full"
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+        with:
+          toolchain: ${{ matrix.toolchain }}
+
+      - name: Cache cargo build
+        uses: Swatinem/rust-cache@v2
+
+      - name: Check with the minimum Rust version
+        run: cargo check --lib --locked --features ${{ matrix.features }}
+
   # Unit tests
   test:
     name: Test
@@ -283,6 +309,27 @@ jobs:
       - name: Build documentation (deny warnings)
         run: RUSTDOCFLAGS="-D warnings" cargo doc --features lint-all --no-deps
 
+  # Public Rust API against the latest release on crates.io: a change that breaks a
+  # downstream crate needs a major version. A new config field or enum variant
+  # needs a minor one; Cargo.toml sets that under `cargo-semver-checks.lints`.
+  semver:
+    name: SemVer
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+
+      # Not a gate until it has passed once; see production-review-decisions-4.md, 4-7.
+      - name: Check semver
+        continue-on-error: true
+        uses: obi1kenobi/cargo-semver-checks-action@v2
+        with:
+          package: mq-bridge
+          feature-group: only-explicit-features
+          features: full,plugin-sdk
+
   # Supply chain: licenses, banned crates, source registries, RustSec advisories
   supply-chain:
     name: Supply Chain
@@ -301,6 +348,11 @@ jobs:
         with:
           command: check bans licenses sources
 
+      # cargo-deny approves licenses; this checks the shipped notice files name
+      # every crate that ends up in a release artifact.
+      - name: Third-party notices list every shipped crate
+        run: scripts/ci/check_third_party_notices.sh
+
       # Informational: every current advisory is in a transitive dependency we
       # cannot upgrade ourselves, and RustSec updates daily. SECURITY.md records
       # the per-feature reachability analysis; deny.toml carries the reasoning.

{mq_bridge_basic-0.4.20 → mq_bridge_basic-1.0.0}/.github/workflows/publish-python.yml

@@ -24,11 +24,12 @@ on:
   workflow_dispatch:
     inputs:
       target:
-        description: "Where to publish the packages"
+        description: "Where to publish the packages (build-only uploads nothing)"
         required: true
-        default: "testpypi"
+        default: "build-only"
         type: choice
         options:
+          - build-only
           - testpypi
           - pypi
 
@@ -200,8 +201,14 @@ jobs:
           # cmake. manylinux containers already ship it; the musllinux (Alpine)
           # container does not, so install it there. Guarded so it's a no-op
           # wherever cmake is already present. Only runs for linux builds.
+          # full's `kafka-ssl` builds OpenSSL, whose Configure needs perl modules
+          # (IPC::Cmd, ...) the manylinux image leaves out.
           before-script-linux: |
-            command -v cmake >/dev/null 2>&1 || apk add --no-cache cmake gcc g++ make musl-dev perl
+            if command -v apk >/dev/null 2>&1; then
+              command -v cmake >/dev/null 2>&1 || apk add --no-cache cmake gcc g++ make musl-dev perl
+            elif command -v yum >/dev/null 2>&1; then
+              yum install -y perl-core || yum install -y perl perl-IPC-Cmd
+            fi
 
       - name: Upload wheels
         uses: actions/upload-artifact@v7
@@ -256,7 +263,7 @@ jobs:
     # Direct runs only. Publishing from here under release.yml authenticates
     # (PyPI matches the reusable workflow) but the attestation is signed with the
     # *caller's* identity, which PyPI then rejects. release.yml uploads instead.
-    if: ${{ !inputs.skip_publish }}
+    if: ${{ !inputs.skip_publish && inputs.target != 'build-only' }}
     runs-on: ubuntu-latest
     needs: [build-wheels, build-sdists]
     permissions:

{mq_bridge_basic-0.4.20 → mq_bridge_basic-1.0.0}/.github/workflows/release.yml

@@ -451,6 +451,10 @@ jobs:
     name: Build CLI asset for ${{ matrix.target }}
     needs: [metadata, release]
     runs-on: ${{ matrix.os }}
+    # Asset builds must not fail on warnings: MSVC emits LNK4099 for the vendored
+    # OpenSSL objects. Presetting this stops setup-rust-toolchain from denying them.
+    env:
+      CARGO_BUILD_WARNINGS: warn
     permissions:
       contents: write
     strategy:
@@ -496,9 +500,13 @@ jobs:
         if: runner.os == 'Linux'
         run: sudo apt-get update && sudo apt-get install -y libssl-dev pkg-config zlib1g-dev cmake libcurl4-openssl-dev protobuf-compiler
 
+      # `kafka-ssl` builds OpenSSL with perl. The bash build step would pick Git's
+      # perl, which lacks the modules; pin the Strawberry perl this shell resolves.
       - name: Install dependencies (Windows)
         if: runner.os == 'Windows'
-        run: choco install protoc --no-progress -y
+        run: |
+          choco install protoc --no-progress -y
+          "OPENSSL_SRC_PERL=$((Get-Command perl).Source)" >> $env:GITHUB_ENV
 
       - name: Install dependencies (macOS)
         if: runner.os == 'macOS'
@@ -541,6 +549,110 @@ jobs:
           tag_name: ${{ needs.metadata.outputs.release_tag }}
           files: ${{ env.ASSET_PATH }}
 
+  # The C library has no ABI stability, so each archive carries the header that
+  # matches its library. Shared library only: a `full` static archive is huge and
+  # needs a per-target native link line.
+  build-c-library:
+    name: Build C library asset for ${{ matrix.target }}
+    needs: [metadata, release]
+    runs-on: ${{ matrix.os }}
+    # Same LNK4099 reason as build-release.
+    env:
+      CARGO_BUILD_WARNINGS: warn
+    permissions:
+      contents: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # Same runners as the CLI assets, so both share one glibc floor.
+          - os: ubuntu-22.04
+            target: x86_64-unknown-linux-gnu
+          - os: macos-latest
+            target: aarch64-apple-darwin
+          - os: windows-2022
+            target: x86_64-pc-windows-msvc
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.tag_name || github.ref }}
+
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v2
+        with:
+          toolchain: stable
+          target: ${{ matrix.target }}
+
+      - name: Install dependencies (Linux)
+        if: runner.os == 'Linux'
+        run: sudo apt-get update && sudo apt-get install -y libssl-dev pkg-config zlib1g-dev cmake libcurl4-openssl-dev protobuf-compiler
+
+      # `kafka-ssl` builds OpenSSL with perl. The bash build step would pick Git's
+      # perl, which lacks the modules; pin the Strawberry perl this shell resolves.
+      - name: Install dependencies (Windows)
+        if: runner.os == 'Windows'
+        run: |
+          choco install protoc --no-progress -y
+          "OPENSSL_SRC_PERL=$((Get-Command perl).Source)" >> $env:GITHUB_ENV
+
+      - name: Install dependencies (macOS)
+        if: runner.os == 'macOS'
+        run: brew install cmake pkg-config openssl@3 protobuf
+
+      # `cargo rustc --crate-type` skips the static library the manifest also declares.
+      - name: Build shared library (full)
+        shell: bash
+        run: cargo rustc -p mq-bridge-c --release --target ${{ matrix.target }} --crate-type cdylib
+
+      - name: Package artifacts
+        shell: bash
+        run: |
+          ASSET_NAME="mq-bridge-c-${{ matrix.target }}"
+          OUT="target/${{ matrix.target }}/release"
+          mkdir -p staging/lib staging/include
+          case "$RUNNER_OS" in
+            Windows) cp "$OUT/mq_bridge.dll" "$OUT/mq_bridge.dll.lib" staging/lib/ ;;
+            macOS)
+              cp "$OUT/libmq_bridge.dylib" staging/lib/
+              # Pin the install name so programs find the library through their rpath.
+              install_name_tool -id @rpath/libmq_bridge.dylib staging/lib/libmq_bridge.dylib
+              codesign --force --sign - staging/lib/libmq_bridge.dylib
+              ;;
+            *) cp "$OUT/libmq_bridge.so" staging/lib/ ;;
+          esac
+          cp include/*.h staging/include/
+          cp LICENSE LICENSE-MIT LICENSE-APACHE staging/
+          cp c/mq-bridge-c/README.md staging/README.md
+          cp c/mq-bridge-c/THIRD_PARTY_LICENSES.txt staging/
+          if [ "$RUNNER_OS" == "Windows" ]; then
+            7z a "${ASSET_NAME}.zip" ./staging/*
+            echo "ASSET_PATH=${ASSET_NAME}.zip" >> "$GITHUB_ENV"
+          else
+            tar -czf "${ASSET_NAME}.tar.gz" -C staging .
+            echo "ASSET_PATH=${ASSET_NAME}.tar.gz" >> "$GITHUB_ENV"
+          fi
+
+      # CI only links the `--no-default-features` build; this is the one place a C
+      # program meets the `full` library, and it uses the archive as a user would.
+      - name: Smoke test the archive
+        if: runner.os != 'Windows'
+        shell: bash
+        run: |
+          mkdir unpacked
+          tar -xzf "$ASSET_PATH" -C unpacked
+          cc -std=c11 -I unpacked/include examples/c-library/smoke.c \
+            -L unpacked/lib -lmq_bridge "-Wl,-rpath,$PWD/unpacked/lib" -o smoke
+          if [ "$RUNNER_OS" == "macOS" ]; then otool -L unpacked/lib/libmq_bridge.dylib; else ldd unpacked/lib/libmq_bridge.so; fi
+          ./smoke "$RUNNER_TEMP" | tee smoke.log
+          grep -q "smoke test passed" smoke.log
+
+      - name: Upload Release Asset
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
+        with:
+          tag_name: ${{ needs.metadata.outputs.release_tag }}
+          files: ${{ env.ASSET_PATH }}
+
   build-linux-amd64:
     name: Build docker linux/amd64
     needs: [metadata, preflight, test, app-checks, package-dry-run]
@@ -833,6 +945,7 @@ jobs:
     needs:
       - metadata
       - build-release
+      - build-c-library
       - build-linux-arm64-asset
       - build-tauri-release
       - publish-manifest