mq-bridge-basic 0.4.20__tar.gz → 1.0.1__tar.gz

mq_bridge_basic-1.0.1/.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

{mq_bridge_basic-0.4.20 → mq_bridge_basic-1.0.1}/.github/workflows/app.yml

@@ -238,24 +238,29 @@ jobs:
       # cargo reports the binary it just built; a restored cache can leave several
       # older `cli_copy_docker_test-<hash>` files next to it, so globbing deps/
       # would pick an arbitrary one.
-      - name: Build the docker test binary
+      - name: Build the docker test binaries
         working-directory: apps/mq-bridge-app
         shell: bash
         run: |
-          cargo test -p mq-bridge-app --test cli_copy_docker_test --no-run \
+          cargo test -p mq-bridge-app --test cli_copy_docker_test \
+            --test cli_scenario_docker_test --no-run \
             --message-format=json > "$RUNNER_TEMP/build.json"
           jq -r 'select(.target.name == "cli_copy_docker_test") | .executable // empty' \
             "$RUNNER_TEMP/build.json" | tail -1 > "$RUNNER_TEMP/test-binary"
+          jq -r 'select(.target.name == "cli_scenario_docker_test") | .executable // empty' \
+            "$RUNNER_TEMP/build.json" | tail -1 > "$RUNNER_TEMP/scenario-binary"
           jq -r 'select(.target.name == "mq-bridge-app"
                         and (.target.kind // [] | index("bin"))) | .executable // empty' \
             "$RUNNER_TEMP/build.json" | tail -1 > "$RUNNER_TEMP/cli-binary"
-          test -s "$RUNNER_TEMP/test-binary" && test -s "$RUNNER_TEMP/cli-binary"
+          test -s "$RUNNER_TEMP/test-binary" && test -s "$RUNNER_TEMP/scenario-binary" \
+            && test -s "$RUNNER_TEMP/cli-binary"
 
       - name: Collect binaries
         shell: bash
         run: |
           mkdir -p docker-suite
           cp "$(cat "$RUNNER_TEMP/test-binary")" docker-suite/test-binary
+          cp "$(cat "$RUNNER_TEMP/scenario-binary")" docker-suite/scenario-binary
           cp "$(cat "$RUNNER_TEMP/cli-binary")" docker-suite/mq-bridge-app
           cp "$RUNNER_TEMP/cli-binary" docker-suite/cli-path
 
@@ -266,18 +271,14 @@ jobs:
           path: docker-suite
           retention-days: 1
 
-  # One backend per runner, so the servers never compete for memory or for the
-  # fixed host ports the test URIs use. `run_docker_tests.sh` does the same loop
-  # locally, one at a time.
+  # One backend at a time on one runner, so the servers never compete for memory
+  # or for the fixed host ports the test URIs use. `run_docker_tests.sh` does the
+  # same loop locally. Nine runners for ~20 s of tests each held slots the rest
+  # of the workflows were queuing for.
   docker:
-    name: App docker (${{ matrix.backend }})
+    name: App docker
     runs-on: ubuntu-latest
     needs: docker-build
-    strategy:
-      fail-fast: false
-      matrix:
-        backend:
-          [postgres, mysql, mariadb, kafka, nats, mongodb, redis, amqp, mqtt]
     steps:
       - uses: actions/checkout@v7
 
@@ -295,7 +296,7 @@ jobs:
           cli="$(cat docker-suite/cli-path)"
           mkdir -p "$(dirname "$cli")"
           mv docker-suite/mq-bridge-app "$cli"
-          chmod +x "$cli" docker-suite/test-binary
+          chmod +x "$cli" docker-suite/test-binary docker-suite/scenario-binary
 
       - name: Install runtime libraries
         timeout-minutes: 5
@@ -303,24 +304,100 @@ jobs:
 
       # The engine's own integration stacks, so there is one definition per
       # service rather than a second copy that can drift.
-      - name: Start ${{ matrix.backend }}
-        run: docker compose -f tests/integration/docker-compose/${{ matrix.backend }}.yml up -d --wait --wait-timeout 300
-
+      #
       # The backend name filters the test names as well as MQB_TEST_BACKEND:
       # `backend!` skips by returning, so without the name filter every excluded
       # test still reports `ok` and a broken service would look green.
-      - name: Run ${{ matrix.backend }} tests
+      #
+      # A failing backend does not stop the loop; the step fails at the end and
+      # names every backend that failed.
+      - name: Run the backends one after another
+        timeout-minutes: 45
         # `shell: bash` for pipefail: the default shell would take `tee`'s exit
         # status and report a failing test run as a pass.
         shell: bash
-        env:
-          MQB_TEST_BACKEND: ${{ matrix.backend }}
         run: |
-          ./docker-suite/test-binary \
-            --ignored --test-threads=1 ${{ matrix.backend }} 2>&1 | tee result.log
-          grep -qE 'test result: ok\. [1-9]' result.log \
-            || { echo "no ${{ matrix.backend }} tests ran"; exit 1; }
+          failed=()
+          for backend in postgres mysql mariadb kafka nats mongodb redis amqp mqtt; do
+            compose="tests/integration/docker-compose/$backend.yml"
+            echo "::group::$backend"
+            ok=1
+            docker compose -f "$compose" up -d --wait --wait-timeout 300 || ok=0
+            if [ "$ok" = 1 ]; then
+              MQB_TEST_BACKEND="$backend" ./docker-suite/test-binary \
+                --ignored --test-threads=1 "$backend" 2>&1 | tee result.log || ok=0
+              grep -qE 'test result: ok\. [1-9]' result.log \
+                || { echo "no $backend tests ran"; ok=0; }
+            fi
+            if [ "$ok" = 0 ]; then
+              failed+=("$backend")
+              docker compose -f "$compose" logs --tail 200 || true
+            fi
+            docker compose -f "$compose" down -v --remove-orphans || true
+            echo "::endgroup::"
+          done
+          if [ "${#failed[@]}" -gt 0 ]; then
+            echo "::error::failed backends: ${failed[*]}"
+            exit 1
+          fi
+
+  # Route-level scenarios through the binary: broker restarts, SIGTERM and
+  # `kill -9` resumes. A job of its own so these slower runs never hold up the
+  # copy matrix above; same binaries, same one-backend-at-a-time loop.
+  docker-scenario:
+    name: App docker — Scenarios
+    runs-on: ubuntu-latest
+    needs: docker-build
+    steps:
+      - uses: actions/checkout@v7
 
-      - name: Service logs
-        if: failure()
-        run: docker compose -f tests/integration/docker-compose/${{ matrix.backend }}.yml logs --tail 200
+      - name: Download docker suite binaries
+        uses: actions/download-artifact@v8
+        with:
+          name: app-docker-suite
+          path: docker-suite
+
+      - name: Restore binaries
+        shell: bash
+        run: |
+          cli="$(cat docker-suite/cli-path)"
+          mkdir -p "$(dirname "$cli")"
+          mv docker-suite/mq-bridge-app "$cli"
+          chmod +x "$cli" docker-suite/scenario-binary
+
+      - name: Install runtime libraries
+        timeout-minutes: 5
+        run: sudo apt-get update && sudo apt-get install -y libcurl4-openssl-dev libssl-dev zlib1g-dev
+
+      # Name filter plus MQB_TEST_BACKEND, and a zero-test run fails, for the
+      # reasons given on the copy loop above.
+      - name: Run the scenarios one backend after another
+        timeout-minutes: 30
+        shell: bash
+        run: |
+          failed=()
+          for backend in kafka postgres nats amqp mqtt mongodb mysql mariadb; do
+            stack="$backend"
+            # CDC needs logical replication; the cursor scenarios run on it too.
+            [ "$backend" = postgres ] && stack=postgres_cdc
+            compose="tests/integration/docker-compose/$stack.yml"
+            echo "::group::$backend"
+            ok=1
+            docker compose -f "$compose" up -d --wait --wait-timeout 300 || ok=0
+            if [ "$ok" = 1 ]; then
+              MQB_TEST_BACKEND="$backend" ./docker-suite/scenario-binary \
+                --ignored --test-threads=1 "$backend" 2>&1 | tee result.log || ok=0
+              grep -qE 'test result: ok\. [1-9]' result.log \
+                || { echo "no $backend scenarios ran"; ok=0; }
+            fi
+            if [ "$ok" = 0 ]; then
+              failed+=("$backend")
+              docker compose -f "$compose" logs --tail 200 || true
+            fi
+            docker compose -f "$compose" down -v --remove-orphans || true
+            echo "::endgroup::"
+          done
+          if [ "${#failed[@]}" -gt 0 ]; then
+            echo "::error::failed backends: ${failed[*]}"
+            exit 1
+          fi

{mq_bridge_basic-0.4.20 → mq_bridge_basic-1.0.1}/.github/workflows/benchmark.yml

@@ -1,8 +1,9 @@
 name: Benchmark
 
 on:
+  # Not on `dev`: benchmarks are no gate, and the nightly run records the trend.
   push:
-    branches: [main, dev]
+    branches: [main]
   schedule:
     # Nightly full benchmark run (04:00 UTC)
     - cron: '0 4 * * *'

{mq_bridge_basic-0.4.20 → mq_bridge_basic-1.0.1}/.github/workflows/ci.yml

@@ -86,6 +86,32 @@ jobs:
             exit 1
           fi
 
+  # The Rust versions the README promises, with the checked-in lock.
+  msrv:
+    name: MSRV (${{ matrix.toolchain }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - toolchain: "1.89.0"
+            features: "file,dir-spool,middleware,yaml,plugin,mongodb,kafka,amqp,nats,mqtt,http,zeromq,redis-streams,sled,grpc,clickhouse,http-bulk,websocket,object-store,parquet,avro,rustls-aws-lc,ibm-mq"
+          - toolchain: "1.94.1"
+            features: "full"
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+        with:
+          toolchain: ${{ matrix.toolchain }}
+
+      - name: Cache cargo build
+        uses: Swatinem/rust-cache@v2
+
+      - name: Check with the minimum Rust version
+        run: cargo check --lib --locked --features ${{ matrix.features }}
+
   # Unit tests
   test:
     name: Test
@@ -182,12 +208,10 @@ jobs:
         include:
           - name: Status
             filter: 'binary(integration_test) & test(=test_all_status)'
-          - name: Chaos
-            filter: 'binary(integration_test) & test(=test_all_chaos)'
           - name: Logic
             filter: 'binary(integration_test) & (test(=test_all_request_reply) | test(=test_all_subscriber_logic))'
           - name: Endpoints
-            filter: 'binary(integration_test) & not test(=test_all_status) & not test(=test_all_chaos) & not test(=test_all_request_reply) & not test(=test_all_subscriber_logic) & not test(=test_all_performance_pipeline) & not test(=test_all_performance_direct)'
+            filter: 'binary(integration_test) & not test(=test_all_status) & not test(=test_all_request_reply) & not test(=test_all_subscriber_logic) & not test(=test_all_performance_pipeline) & not test(=test_all_performance_direct)'
           - name: Performance Pipeline
             filter: 'binary(integration_test) & test(=test_all_performance_pipeline)'
           - name: Performance Direct
@@ -244,9 +268,11 @@ jobs:
 
   # Armature clones an external repo and runs its test suite: no docker stacks, no
   # TLS certs, no keytool. It used to pay ~1.3m of setup for 1.7m of tests.
+  # Advisory: it builds armature's `develop` head unlocked, so their breakage shows here.
   integration-armature:
     name: Integration — Armature
     runs-on: ubuntu-latest
+    continue-on-error: true
     needs: integration-build
     steps:
       - uses: actions/checkout@v7
@@ -283,6 +309,27 @@ jobs:
       - name: Build documentation (deny warnings)
         run: RUSTDOCFLAGS="-D warnings" cargo doc --features lint-all --no-deps
 
+  # Public Rust API against the latest release on crates.io: a change that breaks a
+  # downstream crate needs a major version. A new config field or enum variant
+  # needs a minor one; Cargo.toml sets that under `cargo-semver-checks.lints`.
+  semver:
+    name: SemVer
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+
+      # Not a gate until it has passed once; see production-review-decisions-4.md, 4-7.
+      - name: Check semver
+        continue-on-error: true
+        uses: obi1kenobi/cargo-semver-checks-action@v2
+        with:
+          package: mq-bridge
+          feature-group: only-explicit-features
+          features: full,plugin-sdk
+
   # Supply chain: licenses, banned crates, source registries, RustSec advisories
   supply-chain:
     name: Supply Chain
@@ -301,6 +348,11 @@ jobs:
         with:
           command: check bans licenses sources
 
+      # cargo-deny approves licenses; this checks the shipped notice files name
+      # every crate that ends up in a release artifact.
+      - name: Third-party notices list every shipped crate
+        run: scripts/ci/check_third_party_notices.sh
+
       # Informational: every current advisory is in a transitive dependency we
       # cannot upgrade ourselves, and RustSec updates daily. SECURITY.md records
       # the per-feature reachability analysis; deny.toml carries the reasoning.

{mq_bridge_basic-0.4.20 → mq_bridge_basic-1.0.1}/.github/workflows/ibm-mq.yml

@@ -62,15 +62,23 @@ jobs:
             ${{ runner.os }}-cargo-ibmmq-
             ${{ runner.os }}-cargo-
       
+      # Only a cache miss reaches IBM's download host.
+      - name: Cache IBM MQ redist archive
+        uses: actions/cache@v6
+        with:
+          path: ~/ibm-mq-redist
+          key: ibm-mq-redist-${{ env.IBM_MQ_REDIST_SHA256 }}
+
       - name: Install IBM MQ Client Libraries
         id: mqclient
         run: |
-          archive_url="$IBM_MQ_REDIST_URL"
-          archive_name="$(basename "$archive_url")"
+          archive_name="$HOME/ibm-mq-redist/$(basename "$IBM_MQ_REDIST_URL")"
           # IBM's download host is occasionally unreachable from runners. Treat a
           # download failure as infrastructure flakiness and skip the rest of the
           # job (see `if:` guards below). Checksum/extract failures still fail.
-          if ! curl -fsSLO --retry 5 --retry-all-errors --retry-delay 5 --connect-timeout 30 "$archive_url"; then
+          # Download outside the cached dir so a failure never caches an empty one.
+          tmp="$RUNNER_TEMP/$(basename "$archive_name")"
+          if [ ! -f "$archive_name" ] && ! { curl -fsSL --retry 5 --retry-all-errors --retry-delay 5 --connect-timeout 30 -o "$tmp" "$IBM_MQ_REDIST_URL" && mkdir -p "$(dirname "$archive_name")" && mv "$tmp" "$archive_name"; }; then
             echo "::warning::IBM MQ redist download failed (host unreachable); skipping IBM MQ build."
             echo "available=false" >> "$GITHUB_OUTPUT"
             exit 0
@@ -131,15 +139,23 @@ jobs:
             ${{ runner.os }}-cargo-ibmmq-
             ${{ runner.os }}-cargo-
       
+      # Only a cache miss reaches IBM's download host.
+      - name: Cache IBM MQ redist archive
+        uses: actions/cache@v6
+        with:
+          path: ~/ibm-mq-redist
+          key: ibm-mq-redist-${{ env.IBM_MQ_REDIST_SHA256 }}
+
       - name: Install IBM MQ Client Libraries
         id: mqclient
         run: |
-          archive_url="$IBM_MQ_REDIST_URL"
-          archive_name="$(basename "$archive_url")"
+          archive_name="$HOME/ibm-mq-redist/$(basename "$IBM_MQ_REDIST_URL")"
           # IBM's download host is occasionally unreachable from runners. Treat a
           # download failure as infrastructure flakiness and skip the rest of the
           # job (see `if:` guards below). Checksum/extract failures still fail.
-          if ! curl -fsSLO --retry 5 --retry-all-errors --retry-delay 5 --connect-timeout 30 "$archive_url"; then
+          # Download outside the cached dir so a failure never caches an empty one.
+          tmp="$RUNNER_TEMP/$(basename "$archive_name")"
+          if [ ! -f "$archive_name" ] && ! { curl -fsSL --retry 5 --retry-all-errors --retry-delay 5 --connect-timeout 30 -o "$tmp" "$IBM_MQ_REDIST_URL" && mkdir -p "$(dirname "$archive_name")" && mv "$tmp" "$archive_name"; }; then
             echo "::warning::IBM MQ redist download failed (host unreachable); skipping IBM MQ integration tests."
             echo "available=false" >> "$GITHUB_OUTPUT"
             exit 0
@@ -188,7 +204,7 @@ jobs:
             --ignored --nocapture --test-threads=1 \
             test_all_subscriber_logic \
             test_all_performance_pipeline \
-            test_all_chaos \
+            test_ibm_mq_chaos \
             test_all_status
 
       - name: Run IBM MQ TLS tests
@@ -223,20 +239,7 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-cargo-ibmmq-
       
-      - name: Install IBM MQ Client Libraries
-        run: |
-          archive_url="$IBM_MQ_REDIST_URL"
-          archive_name="$(basename "$archive_url")"
-          curl -fsSLO --retry 5 --retry-all-errors --retry-delay 5 --connect-timeout 30 "$archive_url"
-          echo "${IBM_MQ_REDIST_SHA256}  ${archive_name}" | sha256sum -c -
-          # The redist archive extracts a self-contained MQ install tree
-          # (bin/, lib64/, inc/, ...) with no top-level mqm/ dir, so unpack
-          # it directly into the installation path.
-          sudo mkdir -p /opt/mqm
-          sudo tar -xzf "$archive_name" -C /opt/mqm
-          echo "LD_LIBRARY_PATH=/opt/mqm/lib64:$LD_LIBRARY_PATH" >> $GITHUB_ENV
-          echo "MQ_INSTALLATION_PATH=/opt/mqm" >> $GITHUB_ENV
-      
+      # `ibm-mq` loads the client at runtime, so rustdoc needs no IBM MQ SDK.
       - name: Build documentation
         run: cargo doc --features ibm-mq --no-deps
 

{mq_bridge_basic-0.4.20 → mq_bridge_basic-1.0.1}/.github/workflows/publish-python.yml

@@ -24,11 +24,12 @@ on:
   workflow_dispatch:
     inputs:
       target:
-        description: "Where to publish the packages"
+        description: "Where to publish the packages (build-only uploads nothing)"
         required: true
-        default: "testpypi"
+        default: "build-only"
         type: choice
         options:
+          - build-only
           - testpypi
           - pypi
 
@@ -200,8 +201,14 @@ jobs:
           # cmake. manylinux containers already ship it; the musllinux (Alpine)
           # container does not, so install it there. Guarded so it's a no-op
           # wherever cmake is already present. Only runs for linux builds.
+          # full's `kafka-ssl` builds OpenSSL, whose Configure needs perl modules
+          # (IPC::Cmd, ...) the manylinux image leaves out.
           before-script-linux: |
-            command -v cmake >/dev/null 2>&1 || apk add --no-cache cmake gcc g++ make musl-dev perl
+            if command -v apk >/dev/null 2>&1; then
+              command -v cmake >/dev/null 2>&1 || apk add --no-cache cmake gcc g++ make musl-dev perl
+            elif command -v yum >/dev/null 2>&1; then
+              yum install -y perl-core || yum install -y perl perl-IPC-Cmd
+            fi
 
       - name: Upload wheels
         uses: actions/upload-artifact@v7
@@ -256,7 +263,7 @@ jobs:
     # Direct runs only. Publishing from here under release.yml authenticates
     # (PyPI matches the reusable workflow) but the attestation is signed with the
     # *caller's* identity, which PyPI then rejects. release.yml uploads instead.
-    if: ${{ !inputs.skip_publish }}
+    if: ${{ !inputs.skip_publish && inputs.target != 'build-only' }}
     runs-on: ubuntu-latest
     needs: [build-wheels, build-sdists]
     permissions:

{mq_bridge_basic-0.4.20 → mq_bridge_basic-1.0.1}/.github/workflows/release.yml

@@ -451,6 +451,10 @@ jobs:
     name: Build CLI asset for ${{ matrix.target }}
     needs: [metadata, release]
     runs-on: ${{ matrix.os }}
+    # Asset builds must not fail on warnings: MSVC emits LNK4099 for the vendored
+    # OpenSSL objects. Presetting this stops setup-rust-toolchain from denying them.
+    env:
+      CARGO_BUILD_WARNINGS: warn
     permissions:
       contents: write
     strategy:
@@ -496,9 +500,13 @@ jobs:
         if: runner.os == 'Linux'
         run: sudo apt-get update && sudo apt-get install -y libssl-dev pkg-config zlib1g-dev cmake libcurl4-openssl-dev protobuf-compiler
 
+      # `kafka-ssl` builds OpenSSL with perl. The bash build step would pick Git's
+      # perl, which lacks the modules; pin the Strawberry perl this shell resolves.
       - name: Install dependencies (Windows)
         if: runner.os == 'Windows'
-        run: choco install protoc --no-progress -y
+        run: |
+          choco install protoc --no-progress -y
+          "OPENSSL_SRC_PERL=$((Get-Command perl).Source)" >> $env:GITHUB_ENV
 
       - name: Install dependencies (macOS)
         if: runner.os == 'macOS'
@@ -541,6 +549,110 @@ jobs:
           tag_name: ${{ needs.metadata.outputs.release_tag }}
           files: ${{ env.ASSET_PATH }}
 
+  # The C library has no ABI stability, so each archive carries the header that
+  # matches its library. Shared library only: a `full` static archive is huge and
+  # needs a per-target native link line.
+  build-c-library:
+    name: Build C library asset for ${{ matrix.target }}
+    needs: [metadata, release]
+    runs-on: ${{ matrix.os }}
+    # Same LNK4099 reason as build-release.
+    env:
+      CARGO_BUILD_WARNINGS: warn
+    permissions:
+      contents: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # Same runners as the CLI assets, so both share one glibc floor.
+          - os: ubuntu-22.04
+            target: x86_64-unknown-linux-gnu
+          - os: macos-latest
+            target: aarch64-apple-darwin
+          - os: windows-2022
+            target: x86_64-pc-windows-msvc
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.tag_name || github.ref }}
+
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v2
+        with:
+          toolchain: stable
+          target: ${{ matrix.target }}
+
+      - name: Install dependencies (Linux)
+        if: runner.os == 'Linux'
+        run: sudo apt-get update && sudo apt-get install -y libssl-dev pkg-config zlib1g-dev cmake libcurl4-openssl-dev protobuf-compiler
+
+      # `kafka-ssl` builds OpenSSL with perl. The bash build step would pick Git's
+      # perl, which lacks the modules; pin the Strawberry perl this shell resolves.
+      - name: Install dependencies (Windows)
+        if: runner.os == 'Windows'
+        run: |
+          choco install protoc --no-progress -y
+          "OPENSSL_SRC_PERL=$((Get-Command perl).Source)" >> $env:GITHUB_ENV
+
+      - name: Install dependencies (macOS)
+        if: runner.os == 'macOS'
+        run: brew install cmake pkg-config openssl@3 protobuf
+
+      # `cargo rustc --crate-type` skips the static library the manifest also declares.
+      - name: Build shared library (full)
+        shell: bash
+        run: cargo rustc -p mq-bridge-c --release --target ${{ matrix.target }} --crate-type cdylib
+
+      - name: Package artifacts
+        shell: bash
+        run: |
+          ASSET_NAME="mq-bridge-c-${{ matrix.target }}"
+          OUT="target/${{ matrix.target }}/release"
+          mkdir -p staging/lib staging/include
+          case "$RUNNER_OS" in
+            Windows) cp "$OUT/mq_bridge.dll" "$OUT/mq_bridge.dll.lib" staging/lib/ ;;
+            macOS)
+              cp "$OUT/libmq_bridge.dylib" staging/lib/
+              # Pin the install name so programs find the library through their rpath.
+              install_name_tool -id @rpath/libmq_bridge.dylib staging/lib/libmq_bridge.dylib
+              codesign --force --sign - staging/lib/libmq_bridge.dylib
+              ;;
+            *) cp "$OUT/libmq_bridge.so" staging/lib/ ;;
+          esac
+          cp include/*.h staging/include/
+          cp LICENSE LICENSE-MIT LICENSE-APACHE staging/
+          cp c/mq-bridge-c/README.md staging/README.md
+          cp c/mq-bridge-c/THIRD_PARTY_LICENSES.txt staging/
+          if [ "$RUNNER_OS" == "Windows" ]; then
+            7z a "${ASSET_NAME}.zip" ./staging/*
+            echo "ASSET_PATH=${ASSET_NAME}.zip" >> "$GITHUB_ENV"
+          else
+            tar -czf "${ASSET_NAME}.tar.gz" -C staging .
+            echo "ASSET_PATH=${ASSET_NAME}.tar.gz" >> "$GITHUB_ENV"
+          fi
+
+      # CI only links the `--no-default-features` build; this is the one place a C
+      # program meets the `full` library, and it uses the archive as a user would.
+      - name: Smoke test the archive
+        if: runner.os != 'Windows'
+        shell: bash
+        run: |
+          mkdir unpacked
+          tar -xzf "$ASSET_PATH" -C unpacked
+          cc -std=c11 -I unpacked/include examples/c-library/smoke.c \
+            -L unpacked/lib -lmq_bridge "-Wl,-rpath,$PWD/unpacked/lib" -o smoke
+          if [ "$RUNNER_OS" == "macOS" ]; then otool -L unpacked/lib/libmq_bridge.dylib; else ldd unpacked/lib/libmq_bridge.so; fi
+          ./smoke "$RUNNER_TEMP" | tee smoke.log
+          grep -q "smoke test passed" smoke.log
+
+      - name: Upload Release Asset
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
+        with:
+          tag_name: ${{ needs.metadata.outputs.release_tag }}
+          files: ${{ env.ASSET_PATH }}
+
   build-linux-amd64:
     name: Build docker linux/amd64
     needs: [metadata, preflight, test, app-checks, package-dry-run]
@@ -833,6 +945,7 @@ jobs:
     needs:
       - metadata
       - build-release
+      - build-c-library
       - build-linux-arm64-asset
       - build-tauri-release
       - publish-manifest