Release 0.5.44

.github/workflows/ci.yml

@@ -287,6 +287,16 @@ jobs:
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
     steps:
+      # Every test binary of the debug build links the whole engine, which
+      # nearly fills an ubuntu runner's disk: remove preinstalled SDKs that
+      # this job does not use.
+      - name: Free disk space
+        if: runner.os == 'Linux'
+        run: |
+          df -h /
+          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL
+          df -h /
+
       - uses: actions/checkout@v7
 
       - name: Install Rust toolchain
@@ -298,31 +308,38 @@ jobs:
       - name: Configure sccache
         uses: mozilla-actions/sccache-action@v0.0.11
 
+      # Crate sources only: archiving this job's target directory filled the
+      # runner's disk, and sccache keeps the compiled crates between runs.
       - name: Cache cargo registry
         uses: actions/cache@v6
         with:
           path: |
             ~/.cargo/registry
             ~/.cargo/git
-            target
-          key: ${{ runner.os }}-cargo-test-${{ hashFiles('**/Cargo.lock') }}
+          key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: |
-            ${{ runner.os }}-cargo-test-
+            ${{ runner.os }}-cargo-registry-
 
       # Full profile: --all-features tests every language parser, AI index,
       # RDF store, algorithms, CDC, and other optional modules together.
       # This catches integration issues across feature combinations.
       # Spec tests are excluded here as they run in the dedicated rust-spec job.
+      # Line tables keep file and line in backtraces at a fraction of the size
+      # of full debug info.
       - name: Run tests
         run: cargo nextest run --all-features --workspace --exclude grafeo-spec-tests
         env:
           RUSTC_WRAPPER: sccache
+          SCCACHE_GHA_ENABLED: "true"
+          CARGO_PROFILE_DEV_DEBUG: line-tables-only
 
       # nextest does not run doc-tests, so run them separately
       - name: Run doc-tests
         run: cargo test --all-features --workspace --doc
         env:
           RUSTC_WRAPPER: sccache
+          SCCACHE_GHA_ENABLED: "true"
+          CARGO_PROFILE_DEV_DEBUG: line-tables-only
 
   # Rust tests (release, ubuntu only)
   # Release-mode catches issues from inlining and overflow checks.
@@ -386,6 +403,8 @@ jobs:
           - profile: rdf
             features: "--features gql,sparql,graphql,triple-store,spill,mmap,regex"
             engine_features: "--features gql,sparql,graphql,triple-store,shacl,wal,grafeo-file,spill,mmap,regex"
+            # The facade's `rdf` profile on its own keeps its data across a reopen (#544).
+            facade_test: "--features rdf --test rdf_profile"
           # Analytics persona: Data Scientist (algorithms + search + bulk import)
           - profile: analytics
             features: "--features algos,vector-index,text-index,hybrid-search,jsonl-import,parquet-import"
@@ -456,6 +475,17 @@ jobs:
         env:
           RUSTC_WRAPPER: sccache
 
+      # A facade test built with only the profile's features, for profiles
+      # whose behavior depends on what the profile itself enables.
+      - name: Test facade profile (${{ matrix.profile }})
+        if: matrix.facade_test
+        run: >
+          cargo test
+          -p grafeo
+          --no-default-features ${{ matrix.facade_test }}
+        env:
+          RUSTC_WRAPPER: sccache
+
   # Miri undefined behavior check
   miri:
     name: Miri UB Check

.github/workflows/release.yml

@@ -194,7 +194,6 @@ jobs:
         uses: softprops/action-gh-release@v3
         with:
           files: ./checksums.txt
-        continue-on-error: true
 
   # Publish crates to crates.io (in dependency order)
   publish-crates:
@@ -350,6 +349,10 @@ jobs:
     name: Publish to npm
     runs-on: ubuntu-latest
     needs: [create-release, build-node-native]
+    environment: npm
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v7
 
@@ -381,30 +384,31 @@ jobs:
           echo "=== Platform packages ==="
           find npm -name '*.node' -ls
 
+      - name: Update npm (trusted publishing needs 11.5.1 or later)
+        run: npm install -g npm@^11.5.1
+
       - name: Publish platform packages
         working-directory: crates/bindings/node
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           for dir in npm/*/; do
             if ls "$dir"*.node 1>/dev/null 2>&1; then
-              echo "Publishing $(basename "$dir")..."
-              (cd "$dir" && npm publish --access public) || true
+              (cd "$dir" && bash "$GITHUB_WORKSPACE/scripts/npm-publish.sh")
             fi
           done
 
       - name: Publish @grafeo-db/js
         working-directory: crates/bindings/node
-        run: npm publish --access public --ignore-scripts
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        continue-on-error: true
+        run: bash "$GITHUB_WORKSPACE/scripts/npm-publish.sh" --ignore-scripts
 
   # Publish WASM package to npm
   publish-wasm:
     name: Publish WASM to npm
     runs-on: ubuntu-latest
     needs: create-release
+    environment: npm
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v7
 
@@ -431,18 +435,22 @@ jobs:
           # Copy our maintained package.json over the generated one.
           cp crates/bindings/wasm/package.json crates/bindings/wasm/pkg/package.json
 
+      - name: Update npm (trusted publishing needs 11.5.1 or later)
+        run: npm install -g npm@^11.5.1
+
       - name: Publish @grafeo-db/wasm
         working-directory: crates/bindings/wasm/pkg
-        run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        continue-on-error: true
+        run: bash "$GITHUB_WORKSPACE/scripts/npm-publish.sh"
 
   # Publish WASM lite package to npm
   publish-wasm-lite:
     name: Publish WASM Lite to npm
     runs-on: ubuntu-latest
     needs: create-release
+    environment: npm
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v7
 
@@ -466,18 +474,22 @@ jobs:
       - name: Fix WASM lite package metadata
         run: cp crates/bindings/wasm/package-lite.json crates/bindings/wasm/pkg-lite/package.json
 
+      - name: Update npm (trusted publishing needs 11.5.1 or later)
+        run: npm install -g npm@^11.5.1
+
       - name: Publish @grafeo-db/wasm-lite
         working-directory: crates/bindings/wasm/pkg-lite
-        run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        continue-on-error: true
+        run: bash "$GITHUB_WORKSPACE/scripts/npm-publish.sh"
 
   # Publish CLI npm wrapper packages
   publish-cli-npm:
     name: Publish CLI to npm
     runs-on: ubuntu-latest
     needs: build-binaries
+    environment: npm
+    permissions:
+      contents: read
+      id-token: write
     strategy:
       fail-fast: false
       matrix:
@@ -544,18 +556,22 @@ jobs:
           chmod +x ${{ matrix.binary }} 2>/dev/null || true
           ls -la
 
+      - name: Update npm (trusted publishing needs 11.5.1 or later)
+        run: npm install -g npm@^11.5.1
+
       - name: Publish platform package
         working-directory: platform-pkg
-        run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        continue-on-error: true
+        run: bash "$GITHUB_WORKSPACE/scripts/npm-publish.sh"
 
   # Publish main CLI npm launcher (after platform packages)
   publish-cli-npm-launcher:
     name: Publish @grafeo-db/cli
     runs-on: ubuntu-latest
     needs: publish-cli-npm
+    environment: npm
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v7
 
@@ -565,12 +581,12 @@ jobs:
           node-version: '24'
           registry-url: 'https://registry.npmjs.org'
 
+      - name: Update npm (trusted publishing needs 11.5.1 or later)
+        run: npm install -g npm@^11.5.1
+
       - name: Publish launcher package
         working-directory: packages/grafeo-cli-npm
-        run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        continue-on-error: true
+        run: bash "$GITHUB_WORKSPACE/scripts/npm-publish.sh"
 
   # Publish C# bindings to NuGet
   publish-nuget:
@@ -608,8 +624,7 @@ jobs:
         run: dotnet pack -c Release -o ../../nupkg
 
       - name: Publish to NuGet
-        run: dotnet nuget push "crates/bindings/csharp/nupkg/*.nupkg" --api-key ${{ secrets.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json
-        continue-on-error: true
+        run: dotnet nuget push "crates/bindings/csharp/nupkg/*.nupkg" --api-key ${{ secrets.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json --skip-duplicate
 
   # Build CLI Python wheels using workflow artifacts (no release asset race)
   build-cli-wheels:
@@ -700,7 +715,7 @@ jobs:
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
           packages-dir: dist/
-        continue-on-error: true
+          skip-existing: true
 
   # Notify Discord about the new release
   notify-discord: