Enforce RFC 0020 two-phase release workflow

.github/actions/install-yq/action.yaml

@@ -0,0 +1,18 @@
+name: Install yq
+description: Install mikefarah/yq at a pinned version
+
+inputs:
+  version:
+    description: "yq version to install"
+    required: false
+    default: "4.53.3"
+
+runs:
+  using: composite
+  steps:
+    - name: Install yq v${{ inputs.version }}
+      shell: bash
+      run: |
+        sudo wget -qO /usr/local/bin/yq \
+          "https://github.com/mikefarah/yq/releases/download/v${{ inputs.version }}/yq_linux_amd64"
+        sudo chmod +x /usr/local/bin/yq

.github/actions/prepare-release/action.yaml

@@ -5,10 +5,6 @@ inputs:
   version:
     description: 'WASM Shim version (semver, e.g., 0.12.1)'
     required: true
-  push-branch:
-    description: 'Whether to push the base branch immediately if it does not exist'
-    required: false
-    default: 'false'
   github-token:
     description: 'GitHub token for protoc setup'
     required: true
@@ -17,9 +13,6 @@ outputs:
   wasm-shim-version:
     description: 'The validated WASM Shim version'
     value: ${{ steps.validate.outputs.version }}
-  base-branch:
-    description: 'The base release branch name'
-    value: ${{ steps.create-branch.outputs.base-branch }}
 
 runs:
   using: 'composite'
@@ -36,35 +29,27 @@ runs:
         echo "WASM_SHIM_VERSION=$VERSION" >> $GITHUB_ENV
         echo "version=$VERSION" >> $GITHUB_OUTPUT
 
-    - name: Create release branch
-      id: create-branch
-      shell: bash
-      run: |
-        base_branch=release-$(echo "$WASM_SHIM_VERSION" | sed 's/[+-].*//; s/\.[0-9]*$//')
-        echo "BASE_BRANCH=$base_branch" >> $GITHUB_ENV
-        echo "base-branch=$base_branch" >> $GITHUB_OUTPUT
+    - name: Set up Rust and WASM environment
+      uses: ./.github/actions/setup-rust-wasm
+      with:
+        github-token: ${{ inputs.github-token }}
 
-        if git ls-remote --exit-code --heads origin "$base_branch" ; then
-          echo "Base branch $base_branch already exists"
-        else
-          echo "Creating branch $base_branch"
-          git checkout -b "$base_branch"
-          if [ "${{ inputs.push-branch }}" = "true" ]; then
-            echo "Pushing branch $base_branch to origin"
-            git push --set-upstream origin "$base_branch"
-          fi
-        fi
+    - shell: bash
+      run: cargo install cargo-edit --version 0.13.13
 
     - name: Update Cargo.toml version
       shell: bash
       run: |
-        sed -i '0,/^version = ".*"/s//version = "'"$WASM_SHIM_VERSION"'"/' Cargo.toml
-
-    - name: Set up Rust and WASM environment
-      uses: ./.github/actions/setup-rust-wasm
-      with:
-        github-token: ${{ inputs.github-token }}
+        cargo set-version --offline -p wasm-shim "$WASM_SHIM_VERSION"
 
     - name: Update Cargo.lock
       shell: bash
       run: cargo check --target wasm32-wasip1
+
+    - uses: ./.github/actions/install-yq
+
+    - name: Sync release.yaml from Cargo.toml
+      shell: bash
+      run: |
+        chmod +x .github/scripts/sync-release-yaml.sh
+        .github/scripts/sync-release-yaml.sh

.github/actions/setup-rust-wasm/action.yaml

@@ -31,3 +31,7 @@ runs:
         elif [ "$RUNNER_OS" == "macOS" ]; then
           brew install protobuf
         fi
+
+    - name: Fetch crate sources and registry index entries
+      shell: bash
+      run: cargo fetch --locked

.github/scripts/README.md

@@ -0,0 +1,57 @@
+# Release Scripts
+
+Helper scripts for the two-phase release process. All scripts use `release.yaml` as the default path but accept an override as the first positional argument.
+
+## Source of Truth
+
+**`Cargo.toml` is the authoritative source for the wasm-shim version.** `release.yaml` is a derived mirror maintained by `sync-release-yaml.sh` for cross-repo tooling compatibility.
+
+## Scripts
+
+### `sync-release-yaml.sh`
+
+Reads the wasm-shim version from `cargo metadata` and writes it to `release.yaml`. If the Cargo.toml version contains `-dev`, the sentinel value `0.0.0` is written instead.
+
+```bash
+.github/scripts/sync-release-yaml.sh [release.yaml]
+```
+
+**Requires:** `cargo`, `jq`, `yq`
+
+### `check-versions.sh`
+
+Validates that `release.yaml` and `Cargo.toml` are consistent:
+
+- If `release.yaml` has `0.0.0` (sentinel), `Cargo.toml` must end in `-dev`
+- Otherwise, both must match exactly
+
+```bash
+.github/scripts/check-versions.sh [release.yaml]
+```
+
+**Requires:** `cargo`, `jq`, `yq`
+
+### `parse-version.sh`
+
+Reads the version from `release.yaml`, validates it as semver, and outputs decomposed components to `$GITHUB_OUTPUT` (or stdout when run locally).
+
+```bash
+.github/scripts/parse-version.sh [release.yaml]
+```
+
+**Outputs:** `version`, `major`, `minor`, `patch`, `release-branch`
+
+**Requires:** `yq`
+
+### `validate-release-yaml.sh`
+
+Validates `release.yaml` for release readiness:
+
+- On `release-*` branches: rejects `0.0.0` sentinel and `-dev` versions
+- Checks that declared dependency versions have corresponding GitHub Releases
+
+```bash
+.github/scripts/validate-release-yaml.sh <branch-name> [org] [release.yaml]
+```
+
+**Requires:** `yq`, `gh` (GitHub CLI)

.github/scripts/check-versions.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+RELEASE_YAML="${1:-release.yaml}"
+
+if [[ ! -f "$RELEASE_YAML" ]]; then
+  echo "::error::File not found: $RELEASE_YAML"
+  exit 1
+fi
+
+YAML_VERSION=$(yq '.wasm-shim.version' "$RELEASE_YAML")
+CARGO_VERSION=$(cargo metadata --no-deps --format-version 1 \
+  | jq -r '.packages[] | select(.name=="wasm-shim") | .version')
+
+ERRORS=0
+
+if [[ "$YAML_VERSION" == "0.0.0" ]]; then
+  if [[ "$CARGO_VERSION" != *-dev* ]]; then
+    echo "::error::release.yaml version is 0.0.0 but Cargo.toml version '${CARGO_VERSION}' does not end in -dev"
+    ERRORS=$((ERRORS + 1))
+  fi
+else
+  if [[ "$YAML_VERSION" != "$CARGO_VERSION" ]]; then
+    echo "::error::Version mismatch: release.yaml has '${YAML_VERSION}' but Cargo.toml has '${CARGO_VERSION}'"
+    ERRORS=$((ERRORS + 1))
+  fi
+fi
+
+if [[ "$ERRORS" -gt 0 ]]; then
+  echo "::error::Version consistency check failed with ${ERRORS} error(s)"
+  exit 1
+fi
+
+echo "Version consistency check passed: release.yaml and Cargo.toml agree"
+echo "  release.yaml=${YAML_VERSION} Cargo.toml=${CARGO_VERSION}"

.github/scripts/parse-version.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+RELEASE_YAML="${1:-release.yaml}"
+
+if [[ ! -f "$RELEASE_YAML" ]]; then
+  echo "::error::File not found: $RELEASE_YAML"
+  exit 1
+fi
+
+VERSION=$(yq '.wasm-shim.version' "$RELEASE_YAML")
+if [[ -z "$VERSION" || "$VERSION" == "null" ]]; then
+  echo "::error::No version found in $RELEASE_YAML under wasm-shim.version"
+  exit 1
+fi
+
+if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$ ]]; then
+  echo "::error::Invalid semver for version: $VERSION"
+  exit 1
+fi
+
+MAJOR=$(echo "$VERSION" | cut --delimiter=. --fields=1)
+MINOR=$(echo "$VERSION" | cut --delimiter=. --fields=2)
+PATCH=$(echo "$VERSION" | cut --delimiter=. --fields=3 | cut --delimiter=- --fields=1)
+RELEASE_BRANCH="release-${MAJOR}.${MINOR}"
+
+echo "version=$VERSION" >> "${GITHUB_OUTPUT:-/dev/stdout}"
+echo "major=$MAJOR" >> "${GITHUB_OUTPUT:-/dev/stdout}"
+echo "minor=$MINOR" >> "${GITHUB_OUTPUT:-/dev/stdout}"
+echo "patch=$PATCH" >> "${GITHUB_OUTPUT:-/dev/stdout}"
+echo "release-branch=$RELEASE_BRANCH" >> "${GITHUB_OUTPUT:-/dev/stdout}"

.github/scripts/sync-release-yaml.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+RELEASE_YAML="${1:-release.yaml}"
+
+VERSION=$(cargo metadata --no-deps --format-version 1 \
+  | jq -r '.packages[] | select(.name=="wasm-shim") | .version')
+
+if [[ -z "$VERSION" || "$VERSION" == "null" ]]; then
+  echo "::error::Could not read wasm-shim version from cargo metadata"
+  exit 1
+fi
+
+# On main, Cargo.toml has -dev versions but release.yaml uses 0.0.0 sentinel.
+# Strip -dev suffix: if present, write 0.0.0 instead.
+if [[ "$VERSION" == *-dev* ]]; then
+  VERSION="0.0.0"
+fi
+
+yq --inplace ".\"wasm-shim\".version = \"${VERSION}\"" "$RELEASE_YAML"
+
+echo "release.yaml synced: version=${VERSION}"

.github/scripts/validate-release-yaml.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+BRANCH="${1:?Branch name required}"
+ORG="${2:-Kuadrant}"
+RELEASE_YAML="${3:-release.yaml}"
+
+if [[ ! -f "$RELEASE_YAML" ]]; then
+  echo "::error::File not found: $RELEASE_YAML"
+  exit 1
+fi
+
+VERSION=$(yq '.wasm-shim.version' "$RELEASE_YAML")
+
+if [[ "$BRANCH" =~ ^release- ]]; then
+  if [[ "$VERSION" == "0.0.0" ]]; then
+    echo "::error::release.yaml version is 0.0.0 on branch '$BRANCH' -- must specify a release version on release branches"
+    exit 1
+  fi
+
+  if [[ "$VERSION" == *-dev* ]]; then
+    echo "::error::release.yaml version '${VERSION}' is a dev version on branch '$BRANCH' -- release versions must not contain '-dev'"
+    exit 1
+  fi
+fi
+
+DEPS=$(yq '.dependencies | keys | .[]' "$RELEASE_YAML" 2>/dev/null || true)
+for dep in $DEPS; do
+  dep_version=$(yq ".dependencies.${dep}" "$RELEASE_YAML")
+  if [[ "$dep_version" != "0.0.0" && "$dep_version" != "null" && -n "$dep_version" ]]; then
+    if ! gh release view "v${dep_version}" --repo "${ORG}/${dep}" &>/dev/null; then
+      echo "::error::Dependency '${dep}' targets version '${dep_version}', but release v${dep_version} does not exist in ${ORG}/${dep}"
+      exit 1
+    fi
+  fi
+done
+
+echo "release.yaml validation passed"