Release: promote releases/r10.0-develop to releases/r10.0 (first production deploy)

.dockerignore

@@ -13,7 +13,7 @@
 **/*.jfm
 **/azds.yaml
 **/bin
-**/charts
+charts
 **/docker-compose*
 **/Dockerfile*
 **/node_modules

.github/workflows/cli-release.yml

@@ -0,0 +1,143 @@
+name: bitween CLI release
+
+# Publishes the bitween command as self-contained binaries on a GitHub release: nothing needs .NET
+# installed to run them. Never run by hand or by a tag: the CI run that publishes this repository
+# calls it with the version it computed (determine-semver: the next patch from the git tags), so the
+# CLI carries the version of the release it ships with. The computed version is the bare x.y.z on
+# develop too, so a develop build says so with prerelease and passes its run number.
+#   a release, 10.0.61                                  cli-v10.0.61          the latest release
+#   a prerelease, 10.0.61 with prerelease and run 121   cli-v10.0.61-dev.121  a pre-release, to try out
+# Called by bitween-api-cicd-gateway.yml: after the release from releases/r10.0, and after each develop build.
+on:
+  workflow_call:
+    inputs:
+      version:
+        description: "The version the calling run computed"
+        type: string
+        required: true
+      prerelease:
+        description: "Release as a pre-release, named after the run"
+        type: boolean
+        default: false
+      run-number:
+        description: "The calling run's number, for a pre-release"
+        type: string
+        default: ""
+
+permissions:
+  contents: write
+
+jobs:
+  channel:
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.channel.outputs.version }}
+      prerelease: ${{ steps.channel.outputs.prerelease }}
+    steps:
+      - name: Channel
+        id: channel
+        env:
+          VERSION: ${{ inputs.version }}
+          PRERELEASE: ${{ inputs.prerelease }}
+          RUN_NUMBER: ${{ inputs.run-number }}
+        run: |
+          v="$VERSION"
+          if [ "$PRERELEASE" = "true" ]; then
+            # A pre-release names its run: 10.0.61 from run 121 is 10.0.61-dev.121.
+            v="${v%%-*}-dev.${RUN_NUMBER:-${GITHUB_RUN_NUMBER}}"
+            echo "prerelease=true" >> "$GITHUB_OUTPUT"
+          elif [[ "$v" == *-* ]]; then
+            # A version that already carries its branch and run: 10.0.61-releases-r10-0-develop.121 is 10.0.61-dev.121.
+            v="${v%%-*}-dev.${v##*.}"
+            echo "prerelease=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "prerelease=false" >> "$GITHUB_OUTPUT"
+          fi
+          echo "version=$v" >> "$GITHUB_OUTPUT"
+
+  build:
+    needs: channel
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        rid: [linux-x64, linux-arm64, linux-musl-x64, linux-musl-arm64, osx-x64, osx-arm64, win-x64]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.0.x"
+      - name: Publish
+        run: >
+          dotnet publish SW.Bitween.Cli -c Release -r ${{ matrix.rid }} --self-contained
+          -p:PublishSingleFile=true -p:IncludeNativeLibrariesForSelfExtract=true -p:DebugType=none
+          -p:Version=${{ needs.channel.outputs.version }} -o out
+      - name: Package
+        run: |
+          mkdir -p dist
+          cp docs/cli.md out/README.md 2>/dev/null || true
+          if [[ "${{ matrix.rid }}" == win-* ]]; then
+            (cd out && zip -q -r ../dist/bitween-${{ matrix.rid }}.zip .)
+          else
+            tar -czf dist/bitween-${{ matrix.rid }}.tar.gz -C out .
+          fi
+      - uses: actions/upload-artifact@v4
+        with:
+          name: bitween-${{ matrix.rid }}
+          path: dist/*
+
+  # The data source providers (RabbitMQ, SQS and the database engines) as adapter packages, with the
+  # release's version: installed like any adapter, with bitween adapter publish or apply's adapters
+  # section. Nothing else publishes them, and a Bitween runs no data source without them.
+  providers:
+    needs: channel
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.0.x"
+      - name: Build
+        env:
+          VERSION: ${{ needs.channel.outputs.version }}
+        run: |
+          dotnet build SW.Bitween.Cli -c Release -o cli
+          mkdir -p dist
+          for project in SW.Bitween.Adapters.Bus.RabbitMq SW.Bitween.Adapters.Bus.Sqs SW.Bitween.Adapters.Db.PostgreSql \
+                         SW.Bitween.Adapters.Db.MySql SW.Bitween.Adapters.Db.SqlServer SW.Bitween.Adapters.Db.Oracle; do
+            jq --arg v "$VERSION" '.version = $v' "$project/adapter.json" > adapter.json.tmp && mv adapter.json.tmp "$project/adapter.json"
+            dotnet cli/bitween.dll adapter build "$project" -o dist
+          done
+          ls -la dist
+      - uses: actions/upload-artifact@v4
+        with:
+          name: bitween-providers
+          path: dist/*.zip
+
+  release:
+    needs: [channel, build, providers]
+    runs-on: ubuntu-latest
+    steps:
+      # Only the CLI builds' own artifacts. Without a pattern this fetched every artifact in the run,
+      # including the build record docker/build-push-action uploads in the deploy job, which can't be
+      # extracted and failed the release (and would have landed in SHA256SUMS if it could).
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: bitween-*
+          path: dist
+          merge-multiple: true
+      - name: Checksums
+        run: cd dist && sha256sum * > SHA256SUMS && cat SHA256SUMS
+      - name: Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          v="${{ needs.channel.outputs.version }}"
+          install="curl -fsSL https://raw.githubusercontent.com/${{ github.repository }}/releases/r10.0/scripts/install-cli.sh"
+          if [ "${{ needs.channel.outputs.prerelease }}" = "true" ]; then
+            gh release create "cli-v$v" dist/* --title "bitween CLI $v (pre-release)" --target "${{ github.sha }}" --prerelease \
+              --notes "A pre-release of the bitween command, built from ${{ github.ref_name }}, to try out. Install: $install | BITWEEN_CLI_VERSION=$v sh - or download the archive for your platform and check it against SHA256SUMS."
+          else
+            gh release create "cli-v$v" dist/* --title "bitween CLI $v" --target "${{ github.sha }}" --latest \
+              --notes "The bitween command, self-contained for each platform. Install: $install | sh - or download the archive for your platform and check it against SHA256SUMS."
+          fi

.github/workflows/critical-vuln-check.yml

@@ -1,19 +1,19 @@
 # =============================================================================
-# Critical Dependabot Vulnerability Check — Caller template
+# Critical Dependabot Vulnerability Check - Caller template
 # =============================================================================
 # USAGE:
 #   Copy this file to your repo at .github/workflows/critical-vuln-check.yml.
-#   No REPLACE values needed — this template requires no customization.
+#   No REPLACE values needed - this template requires no customization.
 #
 # WHAT IT DOES:
 #   Runs on every PR targeting main or develop. Fails if the repository has
 #   any open CRITICAL-severity Dependabot alert.
 #
 #   Enforcement differs by target branch via each repo's OWN branch
 #   protection settings (not by anything in this file):
-#     - On `main`:    mark this check REQUIRED in branch protection — merge
+#     - On `main`:    mark this check REQUIRED in branch protection - merge
 #                     is physically blocked while a critical alert is open.
-#     - On `develop`: leave this check NOT required — it still shows as a
+#     - On `develop`: leave this check NOT required - it still shows as a
 #                     failing/red check (a visible warning) without blocking
 #                     the merge.
 # =============================================================================

.github/workflows/dependabot-auto-merge.yml

@@ -1,5 +1,5 @@
 # =============================================================================
-# Dependabot Auto-Merge — Caller template
+# Dependabot Auto-Merge - Caller template
 # =============================================================================
 # USAGE:
 #   Copy this file to your repo at .github/workflows/dependabot-auto-merge.yml.
@@ -10,13 +10,13 @@
 #     - The PR author is dependabot[bot]
 #     - The update is a semver PATCH bump (never minor/major)
 #     - The ecosystem is npm, nuget, pub, bundler, or github-actions
-#       (NEVER docker — base image bumps always need manual review)
+#       (NEVER docker - base image bumps always need manual review)
 #     - This repo currently has no open critical Dependabot alert (re-checked
-#       here explicitly — see workflow-templates/critical-vuln-check.yml's
+#       here explicitly - see workflow-templates/critical-vuln-check.yml's
 #       header for why this can't just `needs:` that file's job)
 #   "Auto-merge" here means GitHub's native auto-merge feature: it still
 #   waits for the repo's actual required status checks (build/test) to pass
-#   before merging — this workflow does not bypass those.
+#   before merging - this workflow does not bypass those.
 # =============================================================================
 name: Dependabot Auto-Merge
 
@@ -64,5 +64,5 @@ jobs:
           PR_URL: ${{ github.event.pull_request.html_url }}
         run: |
           set -euo pipefail
-          echo "::notice title=🤖 [AUTO-MERGE] Enabling auto-merge::${PR_URL} — patch-level ${{ steps.metadata.outputs.package-ecosystem }} bump, vuln gate passed"
+          echo "::notice title=🤖 [AUTO-MERGE] Enabling auto-merge::${PR_URL} - patch-level ${{ steps.metadata.outputs.package-ecosystem }} bump, vuln gate passed"
           gh pr merge --auto --squash "$PR_URL"

.github/workflows/dotnet-pr-checks.yml

@@ -0,0 +1,50 @@
+# Builds the solution and runs the .NET unit tests on every pull request into a release branch.
+#
+# The deploy pipeline runs the .NET tests only after a merge, so a change that broke them was
+# found once it had already landed on a release branch. Bitween runs at customer sites that
+# upgrade in place, so this check runs before the merge instead. The unit tests need no
+# database or broker and take seconds. The integration tests (Testcontainers) still run in the
+# deploy pipeline.
+name: .NET checks
+
+on:
+  pull_request:
+    branches: [releases/**]
+    paths-ignore:
+      # Covered by frontend-tests.yml; the .NET build does not compile the SPA.
+      - 'SW.Bitween.Web/ClientApp/**'
+      - 'docs/**'
+      - '**/*.md'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: dotnet-pr-checks-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  build-and-unit-test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      # Pinned to commits, since a tag can be moved.
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
+        with:
+          dotnet-version: '10.0.x'
+      - run: dotnet restore SW.Bitween.sln
+      # SkipClientBuild keeps MSBuild from building the SPA should any target pull in publish.
+      - run: dotnet build SW.Bitween.sln --no-restore --configuration Release -p:SkipClientBuild=true
+      - run: >
+          dotnet test SW.Bitween.UnitTests/SW.Bitween.UnitTests.csproj
+          --no-build --configuration Release
+          --logger "trx;LogFileName=unit-tests.trx"
+          --results-directory TestResults
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        if: failure()
+        with:
+          name: unit-test-results
+          path: TestResults

.github/workflows/frontend-tests.yml

@@ -3,7 +3,7 @@
 #
 # The deploy pipeline only runs the .NET test projects, and only after a merge, so until
 # this existed nothing ever ran the frontend tests outside someone's machine. These need
-# no backend or database — the component tests render pages against a mock network — so
+# no backend or database - the component tests render pages against a mock network - so
 # they take seconds. The Playwright e2e suite is not run here: it needs a running backend
 # with seeded data.
 name: Frontend tests
@@ -40,7 +40,7 @@ jobs:
           cache: yarn
           cache-dependency-path: SW.Bitween.Web/ClientApp/yarn.lock
       - run: yarn install --frozen-lockfile
-      # The same type-check the Docker build runs, which covers the tests too — so a test file
+      # The same type-check the Docker build runs, which covers the tests too - so a test file
       # that breaks it fails here rather than in the deploy after the merge.
       - run: npx tsc -b
       - run: yarn test

.github/workflows/sdk-release.yml

@@ -0,0 +1,95 @@
+name: SDK release
+
+# Publishes the adapter contract for Python to PyPI as simplyworks-bitween and for JavaScript and
+# TypeScript to npm as @simplyworks/bitween. Never run by hand or by a tag: the release run on
+# releases/r10.0 (bitween-api-cicd-gateway.yml) calls it with the version it computed, so they carry
+# Bitween's version. Only a release version is published. Each is tested first against
+# SW-Serverless's SDK from its default branch, and a version already on its registry is left alone,
+# so a failed run can simply be run again.
+on:
+  workflow_call:
+    inputs:
+      version:
+        description: "The version the calling run computed"
+        type: string
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  python:
+    if: ${{ !contains(inputs.version, '-') }}
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: sdk/python
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4
+        with:
+          repository: simplify9/SW-Serverless
+          path: sw-serverless
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Version
+        id: version
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          v="$VERSION"
+          sed -i -E "s/^version = \".*\"/version = \"$v\"/" pyproject.toml
+          sed -i -E "s/^__version__ = \".*\"/__version__ = \"$v\"/" src/simplyworks_bitween/__init__.py
+          echo "value=$v" >> "$GITHUB_OUTPUT"
+      - name: Test
+        run: PYTHONPATH="src:$GITHUB_WORKSPACE/sw-serverless/sdk/python/src" python -m unittest discover -s tests
+      - name: Build
+        run: |
+          python -m pip install --upgrade build
+          python -m build
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: sdk/python/dist
+          password: ${{ secrets.PYPI_API_TOKEN }}
+          skip-existing: true
+
+  node:
+    if: ${{ !contains(inputs.version, '-') }}
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: sdk/node
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4
+        with:
+          repository: simplify9/SW-Serverless
+          path: sw-serverless
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          registry-url: "https://registry.npmjs.org"
+      - name: Version
+        id: version
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          v="$VERSION"
+          npm version "$v" --no-git-tag-version --allow-same-version
+          sed -i -E "s/^const VERSION = \".*\";/const VERSION = \"$v\";/" src/index.js
+          echo "value=$v" >> "$GITHUB_OUTPUT"
+      - name: Test
+        env:
+          SW_SERVERLESS_NODE: ${{ github.workspace }}/sw-serverless/sdk/node/src
+        run: node --test
+      - name: Publish
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          name=$(node -p "require('./package.json').name")
+          if npm view "$name@${{ steps.version.outputs.value }}" version >/dev/null 2>&1; then
+            echo "$name@${{ steps.version.outputs.value }} is already on npm."
+          else
+            npm publish --access public
+          fi