chore: migrate to release-please with independent release lines

.github/workflows/publish-ibis-server.yml

@@ -0,0 +1,119 @@
+name: Publish ibis-server Docker image
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        description: "Version number (e.g. 0.25.0)"
+        required: true
+        type: string
+      tag_name:
+        description: "Git tag to checkout (e.g. ibis-server-v0.25.0)"
+        required: true
+        type: string
+      prerelease:
+        description: "Whether this is a pre-release build"
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+  packages: write
+
+env:
+  IBIS_IMAGE: ghcr.io/canner/wren-engine-ibis
+
+jobs:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        arch:
+          - runner: ubuntu-latest
+            platform: linux/amd64
+          - runner: linux_arm64_runner
+            platform: linux/arm64
+    runs-on: ${{ matrix.arch.runner }}
+    steps:
+      - name: Prepare platform
+        run: |
+          platform=${{ matrix.arch.platform }}
+          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag_name }}
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.IBIS_IMAGE }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Build and push by digest
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          platforms: ${{ matrix.arch.platform }}
+          labels: ${{ steps.meta.outputs.labels }}
+          context: ./ibis-server
+          build-args: |
+            ENV=prod
+            MCP_SERVER_VERSION=${{ inputs.version }}
+          build-contexts: |
+            wren-core-py=./wren-core-py
+            wren-core=./wren-core
+            wren-core-base=./wren-core-base
+            mcp-server=./mcp-server
+          outputs: type=image,name=${{ env.IBIS_IMAGE }},push-by-digest=true,name-canonical=true,push=true
+      - name: Export digest
+        run: |
+          mkdir -p /tmp/digests
+          digest="${{ steps.build.outputs.digest }}"
+          touch "/tmp/digests/${digest#sha256:}"
+      - name: Upload digest
+        uses: actions/upload-artifact@v4
+        with:
+          name: digests-${{ env.PLATFORM_PAIR }}
+          path: /tmp/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  merge:
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - name: Download digests
+        uses: actions/download-artifact@v4
+        with:
+          path: /tmp/digests
+          pattern: digests-*
+          merge-multiple: true
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.IBIS_IMAGE }}
+          tags: |
+            type=raw,value=${{ inputs.version }}
+            ${{ !inputs.prerelease && 'type=raw,value=latest' || '' }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Create manifest list and push
+        working-directory: /tmp/digests
+        run: |
+          docker buildx imagetools create \
+            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            $(printf '${{ env.IBIS_IMAGE }}@sha256:%s ' *)

.github/workflows/publish-mcp-server.yml

@@ -0,0 +1,54 @@
+name: Publish mcp-server
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        description: "Version number (e.g. 0.25.0 or 0.25.0-rc.1)"
+        required: true
+        type: string
+      tag_name:
+        description: "Git tag to checkout (e.g. mcp-server-v0.25.0)"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    name: Verify mcp-server version
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag_name }}
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Verify version matches tag
+        working-directory: mcp-server
+        env:
+          EXPECTED_VERSION: ${{ inputs.version }}
+        run: |
+          TOML_VERSION=$(python -c "
+          import re
+          with open('pyproject.toml') as f:
+              content = f.read()
+          match = re.search(r'^version\s*=\s*\"(.+?)\"', content, re.MULTILINE)
+          print(match.group(1))
+          ")
+          echo "pyproject.toml version: $TOML_VERSION"
+          echo "Expected version: $EXPECTED_VERSION"
+          if [ "$TOML_VERSION" = "$EXPECTED_VERSION" ]; then
+            echo "Version verified successfully"
+          else
+            # For RC releases, version files aren't bumped — verify base version is consistent
+            BASE_VERSION=$(echo "$EXPECTED_VERSION" | sed 's/-rc\..*//')
+            if [ "$TOML_VERSION" = "$BASE_VERSION" ]; then
+              echo "::notice::RC release — pyproject.toml has base version $TOML_VERSION, RC version is $EXPECTED_VERSION"
+            else
+              echo "::error::Version mismatch: pyproject.toml has $TOML_VERSION but expected $EXPECTED_VERSION (base: $BASE_VERSION)"
+              exit 1
+            fi
+          fi

.github/workflows/pypi-publish.yml → .github/workflows/publish-wren-core-py.yml

@@ -1,20 +1,25 @@
 name: Publish wren-core-py to PyPI
 
-permissions:
-  contents: read
-  id-token: write  # Required for trusted publishing (OIDC)
-
 on:
-  workflow_dispatch:
+  workflow_call:
     inputs:
-      target:
-        description: "Publish target"
+      version:
+        description: "Version number (e.g. 0.2.0)"
         required: true
-        default: "testpypi"
-        type: choice
-        options:
-          - testpypi
-          - pypi
+        type: string
+      tag_name:
+        description: "Git tag to checkout (e.g. wren-core-py-v0.2.0)"
+        required: true
+        type: string
+      pypi_target:
+        description: "Publish target (pypi or testpypi)"
+        required: false
+        type: string
+        default: "pypi"
+
+permissions:
+  contents: read
+  id-token: write
 
 jobs:
   build-wheels:
@@ -24,25 +29,24 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          # Linux x86_64
           - os: ubuntu-latest
             target: x86_64-unknown-linux-gnu
-          # TODO: Linux aarch64 disabled — ring 0.17+ cross-compilation fails (__ARM_ARCH undefined)
-          # Ref: https://github.com/PyO3/maturin-action/issues/222
-          # - os: ubuntu-24.04-arm
-          #   target: aarch64-unknown-linux-gnu
-          #   manylinux: 2_28
-          # macOS x86_64
           - os: macos-15-intel
             target: x86_64-apple-darwin
-          # macOS arm64
           - os: macos-15
             target: aarch64-apple-darwin
-          # Windows x86_64
           - os: windows-latest
             target: x86_64-pc-windows-msvc
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag_name }}
+      - name: Set version
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          sed -i "s/^version = \".*\"/version = \"${VERSION}\"/" wren-core-py/Cargo.toml
+          sed -i "s/^version = \".*\"/version = \"${VERSION}\"/" wren-core-py/pyproject.toml
       - uses: actions/setup-python@v5
         with:
           python-version: "3.11"
@@ -64,6 +68,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag_name }}
+      - name: Set version
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          sed -i "s/^version = \".*\"/version = \"${VERSION}\"/" wren-core-py/Cargo.toml
+          sed -i "s/^version = \".*\"/version = \"${VERSION}\"/" wren-core-py/pyproject.toml
       - name: Build sdist
         uses: PyO3/maturin-action@v1
         with:
@@ -77,24 +89,22 @@ jobs:
           path: wren-core-py/dist/*.tar.gz
 
   publish:
-    name: Publish to ${{ github.event.inputs.target || 'testpypi' }}
+    name: Publish to ${{ inputs.pypi_target }}
     needs: [build-wheels, build-sdist]
     runs-on: ubuntu-latest
     environment:
-      name: ${{ github.event.inputs.target || 'testpypi' }}
-      url: ${{ github.event.inputs.target == 'pypi' && 'https://pypi.org/project/wren-core-py/' || 'https://test.pypi.org/project/wren-core-py/' }}
+      name: ${{ inputs.pypi_target }}
+      url: ${{ inputs.pypi_target == 'pypi' && 'https://pypi.org/project/wren-core-py/' || 'https://test.pypi.org/project/wren-core-py/' }}
     steps:
       - name: Download all artifacts
         uses: actions/download-artifact@v4
         with:
           path: dist
           merge-multiple: true
-
       - name: List artifacts
         run: ls -lhR dist/
-
-      - name: Publish to ${{ github.event.inputs.target }}
+      - name: Publish
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          repository-url: ${{ github.event.inputs.target == 'testpypi' && 'https://test.pypi.org/legacy/' || 'https://upload.pypi.org/legacy/' }}
+          repository-url: ${{ inputs.pypi_target == 'testpypi' && 'https://test.pypi.org/legacy/' || 'https://upload.pypi.org/legacy/' }}
           packages-dir: dist/

.github/workflows/publish-wren.yml

@@ -0,0 +1,71 @@
+name: Publish wren-engine to PyPI
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        description: "Version number (e.g. 0.3.0)"
+        required: true
+        type: string
+      tag_name:
+        description: "Git tag to checkout (e.g. wren-v0.3.0)"
+        required: true
+        type: string
+      pypi_target:
+        description: "Publish target (pypi or testpypi)"
+        required: false
+        type: string
+        default: "pypi"
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  build:
+    name: Build distribution
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag_name }}
+      - name: Set version
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          sed -i "s/^version = \".*\"/version = \"${VERSION}\"/" wren/pyproject.toml
+          sed -i "s/^__version__ = \".*\"/__version__ = \"${VERSION}\"/" wren/src/wren/__init__.py
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Install build tool
+        run: pip install build
+      - name: Build sdist and wheel
+        run: python -m build
+        working-directory: wren
+      - name: Upload distributions
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: wren/dist/
+
+  publish:
+    name: Publish to ${{ inputs.pypi_target }}
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: ${{ inputs.pypi_target }}
+      url: ${{ inputs.pypi_target == 'pypi' && 'https://pypi.org/project/wren-engine/' || 'https://test.pypi.org/project/wren-engine/' }}
+    steps:
+      - name: Download distributions
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - name: List artifacts
+        run: ls -lhR dist/
+      - name: Publish
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: ${{ inputs.pypi_target == 'testpypi' && 'https://test.pypi.org/legacy/' || 'https://upload.pypi.org/legacy/' }}
+          packages-dir: dist/