Qualify installed compiler release artifacts

.github/workflows/duckdb-extension-release.yml

@@ -17,6 +17,10 @@ on:
     tags:
       - "sidemantic-duckdb-v*"
 
+  pull_request:
+    paths:
+      - ".github/workflows/duckdb-extension-release.yml"
+
 permissions:
   contents: read
 
@@ -60,11 +64,6 @@ jobs:
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
 
-      - name: Cache cargo
-        uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: sidemantic-rs
-
       - name: Install build dependencies
         run: sudo apt-get update && sudo apt-get install -y ninja-build
 

.github/workflows/release-rust-binaries.yml

@@ -98,11 +98,6 @@ jobs:
         with:
           targets: ${{ matrix.target }}
 
-      - name: Cache cargo
-        uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: sidemantic-rs
-
       - name: Build Rust binaries
         env:
           TARGET: ${{ matrix.target }}

.github/workflows/rust-runtime-release.yml

@@ -18,6 +18,11 @@ on:
       - "sidemantic-rs-v*"
       - "rust-runtime-v*"
 
+  pull_request:
+    paths:
+      - ".github/workflows/rust-runtime-release.yml"
+      - "sidemantic-rs/tests/packaged_cli_smoke.py"
+
 permissions:
   contents: read
 
@@ -38,11 +43,6 @@ jobs:
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
 
-      - name: Cache cargo
-        uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: sidemantic-rs
-
       - name: Run package metadata tests
         run: cargo test --locked --test package_metadata
 
@@ -73,7 +73,7 @@ jobs:
         include:
           - os: ubuntu-latest
             artifact: linux-x86_64
-          - os: macos-13
+          - os: macos-15-intel
             artifact: macos-x86_64
           - os: macos-14
             artifact: macos-arm64
@@ -90,11 +90,6 @@ jobs:
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
 
-      - name: Cache cargo
-        uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: sidemantic-rs
-
       - name: Build CLI
         run: cargo build --release --locked --bin sidemantic
 
@@ -104,12 +99,27 @@ jobs:
           mkdir -p dist
 
           if [ "$RUNNER_OS" = "Windows" ]; then
-            cp target/release/sidemantic.exe "dist/sidemantic-${{ matrix.artifact }}.exe"
+            cp ../target/release/sidemantic.exe "dist/sidemantic-${{ matrix.artifact }}.exe"
           else
-            cp target/release/sidemantic "dist/sidemantic-${{ matrix.artifact }}"
+            cp ../target/release/sidemantic "dist/sidemantic-${{ matrix.artifact }}"
             tar -czf "dist/sidemantic-${{ matrix.artifact }}.tar.gz" -C dist "sidemantic-${{ matrix.artifact }}"
           fi
 
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+
+      - name: Smoke packaged CLI
+        shell: bash
+        run: |
+          if [ "$RUNNER_OS" = "Windows" ]; then
+            uv run --no-project tests/packaged_cli_smoke.py dist/sidemantic-${{ matrix.artifact }}.exe
+          else
+            mkdir -p dist/smoke
+            tar -xzf dist/sidemantic-${{ matrix.artifact }}.tar.gz -C dist/smoke
+            uv run --no-project tests/packaged_cli_smoke.py dist/smoke/sidemantic-${{ matrix.artifact }}
+            rm -r dist/smoke
+          fi
+
       - name: Upload CLI artifact
         uses: actions/upload-artifact@v4
         with:

.github/workflows/sidemantic-rs-wheels.yml

@@ -17,6 +17,12 @@ on:
     tags:
       - "sidemantic-rs-v*"
 
+  pull_request:
+    paths:
+      - ".github/workflows/sidemantic-rs-wheels.yml"
+      - "sidemantic-rs/pyproject.toml"
+      - "sidemantic-rs/tests/python_wheel_smoke.py"
+
 permissions:
   contents: read
 
@@ -33,9 +39,9 @@ jobs:
         include:
           - os: ubuntu-latest
             target: x86_64
-          - os: ubuntu-latest
+          - os: ubuntu-24.04-arm
             target: aarch64
-          - os: macos-13
+          - os: macos-15-intel
             target: x86_64
           - os: macos-14
             target: aarch64
@@ -58,6 +64,13 @@ jobs:
           manylinux: auto
           target: ${{ matrix.target }}
 
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+
+      - name: Smoke built wheel on its target host
+        shell: bash
+        run: uv run --no-project --with sidemantic-rs/dist/*.whl sidemantic-rs/tests/python_wheel_smoke.py
+
       - name: Upload wheel
         uses: actions/upload-artifact@v4
         with:
@@ -93,36 +106,11 @@ jobs:
           path: sidemantic-rs/dist/*.tar.gz
           if-no-files-found: error
 
-  smoke-host-wheel:
-    name: Smoke host wheel
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: sidemantic-rs
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@v5
-        with:
-          enable-cache: true
-
-      - name: Set up Python
-        run: uv python install 3.12
-
-      - name: Build host wheel
-        run: uvx maturin build --release --out dist
-
-      - name: Smoke host wheel
-        run: uv run --no-project --with dist/*.whl tests/python_wheel_smoke.py
-
   release:
     name: Publish or attach wheel artifacts
     needs:
       - build-wheels
       - build-sdist
-      - smoke-host-wheel
     if: ${{ startsWith(github.ref, 'refs/tags/') || (github.event_name == 'workflow_dispatch' && (inputs.publish_pypi == true || inputs.create_github_release == true)) }}
     runs-on: ubuntu-latest
     permissions:

.github/workflows/wasm-package-release.yml

@@ -14,6 +14,9 @@ on:
   pull_request:
     paths:
       - "sidemantic-wasm/**"
+      - "sidemantic-rs/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
       - ".github/workflows/wasm-package-release.yml"
 
 permissions:
@@ -38,11 +41,6 @@ jobs:
         with:
           targets: wasm32-unknown-unknown
 
-      - name: Cache cargo
-        uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: .
-
       - name: Install wasm-bindgen-cli matching the crate
         working-directory: .
         run: |
@@ -75,8 +73,17 @@ jobs:
           bun run scripts/smoke_client.mjs
           bun run scripts/smoke_vite.mjs
 
-      - name: Check package contents
-        run: npm pack --dry-run
+      - name: Pack and smoke test shipped package
+        run: |
+          bun pm pack --ignore-scripts --filename sidemantic-wasm.tgz
+          bun run scripts/smoke_package.mjs sidemantic-wasm.tgz
+
+      - name: Upload tested package
+        uses: actions/upload-artifact@v4
+        with:
+          name: sidemantic-wasm-package
+          path: sidemantic-wasm/sidemantic-wasm.tgz
+          if-no-files-found: error
 
       - name: Set up npm registry
         if: ${{ (github.event_name == 'workflow_dispatch' && inputs.publish_npm == true) || startsWith(github.ref, 'refs/tags/sidemantic-wasm-v') }}
@@ -94,5 +101,5 @@ jobs:
             echo "NPM_TOKEN not set; skipping publish."
             exit 0
           fi
-          # wasm/ is already built above; --ignore-scripts avoids a redundant rebuild.
-          npm publish --access public --ignore-scripts
+          # Publish the exact tarball exercised by the isolated consumer above.
+          npm publish sidemantic-wasm.tgz --access public --ignore-scripts