feat: add WASIX extension assets and release workflows

Generate packaged WASIX extension metadata, portable assets, and source-only target AOT crate templates for promoted SQL extensions.

Unify runtime/root setup, protocol correctness paths, pg_dump/data-dir APIs, and extension smoke coverage around the Wasmer/WASIX backend.

Operationalize maintainer workflows with path-aware CI, source-free committed asset verification, CI-generated AOT release artifacts, release-plz publishing, dependency invariants, and updated release docs.

Author: f0rr0

.github/actions/setup-rust-tools/action.yml

@@ -0,0 +1,50 @@
+name: Setup Rust Tools
+description: Install the pinned Rust toolchain, cache Cargo output, and install optional Cargo tools.
+
+inputs:
+  toolchain:
+    description: Rust toolchain version.
+    required: false
+    default: "1.92"
+  components:
+    description: Comma-separated Rust components.
+    required: false
+    default: ""
+  cache:
+    description: Whether to enable the Cargo cache.
+    required: false
+    default: "true"
+  cache-workspaces:
+    description: Workspace mapping for Swatinem/rust-cache.
+    required: false
+    default: ". -> target"
+  cache-save-if:
+    description: Expression string passed to Swatinem/rust-cache save-if.
+    required: false
+    default: "true"
+  tools:
+    description: Comma-separated tools for taiki-e/install-action.
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - name: Install Rust toolchain
+      uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
+      with:
+        toolchain: ${{ inputs.toolchain }}
+        components: ${{ inputs.components }}
+
+    - name: Cache Cargo output
+      if: ${{ inputs.cache == 'true' }}
+      uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32
+      with:
+        workspaces: ${{ inputs.cache-workspaces }}
+        save-if: ${{ inputs.cache-save-if }}
+
+    - name: Install Cargo tools
+      if: ${{ inputs.tools != '' }}
+      uses: taiki-e/install-action@1f2425cdb59f8fffb99ee16a5968edf6f57a2b93
+      with:
+        tool: ${{ inputs.tools }}

.github/pull_request_template.md

@@ -4,9 +4,13 @@
 
 - [ ] Package/API/runtime change: PR title uses `feat:`, `fix:`, `perf:`, `refactor:`, `revert:`, or a breaking `!`.
 - [ ] Docs/CI/repository-only change: no release intended.
+- [ ] Asset/source-spine change: source pins/fingerprints are current and the Assets workflow will generate/test release artifacts.
 
 ## Verification
 
-- [ ] `scripts/validate.sh ci`
-- [ ] `scripts/validate.sh release`
+- [ ] `scripts/validate.sh repo`
+- [ ] `scripts/validate.sh artifacts`
+- [ ] `scripts/validate.sh lint`
+- [ ] `scripts/validate.sh test`
+- [ ] `scripts/validate.sh package` when published package contents changed
 - [ ] `cargo deny check`

.github/scripts/check-release-changelog.sh

@@ -99,7 +99,7 @@ EOF
   exit 1
 fi
 
-expected_unreleased="[Unreleased]: https://github.com/f0rr0/pglite-oxide/compare/pglite-oxide-v${package_version}...HEAD"
+expected_unreleased="[Unreleased]: https://github.com/f0rr0/pglite-oxide/compare/${package_version}...HEAD"
 
 if ! grep -Fxq "${expected_unreleased}" CHANGELOG.md; then
   cat >&2 <<EOF

.github/scripts/check-release-intent.sh

@@ -67,7 +67,14 @@ if [[ -z "${base_versions}" || -z "${head_versions}" ]]; then
   exit 1
 fi
 
-if [[ "${base_versions}" != "${head_versions}" && "${is_release_pr}" != true ]]; then
+changed_existing_versions="$(
+  join -t $'\t' \
+    <(printf '%s\n' "${base_versions}" | sed 's/=/\t/' | sort -t $'\t' -k1,1) \
+    <(printf '%s\n' "${head_versions}" | sed 's/=/\t/' | sort -t $'\t' -k1,1) |
+    awk -F '\t' '$2 != $3 { print $1 "=" $2 " -> " $3 }'
+)"
+
+if [[ -n "${changed_existing_versions}" && "${is_release_pr}" != true ]]; then
   cat >&2 <<EOF
 This PR changes one or more workspace package versions.
 
@@ -86,6 +93,9 @@ ${base_versions}
 
 Head package versions:
 ${head_versions}
+
+Changed existing package versions:
+${changed_existing_versions}
 EOF
   exit 1
 fi
@@ -94,7 +104,7 @@ while IFS= read -r file; do
   [[ -z "${file}" ]] && continue
 
   case "${file}" in
-    Cargo.toml | Cargo.lock | build.rs | src/* | assets/* | crates/* | xtask/* | examples/* | benches/*)
+    Cargo.toml | build.rs | src/* | crates/*)
       affected_files+=("${file}")
       ;;
   esac
@@ -125,8 +135,9 @@ Breaking changes may use any type with !, for example:
 release-plz PRs are exempt only when their branch starts with release-plz- and
 their title starts with chore(release):.
 
-Docs, CI, issue-template, and repository-only changes can keep non-release types
-such as docs:, ci:, chore:, style:, or test: when they do not touch package code.
+Docs, CI, tests, examples, xtask-only maintenance, source-checkout scripts, and
+other repository-only changes can keep non-release types such as docs:, ci:,
+chore:, style:, or test: when they do not touch published package code.
 
 Received:
   ${subject}

.github/scripts/download-aot-artifacts.sh

@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+: "${GITHUB_REPOSITORY:?GITHUB_REPOSITORY is required}"
+: "${GITHUB_SHA:?GITHUB_SHA is required}"
+: "${GITHUB_TOKEN:?GITHUB_TOKEN is required}"
+
+python3 - <<'PY'
+import io
+import json
+import os
+import sys
+import urllib.request
+import zipfile
+from pathlib import Path
+
+repo = os.environ["GITHUB_REPOSITORY"]
+sha = os.environ["GITHUB_SHA"]
+token = os.environ["GITHUB_TOKEN"]
+targets = [
+    "aarch64-apple-darwin",
+    "x86_64-apple-darwin",
+    "x86_64-unknown-linux-gnu",
+    "aarch64-unknown-linux-gnu",
+    "x86_64-pc-windows-msvc",
+]
+
+
+def github_json(url: str) -> dict:
+    request = urllib.request.Request(
+        url,
+        headers={
+            "Accept": "application/vnd.github+json",
+            "Authorization": f"Bearer {token}",
+            "X-GitHub-Api-Version": "2022-11-28",
+        },
+    )
+    with urllib.request.urlopen(request) as response:
+        return json.load(response)
+
+
+def github_bytes(url: str) -> bytes:
+    request = urllib.request.Request(
+        url,
+        headers={
+            "Accept": "application/vnd.github+json",
+            "Authorization": f"Bearer {token}",
+            "X-GitHub-Api-Version": "2022-11-28",
+        },
+    )
+    with urllib.request.urlopen(request) as response:
+        return response.read()
+
+
+def extract_artifact(data: bytes) -> None:
+    root = Path(".").resolve()
+    with zipfile.ZipFile(io.BytesIO(data)) as archive:
+        for member in archive.infolist():
+            target = (root / member.filename).resolve()
+            if not str(target).startswith(f"{root}/") and target != root:
+                print(f"artifact contains unsafe path: {member.filename}", file=sys.stderr)
+                sys.exit(1)
+        archive.extractall(root)
+
+
+runs = github_json(
+    f"https://api.github.com/repos/{repo}/actions/workflows/assets.yml/runs"
+    f"?head_sha={sha}&per_page=20"
+).get("workflow_runs", [])
+run = next(
+    (
+        run
+        for run in runs
+        if run.get("head_sha") == sha
+        and run.get("status") == "completed"
+        and run.get("conclusion") == "success"
+    ),
+    None,
+)
+if run is None:
+    print(f"no successful Assets workflow found for {sha}", file=sys.stderr)
+    for candidate in runs:
+        print(
+            f"- {candidate.get('status')} / {candidate.get('conclusion')} / {candidate.get('html_url')}",
+            file=sys.stderr,
+        )
+    sys.exit(1)
+
+artifacts = github_json(
+    f"https://api.github.com/repos/{repo}/actions/runs/{run['id']}/artifacts?per_page=100"
+).get("artifacts", [])
+by_name = {artifact["name"]: artifact for artifact in artifacts}
+required = ["pglite-oxide-portable-wasix"] + [f"pglite-oxide-aot-{target}" for target in targets]
+missing = [name for name in required if name not in by_name]
+if missing:
+    print(
+        f"Assets workflow {run.get('html_url')} is missing release artifacts: {', '.join(missing)}",
+        file=sys.stderr,
+    )
+    sys.exit(1)
+
+portable = by_name["pglite-oxide-portable-wasix"]
+extract_artifact(github_bytes(portable["archive_download_url"]))
+portable_manifest = Path("target/pglite-oxide/assets/manifest.json")
+if not portable_manifest.is_file():
+    print(f"pglite-oxide-portable-wasix did not contain {portable_manifest}", file=sys.stderr)
+    sys.exit(1)
+print(f"downloaded pglite-oxide-portable-wasix from {run.get('html_url')}")
+
+for target in targets:
+    name = f"pglite-oxide-aot-{target}"
+    artifact = by_name[name]
+    data = github_bytes(artifact["archive_download_url"])
+    extract_artifact(data)
+    manifest = Path("target/pglite-oxide/aot") / target / "manifest.json"
+    if not manifest.is_file():
+        print(f"{name} did not contain {manifest}", file=sys.stderr)
+        sys.exit(1)
+    print(f"downloaded {name} from {run.get('html_url')}")
+PY