Prepare gcode 0.8.5 and gsqz 0.4.3 release

Refs #179

Author: joshwilhelmi

.github/workflows/release-gcode.yml

@@ -20,6 +20,25 @@ jobs:
         with:
           components: clippy
 
+      - name: Verify tag matches Cargo.toml version
+        # Guards against tag/crate/release drift: installers resolve a version
+        # from crates.io and then look for a matching gcode-v{version} GitHub
+        # asset, so the tag, crate version, and release name must align.
+        run: |
+          set -euo pipefail
+          tag="${GITHUB_REF#refs/tags/}"
+          tag_version="${tag#gcode-v}"
+          if [ "$tag" = "$tag_version" ]; then
+            echo "::error::Tag '$tag' does not start with 'gcode-v'." >&2
+            exit 1
+          fi
+          cargo_version="$(cargo pkgid -p gobby-code | sed 's/.*@//')"
+          if [ "$tag_version" != "$cargo_version" ]; then
+            echo "::error::Tag version '$tag_version' does not match crates/gcode/Cargo.toml version '$cargo_version'." >&2
+            exit 1
+          fi
+          echo "Tag '$tag' aligns with crates/gcode/Cargo.toml version '$cargo_version'."
+
       - name: Clippy
         run: cargo clippy -p gobby-code -- -D warnings
 

.github/workflows/release-gsqz.yml

@@ -20,6 +20,25 @@ jobs:
         with:
           components: clippy
 
+      - name: Verify tag matches Cargo.toml version
+        # Guards against tag/crate/release drift: installers resolve a version
+        # from crates.io and then look for a matching gsqz-v{version} GitHub
+        # asset, so the tag, crate version, and release name must align.
+        run: |
+          set -euo pipefail
+          tag="${GITHUB_REF#refs/tags/}"
+          tag_version="${tag#gsqz-v}"
+          if [ "$tag" = "$tag_version" ]; then
+            echo "::error::Tag '$tag' does not start with 'gsqz-v'." >&2
+            exit 1
+          fi
+          cargo_version="$(cargo pkgid -p gobby-squeeze | sed 's/.*@//')"
+          if [ "$tag_version" != "$cargo_version" ]; then
+            echo "::error::Tag version '$tag_version' does not match crates/gsqz/Cargo.toml version '$cargo_version'." >&2
+            exit 1
+          fi
+          echo "Tag '$tag' aligns with crates/gsqz/Cargo.toml version '$cargo_version'."
+
       - name: Clippy
         run: cargo clippy -p gobby-squeeze -- -D warnings
 
@@ -110,7 +129,7 @@ jobs:
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
 
   release:
-    needs: build
+    needs: [build, publish]
     runs-on: ubuntu-latest
 
     steps:

CHANGELOG.md

@@ -9,6 +9,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.8.5] — gcode
+
 ### Changed
 
 #### gcode
@@ -18,6 +20,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   positional path filters after the query. Bare paths match exact files and
   descendants; glob paths stay verbatim; multiple paths use OR semantics.
 
+- **Broker-first PostgreSQL DSN resolution** — `gcode` now asks the local
+  daemon broker for the PostgreSQL hub DSN before consulting any daemonless
+  fallback. If the broker is unavailable, explicit fallback sources resolve in
+  this order: `GCODE_DATABASE_URL`, `GOBBY_POSTGRES_DSN`,
+  `~/.gobby/gcode.yaml` `database_url`, then bootstrap inline `database_url`.
+
+- **Bootstrap `database_url_ref` rejected** — `~/.gobby/bootstrap.yaml`
+  `database_url_ref` values are no longer accepted by `gcode`. Daemonless
+  setups must provide an inline `database_url` or one of the explicit fallback
+  sources above; broker-managed secrets stay behind the daemon broker.
+
 ### Removed
 
 #### gcode

Cargo.lock

@@ -94,7 +94,8 @@ setups can use `GOBBY_FALKORDB_HOST`, `GOBBY_FALKORDB_PORT`, and
 broker for the hub DSN first. If the daemon is unavailable, it falls back to
 explicit fallback sources: `GCODE_DATABASE_URL`, `GOBBY_POSTGRES_DSN`,
 `~/.gobby/gcode.yaml` `database_url`, then bootstrap `database_url`.
-Bootstrap fallback requires `hub_backend: postgres`.
+Bootstrap fallback requires `hub_backend: postgres`; bootstrap
+`database_url_ref` is rejected.
 Installing from source or crates.io requires Rust 1.88+.
 
 ### From source

README.md

@@ -1,6 +1,6 @@
 [package]
 name = "gobby-code"
-version = "0.8.4"
+version = "0.8.5"
 edition = "2024"
 rust-version = "1.88"
 authors = ["Josh Wilhelmi <hello@gobby.ai>"]

crates/gcode/Cargo.toml

@@ -100,7 +100,7 @@ asks the local daemon broker for the hub DSN first. If the daemon is
 unavailable, it falls back to explicit fallback sources:
 `GCODE_DATABASE_URL`, `GOBBY_POSTGRES_DSN`, `~/.gobby/gcode.yaml`
 `database_url`, then bootstrap `database_url`. Bootstrap fallback requires
-`hub_backend: postgres`.
+`hub_backend: postgres`; bootstrap `database_url_ref` is rejected.
 
 ### With Gobby
 
@@ -202,7 +202,7 @@ Gobby adds graph queries, graph lifecycle orchestration, semantic search, and in
 **PostgreSQL DSNs can stay out of plaintext files.** Isolated gcode runtimes
 ask the daemon broker first. Operators who need daemonless access can opt into
 `GCODE_DATABASE_URL`, `GOBBY_POSTGRES_DSN`, `~/.gobby/gcode.yaml`, or inline
-bootstrap `database_url`.
+bootstrap `database_url`. Bootstrap `database_url_ref` is rejected.
 
 **Indexing happens automatically.** The Gobby daemon watches for file changes and re-indexes in the background. Without the daemon, run `gcode index` manually.
 

crates/gcode/README.md

@@ -19,7 +19,8 @@ Runtime indexing/search requires Gobby's PostgreSQL hub. gcode asks the local
 daemon broker for the hub DSN first. If the daemon is unavailable, it falls back
 to explicit fallback sources: `GCODE_DATABASE_URL`, `GOBBY_POSTGRES_DSN`,
 `~/.gobby/gcode.yaml` `database_url`, then bootstrap `database_url`.
-Bootstrap fallback requires `hub_backend: postgres`.
+Bootstrap fallback requires `hub_backend: postgres`; bootstrap
+`database_url_ref` is rejected.
 
 If you use [Gobby](https://github.com/GobbyAI/gobby), gcode is already installed.
 
@@ -346,7 +347,7 @@ Use those when you want the daemon to clear or replay graph state for the curren
 
 gcode is daemon-independent but not database-independent:
 - Database: PostgreSQL hub from `~/.gobby/bootstrap.yaml`
-- Required bootstrap: `hub_backend: postgres` plus `database_url`
+- Required bootstrap: `hub_backend: postgres` plus `database_url`; bootstrap `database_url_ref` is rejected
 - Identity: `.gobby/project.json`, `.gobby/gcode.json`, isolated root, linked worktree, or generated identity from `gcode init`
 - Optional services: FalkorDB, Qdrant, and embeddings via env vars or PostgreSQL `config_store`
 
@@ -381,6 +382,9 @@ The database connection is resolved in this order:
 4. `~/.gobby/gcode.yaml` `database_url`
 5. `~/.gobby/bootstrap.yaml` `database_url`
 
+Bootstrap `database_url_ref` is rejected. Use the daemon broker path or an
+explicit fallback source for daemonless access.
+
 The daemon URL (used by `invalidate`, `graph clear`, and `graph rebuild`) is resolved from:
 1. `GOBBY_PORT` environment variable (e.g. `60887`)
 2. `~/.gobby/bootstrap.yaml` `daemon_port` + `bind_host` keys