ci(release): stamp package version from tag and bump action versions

Add scripts/ci/stamp_version.sh to rewrite Cargo.toml's [package]
version from the release tag before publishing, and wire it into
release-prepare.yml and release.yml. Since publish now runs against a
possibly-edited Cargo.toml, pass --allow-dirty to cargo publish.

Also bump pinned GitHub Actions across the release and test workflows
(checkout v6->v7, upload-artifact v4->v7, download-artifact v4->v8,
action-gh-release v2->v3) and labeler's checkout v4->v7.

Author: farhan-syah

.github/workflows/labels.yml

@@ -14,7 +14,7 @@ jobs:
   sync:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: crazy-max/ghaction-github-labeler@v5
         with:
           yaml-file: .github/labels.yml

.github/workflows/release-prepare.yml

@@ -70,7 +70,7 @@ jobs:
             label: windows-x64
             ext: ".exe"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install Rust + target
         uses: dtolnay/rust-toolchain@stable
@@ -81,6 +81,10 @@ jobs:
         with:
           prefix-key: fsck-${{ matrix.target }}
 
+      - name: Set version from tag
+        shell: bash
+        run: bash scripts/ci/stamp_version.sh "${{ needs.validate-version.outputs.version }}"
+
       - name: Build pagedb-fsck
         run: cargo build --release --bin pagedb-fsck --target ${{ matrix.target }}
 
@@ -100,7 +104,7 @@ jobs:
           $name = "pagedb-fsck-${{ needs.validate-version.outputs.version }}-${{ matrix.label }}.zip"
           Compress-Archive -Path "pagedb-fsck${{ matrix.ext }}" -DestinationPath $name
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: fsck-${{ matrix.label }}
           path: |

.github/workflows/release-validate.yml

@@ -30,7 +30,7 @@ jobs:
       version: ${{ steps.version.outputs.version }}
       is_full_release: ${{ steps.version.outputs.is_full_release }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref }}
 

.github/workflows/release.yml

@@ -68,7 +68,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: crates.io
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.tag }}
 
@@ -82,6 +82,9 @@ jobs:
       - name: Install LLVM/Clang
         run: sudo apt-get update && sudo apt-get install -y --no-install-recommends clang libclang-dev
 
+      - name: Set version from tag
+        run: bash scripts/ci/stamp_version.sh "${{ needs.validate-version.outputs.version }}"
+
       - name: Publish pagedb
         env:
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
@@ -102,7 +105,9 @@ jobs:
           fi
 
           echo "Publishing pagedb@$VERSION..."
-          cargo publish -p pagedb
+          # --allow-dirty: stamp_version.sh may have edited Cargo.toml for a
+          # prerelease tag; the verifying publish still runs.
+          cargo publish -p pagedb --allow-dirty
 
   # ── GitHub Release ───────────────────────────────────────────────────────────
   # Independent of publish-crate: a crates.io outage must not block cutting the
@@ -116,13 +121,13 @@ jobs:
       contents: write
       actions: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.tag }}
           fetch-depth: 0
 
       - name: Download fsck artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           pattern: "fsck-*"
           run-id: ${{ inputs.prepare_run_id }}
@@ -131,7 +136,7 @@ jobs:
           merge-multiple: true
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ inputs.tag }}
           name: pagedb ${{ needs.validate-version.outputs.version }}

.github/workflows/test.yml

@@ -39,7 +39,7 @@ jobs:
     name: Lint, Format & Docs
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -90,7 +90,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -124,7 +124,7 @@ jobs:
 
       - name: Upload nextest report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: nextest-${{ matrix.os }}
           path: target/nextest/default/junit.xml
@@ -155,7 +155,7 @@ jobs:
           - target: armv7-linux-androideabi
             label: android-armv7 (AndroidVfs / thread-pool)
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install Rust + target
         uses: dtolnay/rust-toolchain@stable
@@ -184,7 +184,7 @@ jobs:
             features: ""
             label: wasi (WasiVfs)
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install Rust + target
         uses: dtolnay/rust-toolchain@stable
@@ -211,7 +211,7 @@ jobs:
           - "--features compression"
           - "--all-features"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -233,7 +233,7 @@ jobs:
     name: Benchmark (dry run)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -258,7 +258,7 @@ jobs:
     name: Dependency audit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
       - name: Install cargo-deny

scripts/ci/stamp_version.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Stamp the package version from a release tag.
+#
+#   scripts/ci/stamp_version.sh <version>       # e.g. 0.1.0, 0.1.0-beta.2
+#
+# Rewrites `[package] version` in Cargo.toml. pagedb is a single leaf crate with
+# no internal path deps, so there is nothing else to pin.
+#
+# No-ops when Cargo.toml already carries the target version, which keeps
+# re-running a stage idempotent.
+
+set -euo pipefail
+
+VERSION="${1:?usage: stamp_version.sh <version>}"
+
+CURRENT=$(cargo metadata --no-deps --format-version=1 \
+    | jq -r '.packages[] | select(.name == "pagedb") | .version')
+
+if [[ "$VERSION" == "$CURRENT" ]]; then
+    echo "Version already $VERSION — nothing to stamp."
+    exit 0
+fi
+
+# First `version = "..."` in the file is [package].
+perl -i -pe 'if (!$done && /^version = "/) { s/^version = ".*"/version = "'"$VERSION"'"/; $done=1 }' Cargo.toml
+
+echo "Stamped package version: $CURRENT -> $VERSION"