chore(release): 0.10.27 / chart 0.3.37 — regular-user SPA cred-vending fix

Re-release covering the regular-user branch of `dashboard.rs::
generate_credentials` that 0.10.26 missed. The 0.10.26 published
images do still ship the superadmin-path SPA fix, but every
`user_*` cred from the SPA pointed at `:5432` (the listener the
chart removed), so SPA users on a fresh 0.10.26 cluster couldn't
psql in. 0.10.27 has both paths going through the same broker-
registry round-robin.

Also bundles two pipeline-hardening commits (no behaviour change
to the published binaries):

- `make ec2-release` now hard-prereqs `make sync-s3` so a future
  build cannot compile against a stale source tarball — the
  failure mode that caused the 0.10.25 retraction.
- Test fixture `dan@boilingdata.com` renamed to
  `integration-test-user@example.com` (RFC-2606 reserved domain).
  `scripts/reset_staging_test_users.sh` deletes every entry on
  every run, and the previous address was real-looking enough to
  shadow operator inboxes.

Verified on staging: 275/275 curated tests passing; both SPA
distribution tests cycle across all 3 pods (15432/15433/15434).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: dforsber

CHANGELOG.md

@@ -5,6 +5,26 @@ All notable changes to BoilStream will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.10.27] - 2026-04-29
+
+### Fixes
+
+- **SPA `POST /auth/api/credentials` regular-user path was returning bare `:5432`.** 0.10.26's SPA round-robin landed on the superadmin branch only — the regular-user branch in `dashboard.rs::generate_credentials` kept the pre-fix `host: state.pgwire_host.clone()` / `port: state.pgwire_port`, so every `user_*` cred handed to the SPA pointed at `app.boilstream.com:5432`, the gateway listener the chart had just removed. The two `Json(CredentialsResponse {…})` blocks differed only in indentation (12 spaces in the superadmin nested block, 8 spaces at the function tail), which is why the original `replace_all` Edit only matched one of them. Caught when matview_stress (which registers fresh regular users) failed `Connection refused (os error 61)` on Phase 2; the existing staging guard authenticates as superadmin so it didn't see it. Added `auth::spa_credentials_distribution_test::test_spa_credentials_for_regular_user_returns_per_pod_port` to lock both paths down.
+
+### Pipeline
+
+- **`make ec2-release` now hard-prereqs `make sync-s3`** so the EC2 build host can't compile against a stale source tarball — the failure mode that caused the 0.10.25 retraction. `SKIP_SYNC_S3=1` bypasses for retries against an already-uploaded tarball.
+- **Test-fixture `dan@boilingdata.com` renamed to `integration-test-user@example.com`.** `scripts/reset_staging_test_users.sh` deletes every entry on every staging-test run; the previous address was real-looking enough to shadow operator inboxes. Reset list now carries a "RULE: only `@example.com`" comment to keep future maintainers from putting plausibly-real addresses on the auto-delete list.
+
+### Stress harness
+
+- `matview_stress` and `tantivy_stress` both extracted `host` from the SPA cred response but ignored `port`, so `--pgwire-port` (default 5432) was silently used. Both now read `creds["port"]` with the CLI flag as the local-dev fallback.
+
+### Notes
+
+- Chart version **0.3.37** tracks appVersion `0.10.27`.
+- Single ARM64 Docker image (`aarch64-linux-0.10.27`) plus `x64-linux-0.10.27`, both built on AWS EC2 (Graviton 2 / Intel Xeon).
+
 ## [0.10.26] - 2026-04-28
 
 Re-release of 0.10.25. The `0.10.25` images on Docker Hub were built

README.md

@@ -44,7 +44,7 @@ See [GitHub releases](https://github.com/boilingdata/boilstream/releases) for th
 #                    Apple Silicon under Docker.
 #   linux-x64        Linux x86_64
 #   windows-x64      Windows
-# Replace {VERSION} with the latest release (see GitHub releases above, e.g. 0.10.26)
+# Replace {VERSION} with the latest release (see GitHub releases above, e.g. 0.10.27)
 curl -L -o boilstream https://www.boilstream.com/binaries/darwin-aarch64/boilstream-{VERSION}
 curl -L -o boilstream-admin https://www.boilstream.com/binaries/darwin-aarch64/boilstream-admin-{VERSION}
 chmod +x boilstream boilstream-admin

charts/boilstream/Chart.yaml

@@ -6,8 +6,8 @@ description: |
   support. Each pod participates in S3-based leader election and serves
   per-user catalogs; failed pods are recovered from S3 backups.
 type: application
-version: 0.3.36
-appVersion: "0.10.26"
+version: 0.3.37
+appVersion: "0.10.27"
 kubeVersion: ">=1.27.0"
 keywords:
   - streaming

charts/boilstream/values-hetzner-example.yaml

@@ -12,7 +12,7 @@
 #   helm install boilstream ./charts/boilstream \
 #     -f charts/boilstream/values-hetzner-example.yaml \
 #     --set image.repository=<your-cfcr-tenant>.europe.registry.cloudfleet.dev/boilstream \
-#     --set image.tag=aarch64-linux-0.10.26 \
+#     --set image.tag=aarch64-linux-0.10.27 \
 #     --set superadmin.existingSecret=boilstream-superadmin
 
 replicas: 2                              # 2 nodes, 1 pod each
@@ -26,7 +26,7 @@ image:
   # SHA3 / SHA512 paths. There is no separate "-generic-" variant — this
   # is the only ARM64 image we publish.
   repository: docker.io/boilinginsights/boilstream
-  tag: aarch64-linux-0.10.26
+  tag: aarch64-linux-0.10.27
   pullPolicy: IfNotPresent
   pullSecrets: []                        # Docker Hub is public; no pull secret needed