Fix broken async db_transaction calls; add auto-tag/release workflow

The July 6 SQL-injection fix left ChirpHeliumKeysRpc.py and
ChirpHeliumJoinRpc.py with a dead psycopg2-based db_transaction
overload (shadowed by an async one) and psycopg2-style %(name)s
query placeholders that asyncpg can't bind. Both get_merged_keys and
add_session_key silently threw TypeError on every call, so device
keys and join session records were never persisted. Switched to
asyncpg's positional $1.. placeholders and made the call sites await
db_transaction properly. Also dropped a stray "await db.close()" in
db_fetch that referenced an undefined name.

Added .github/workflows/release.yml to auto-tag and publish a GitHub
Release (patch bump) on every push to master, which in turn triggers
the existing container build workflow to publish a versioned image.

Author: ccall48

.github/workflows/release.yml

@@ -0,0 +1,54 @@
+name: Tag and Release
+
+# On every push to master, auto-bump the patch version (vX.Y.Z -> vX.Y.Z+1,
+# starting at v0.1.0 if no tags exist yet), tag it, and publish a GitHub
+# Release. Publishing the release triggers build-container-image.yml, which
+# builds and pushes the versioned container image to ghcr.io.
+
+on:
+  push:
+    branches:
+      - master
+
+permissions:
+  contents: write
+
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+jobs:
+  tag_and_release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Compute next version
+        id: version
+        run: |
+          latest_tag=$(git tag -l 'v[0-9]*.[0-9]*.[0-9]*' --sort=-v:refname | head -n1)
+          if [ -z "$latest_tag" ]; then
+            next_tag="v0.1.0"
+          else
+            IFS='.' read -r major minor patch <<< "${latest_tag#v}"
+            next_tag="v${major}.${minor}.$((patch + 1))"
+          fi
+          echo "Latest tag: ${latest_tag:-<none>}, next tag: ${next_tag}"
+          echo "tag=${next_tag}" >> "$GITHUB_OUTPUT"
+
+      - name: Create and push tag
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git tag -a "${{ steps.version.outputs.tag }}" -m "Release ${{ steps.version.outputs.tag }}"
+          git push origin "${{ steps.version.outputs.tag }}"
+
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "${{ steps.version.outputs.tag }}" \
+            --title "${{ steps.version.outputs.tag }}" \
+            --generate-notes

app/ChirpHeliumJoinRpc.py

@@ -30,10 +30,10 @@ def __init__(
         self.cs_grpc = chirpstack_host
         self.auth_token = [("authorization", f"Bearer {chirpstack_token}")]
 
-    async def db_transaction(self, query: str):
+    async def db_transaction(self, query: str, *params):
         async with self.pool.acquire() as con:
             async with con.transaction():
-                await con.execute(query)
+                await con.execute(query, *params)
 
     ###########################################################################
     # follow internal redis stream gRPC for actionable changes
@@ -122,7 +122,7 @@ async def add_session_key(self, dev_eui):
         query = """
             INSERT INTO helium_devices
             (dev_eui, join_eui, dev_addr, max_copies, aps_key, nws_key, dev_name, fcnt_up, fcnt_down)
-            VALUES (%(dev_eui)s, %(join_eui)s, %(dev_addr)s, %(max_copies)s, %(aps_key)s, %(nws_key)s, %(dev_name)s, %(fcnt_up)s, %(fcnt_down)s)
+            VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
             ON CONFLICT (dev_eui) DO UPDATE
             SET join_eui = EXCLUDED.join_eui,
                 dev_addr = EXCLUDED.dev_addr,
@@ -133,15 +133,15 @@ async def add_session_key(self, dev_eui):
                 fcnt_up = EXCLUDED.fcnt_up,
                 fcnt_down = EXCLUDED.fcnt_down;
         """
-        params = {
-            "dev_eui": devices["devEui"],
-            "join_eui": devices["joinEui"],
-            "dev_addr": devices["devAddr"],
-            "max_copies": max_copies,
-            "aps_key": devices["appSKey"],
-            "nws_key": devices["nwkSEncKey"],
-            "dev_name": devices["name"],
-            "fcnt_up": devices["fCntUp"],
-            "fcnt_down": devices["nFCntDown"],
-        }
-        self.db_transaction(query, params)
+        await self.db_transaction(
+            query,
+            devices["devEui"],
+            devices["joinEui"],
+            devices["devAddr"],
+            max_copies,
+            devices["appSKey"],
+            devices["nwkSEncKey"],
+            devices["name"],
+            devices["fCntUp"],
+            devices["nFCntDown"],
+        )

app/ChirpHeliumKeysRpc.py

@@ -23,19 +23,12 @@ def __init__(
     async def db_fetch(self, query: str):
         async with self.pool.acquire() as conn:
             async with conn.transaction():
-                cur = await conn.fetch(query)
-        await db.close()
-        return cur
+                return await conn.fetch(query)
 
-    def db_transaction(self, query: str, params=None):
-        with psycopg2.connect(self.postgres) as con:
-            with con.cursor() as cur:
-                cur.execute(query, params)
-
-    async def db_transaction(self, query: str):
+    async def db_transaction(self, query: str, *params):
         async with self.pool.acquire() as conn:
             async with conn.transaction():
-                await conn.execute(query)
+                await conn.execute(query, *params)
 
     async def fetch_all_devices(self) -> list[str]:
         query = """
@@ -93,7 +86,7 @@ async def get_merged_keys(self, dev_eui: str) -> str:
         query = """
             INSERT INTO helium_devices
             (dev_eui, join_eui, dev_addr, max_copies, aps_key, nws_key, dev_name, fcnt_up, fcnt_down)
-            VALUES (%(dev_eui)s, %(join_eui)s, %(dev_addr)s, %(max_copies)s, %(aps_key)s, %(nws_key)s, %(dev_name)s, %(fcnt_up)s, %(fcnt_down)s)
+            VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
             ON CONFLICT (dev_eui) DO UPDATE
             SET join_eui = EXCLUDED.join_eui,
                 dev_addr = EXCLUDED.dev_addr,
@@ -104,19 +97,18 @@ async def get_merged_keys(self, dev_eui: str) -> str:
                 fcnt_up = EXCLUDED.fcnt_up,
                 fcnt_down = EXCLUDED.fcnt_down;
         """
-        params = {
-            "dev_eui": devices["devEui"],
-            "join_eui": devices["joinEui"],
-            "dev_addr": devices["devAddr"],
-            "max_copies": max_copies,
-            "aps_key": devices["appSKey"],
-            "nws_key": devices["nwkSEncKey"],
-            "dev_name": devices["name"],
-            "fcnt_up": devices["fCntUp"],
-            "fcnt_down": devices["nFCntDown"],
-        }
-        self.db_transaction(query, params)
-        # await self.async_db_transaction(query)
+        await self.db_transaction(
+            query,
+            devices["devEui"],
+            devices["joinEui"],
+            devices["devAddr"],
+            max_copies,
+            devices["appSKey"],
+            devices["nwkSEncKey"],
+            devices["name"],
+            devices["fCntUp"],
+            devices["nFCntDown"],
+        )
         return f"Updated: {dev_eui}"
 
     async def helium_skfs_update(self):