ci: single VERSION file, version guards, goreleaser v2, CI on push

Workflow hardening based on the four-cycle release-debugging session:

Centralized versioning
- Add /VERSION at repo root as single source of truth.
- core/Makefile reads VERSION via `$(shell cat ../VERSION)`.
- Add `make bump VER=X.Y.Z` target that updates /VERSION and syncs
  sdk/package.json in one shot.

Version mismatch guards
- All three release workflows (release.yaml, release-apt.yml,
  publish-sdk.yml) now verify the release tag matches /VERSION at the
  very first step. Stale-VERSION releases fail fast with a clear hint
  to run `make bump`.

GoReleaser v2 migration
- Upgrade goreleaser-action v5 -> v6 (pinned `~> v2`).
- Add `version: 2` to .goreleaser.yaml.
- Migrate to v2 syntax: `archives.format` -> `formats: [...]`,
  `brews.folder` -> `directory`, `snapshot.name_template` ->
  `version_template`, `builds`-style references replaced with `ids:`.
- `before.hooks` can use map syntax again (v2 supports it).

Homebrew tap on stable only
- `brews.skip_upload` is now `'{{ if .Prerelease }}true{{ else }}false{{ end }}'`.
- Stops nightly releases from polluting the tap and from hitting 401
  on stale HOMEBREW_TAP_TOKEN. Stable main releases still publish.

CI on every push
- New ci.yml runs `go vet` + `go test -race` on the core module and
  typecheck/build/unit-tests on the SDK for every push to main/nightly
  and every PR. version-sanity job warns when /VERSION and
  sdk/package.json drift.

Version bump for next pipeline test
- /VERSION: 0.122.8
- sdk/package.json: 0.122.8

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -0,0 +1,85 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+      - nightly
+  pull_request:
+    branches:
+      - main
+      - nightly
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  go-test:
+    name: Go tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.24"
+          cache-dependency-path: core/go.sum
+
+      - name: Vet
+        working-directory: core
+        run: go vet ./...
+
+      - name: Test
+        working-directory: core
+        run: go test -race -timeout 5m ./...
+
+  sdk-build:
+    name: SDK typecheck, build, unit tests
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: sdk
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Typecheck
+        run: pnpm typecheck
+
+      - name: Build
+        run: pnpm build
+
+      - name: Unit tests
+        run: pnpm vitest run tests/unit
+
+  version-sanity:
+    name: Verify VERSION ↔ sdk/package.json sync
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Compare versions
+        run: |
+          ROOT=$(tr -d '[:space:]' < VERSION)
+          SDK=$(node -p "require('./sdk/package.json').version")
+          if [ "$ROOT" != "$SDK" ]; then
+            echo "::warning::/VERSION ($ROOT) and sdk/package.json ($SDK) differ. Run 'make -C core bump VER=$ROOT' to sync."
+          else
+            echo "Versions in sync: $ROOT"
+          fi

.github/workflows/publish-sdk.yml

@@ -28,6 +28,20 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
+      - name: Verify VERSION file matches release tag
+        if: github.event_name == 'release'
+        working-directory: .
+        run: |
+          TAG="${{ github.event.release.tag_name }}"
+          EXPECTED="${TAG#v}"
+          EXPECTED="${EXPECTED%-nightly}"
+          ACTUAL=$(tr -d '[:space:]' < VERSION)
+          if [ "$EXPECTED" != "$ACTUAL" ]; then
+            echo "::error::Tag $TAG implies version '$EXPECTED' but /VERSION says '$ACTUAL'."
+            echo "::error::Run 'make -C core bump VER=$EXPECTED' and commit before tagging."
+            exit 1
+          fi
+
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:

.github/workflows/release-apt.yml

@@ -25,6 +25,19 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
+      - name: Verify VERSION file matches release tag
+        if: github.event_name == 'release'
+        run: |
+          TAG="${{ github.event.release.tag_name }}"
+          EXPECTED="${TAG#v}"
+          EXPECTED="${EXPECTED%-nightly}"
+          ACTUAL=$(tr -d '[:space:]' < VERSION)
+          if [ "$EXPECTED" != "$ACTUAL" ]; then
+            echo "::error::Tag $TAG implies version '$EXPECTED' but /VERSION says '$ACTUAL'."
+            echo "::error::Run 'make -C core bump VER=$EXPECTED' and commit before tagging."
+            exit 1
+          fi
+
       - name: Set up Go
         uses: actions/setup-go@v5
         with:

.github/workflows/release.yaml

@@ -20,17 +20,30 @@ jobs:
         with:
           fetch-depth: 0  # Need full history for changelog
 
+      - name: Verify VERSION file matches release tag
+        run: |
+          TAG="${GITHUB_REF_NAME}"
+          EXPECTED="${TAG#v}"
+          EXPECTED="${EXPECTED%-nightly}"
+          ACTUAL=$(tr -d '[:space:]' < VERSION)
+          if [ "$EXPECTED" != "$ACTUAL" ]; then
+            echo "::error::Tag $TAG implies version '$EXPECTED' but /VERSION says '$ACTUAL'."
+            echo "::error::Run 'make -C core bump VER=$EXPECTED' and commit before tagging."
+            exit 1
+          fi
+          echo "VERSION file matches tag: $ACTUAL"
+
       - name: Set up Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v5
         with:
           go-version: '1.24'
           cache-dependency-path: core/go.sum
 
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v5
+        uses: goreleaser/goreleaser-action@v6
         with:
           distribution: goreleaser
-          version: latest
+          version: '~> v2'
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.goreleaser.yaml

@@ -1,7 +1,8 @@
-# GoReleaser Configuration for DeBros Network
-# Builds and releases orama (CLI) and orama-node binaries
-# Publishes to: GitHub Releases, Homebrew, and apt (.deb packages)
+# GoReleaser v2 Configuration for DeBros Network
+# Builds and releases orama (CLI) and orama-node binaries.
+# Publishes to: GitHub Releases, Homebrew (stable only), and apt (.deb packages).
 
+version: 2
 project_name: orama-network
 
 env:
@@ -9,7 +10,8 @@ env:
 
 before:
   hooks:
-    - go -C core mod tidy
+    - cmd: go mod tidy
+      dir: core
 
 builds:
   # orama CLI binary
@@ -50,9 +52,9 @@ builds:
 archives:
   # Tar.gz archives for orama CLI
   - id: orama-archives
-    builds:
+    ids:
       - orama
-    format: tar.gz
+    formats: [tar.gz]
     name_template: "orama_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
     files:
       - README.md
@@ -60,9 +62,9 @@ archives:
 
   # Tar.gz archives for orama-node
   - id: orama-node-archives
-    builds:
+    ids:
       - orama-node
-    format: tar.gz
+    formats: [tar.gz]
     name_template: "orama-node_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
     files:
       - README.md
@@ -73,7 +75,7 @@ nfpms:
   # orama CLI .deb package
   - id: orama-deb
     package_name: orama
-    builds:
+    ids:
       - orama
     vendor: DeBros
     homepage: https://github.com/DeBrosDAO/orama
@@ -95,7 +97,7 @@ nfpms:
   # orama-node .deb package
   - id: orama-node-deb
     package_name: orama-node
-    builds:
+    ids:
       - orama-node
     vendor: DeBros
     homepage: https://github.com/DeBrosDAO/orama
@@ -114,7 +116,9 @@ nfpms:
       lintian_overrides:
         - statically-linked-binary
 
-# Homebrew tap for macOS (orama CLI only)
+# Homebrew tap for macOS (orama CLI only).
+# Stable releases only — prereleases (nightly) are skipped so we don't
+# pollute the tap or fight a 401 on a missing HOMEBREW_TAP_TOKEN.
 brews:
   - name: orama
     ids:
@@ -123,10 +127,11 @@ brews:
       owner: DeBrosDAO
       name: homebrew-tap
       token: "{{ .Env.HOMEBREW_TAP_TOKEN }}"
-    folder: Formula
+    directory: Formula
     homepage: https://github.com/DeBrosDAO/orama
     description: CLI tool for the Orama decentralized network
     license: MIT
+    skip_upload: '{{ if .Prerelease }}true{{ else }}false{{ end }}'
     install: |
       bin.install "orama"
     test: |
@@ -137,7 +142,7 @@ checksum:
   algorithm: sha256
 
 snapshot:
-  name_template: "{{ incpatch .Version }}-next"
+  version_template: "{{ incpatch .Version }}-next"
 
 changelog:
   sort: asc

VERSION

@@ -0,0 +1 @@
+0.122.8

core/Makefile

@@ -61,9 +61,11 @@ test-e2e-quick:
 # Network - Distributed P2P Database System
 # Makefile for development and build tasks
 
-.PHONY: build clean test deps tidy fmt vet lint install-hooks push-devnet push-testnet rollout-devnet rollout-testnet release
+.PHONY: build clean test deps tidy fmt vet lint install-hooks push-devnet push-testnet rollout-devnet rollout-testnet release bump
 
-VERSION := 0.122.7
+# Single source of truth — repo-root VERSION file. Update with `make bump VER=X.Y.Z`
+# or by editing /VERSION directly. Release workflows verify this matches the tag.
+VERSION := $(shell cat ../VERSION 2>/dev/null | tr -d '[:space:]' || echo unknown)
 COMMIT  ?= $(shell git rev-parse --short HEAD 2>/dev/null || echo unknown)
 DATE    ?= $(shell date -u +%Y-%m-%dT%H:%M:%SZ)
 LDFLAGS := -X 'main.version=$(VERSION)' -X 'main.commit=$(COMMIT)' -X 'main.date=$(DATE)'
@@ -130,6 +132,17 @@ rollout-devnet:
 rollout-testnet:
 	./bin/orama node rollout --env testnet --yes
 
+# Bump the repo-root VERSION file and sync sdk/package.json.
+# Usage: make bump VER=0.122.9
+bump:
+	@if [ -z "$(VER)" ]; then \
+		echo "Usage: make bump VER=X.Y.Z"; exit 1; \
+	fi
+	@echo "$(VER)" > ../VERSION
+	@cd ../sdk && npm version $(VER) --no-git-tag-version > /dev/null
+	@echo "Bumped VERSION and sdk/package.json to $(VER)"
+	@echo "Next: git add ../VERSION ../sdk/package.json && git commit -m 'release: $(VER)'"
+
 # Interactive release workflow (tag + push)
 release:
 	@bash scripts/release.sh

sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@debros/orama",
-  "version": "0.122.3",
+  "version": "0.122.8",
   "description": "TypeScript SDK for Orama Network - Database, PubSub, Cache, Storage, Vault, and more",
   "type": "module",
   "main": "./dist/index.js",