Merged the current Core into the external stream branch.

.cargo/config.toml

@@ -1,6 +1,8 @@
 [env]
 # This temporarily overrides the version of the CLI used for integration tests, locally and in CI
-# CLI_VERSION_OVERRIDE = "v1.6.3-serverless"
+# TEMP: workflow task completion pagination requires server >=v1.32.0-162.0, for which there's no
+# published stable CLI release yet.
+CLI_VERSION_OVERRIDE = "v1.8.3-server-1.32.0-162.0"
 
 [alias]
 # Not sure why --all-features doesn't work
@@ -13,6 +15,8 @@ integ-test = [
     "--features",
     "ephemeral-server",
     "--features",
+    "temporalio-sdk/experimental",
+    "--features",
     "temporalio-sdk-core/otel",
     "--package",
     "temporalio-sdk-core",

.github/workflows/changelog.yml

@@ -0,0 +1,14 @@
+name: Changelog
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  changelog-check:
+    name: Changelog checkpoint
+    uses: temporalio/.github/.github/workflows/changelog.yml@d8129c755fbd1d3f18c5a7a5420d5754acc63e3f

.github/workflows/create-release.yml

@@ -0,0 +1,127 @@
+name: Create Release
+
+on:
+  workflow_dispatch:
+
+concurrency:
+  group: publish-crates
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    name: Publish crates
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    environment: release
+    permissions:
+      contents: write
+      id-token: write
+
+    steps:
+      - name: Require a release branch
+        shell: bash
+        run: |
+          if [[ "$GITHUB_REF" != "refs/heads/main" && ! "$GITHUB_REF_NAME" =~ ^releases/[0-9]+\.[0-9]+\.x$ ]]; then
+            echo "Publishing must be run from main or a releases/<major>.<minor>.x branch; got $GITHUB_REF."
+            exit 1
+          fi
+
+      - name: Check out repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+
+      # Necessary as `cargo publish` builds crates as a check before publishing
+      - name: Set up repository
+        uses: ./.github/actions/setup
+        with:
+          mise-install-args: protoc
+
+      - name: Read release metadata
+        id: release
+        shell: bash
+        run: |
+          metadata="$(cargo metadata --format-version 1 --no-deps)"
+          version="$(jq -er '[.packages[] | select(.name == "temporalio-sdk") | .version] | if length == 1 then .[0] else error("expected one temporalio-sdk package") end' <<<"$metadata")"
+          core_version="$(jq -er '[.packages[] | select(.name == "temporalio-sdk-core") | .version] | if length == 1 then .[0] else error("expected one temporalio-sdk-core package") end' <<<"$metadata")"
+
+          if [[ "$GITHUB_REF_NAME" =~ ^releases/([0-9]+)\.([0-9]+)\.x$ ]]; then
+            release_line="${BASH_REMATCH[1]}.${BASH_REMATCH[2]}"
+            if [[ "$version" != "$release_line".* ]]; then
+              echo "SDK version $version does not belong to release branch $GITHUB_REF_NAME."
+              exit 1
+            fi
+          fi
+
+          {
+            echo "version=$version"
+            echo "tag=v$version"
+            echo "core_tag=core-v$core_version"
+          } >>"$GITHUB_OUTPUT"
+
+      - name: Generate release notes
+        run: |
+          previous_tag="$(git describe --tags --match 'v[0-9]*' --abbrev=0 HEAD)"
+          cargo run -p changelog-release-notes -- \
+            --from "$previous_tag" \
+            --to HEAD \
+            --changelog rust \
+            >"$RUNNER_TEMP/sdk-release-notes.md"
+
+          if ! previous_core_tag="$(git describe --tags --match 'core-v[0-9]*' --abbrev=0 HEAD 2>/dev/null)"; then
+            previous_core_tag="$previous_tag"
+          fi
+          cargo run -p changelog-release-notes -- \
+            --from "$previous_core_tag" \
+            --to HEAD \
+            --changelog core \
+            >"$RUNNER_TEMP/core-release-notes.md"
+
+      - name: Plan crate publication
+        id: publish-plan
+        run: cargo run --quiet -p changelog-release-notes --bin plan-release-publish >>"$GITHUB_OUTPUT"
+
+      - name: Authenticate to crates.io
+        if: steps.publish-plan.outputs.packages != '[]'
+        id: auth
+        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1
+
+      - name: Publish crates
+        if: steps.publish-plan.outputs.packages != '[]'
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
+          PUBLISH_PACKAGES: ${{ steps.publish-plan.outputs.packages }}
+        shell: bash
+        run: |
+          jq -e 'type == "array" and length > 0 and all(.[]; type == "string" and length > 0)' \
+            <<<"$PUBLISH_PACKAGES" >/dev/null
+          mapfile -t packages < <(jq -r '.[]' <<<"$PUBLISH_PACKAGES")
+          publish_args=()
+          for package in "${packages[@]}"; do
+            publish_args+=(--package "$package")
+          done
+          cargo publish "${publish_args[@]}"
+
+      - name: Create draft SDK GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ steps.release.outputs.tag }}
+          RELEASE_TITLE: temporalio-sdk ${{ steps.release.outputs.tag }}
+        run: |
+          gh release create "$RELEASE_TAG" \
+            --target "$GITHUB_SHA" \
+            --draft \
+            --title "$RELEASE_TITLE" \
+            --notes-file "$RUNNER_TEMP/sdk-release-notes.md"
+
+      - name: Create draft Core GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ steps.release.outputs.core_tag }}
+          RELEASE_TITLE: temporalio-sdk-core ${{ steps.release.outputs.core_tag }}
+        run: |
+          gh release create "$RELEASE_TAG" \
+            --target "$GITHUB_SHA" \
+            --draft \
+            --title "$RELEASE_TITLE" \
+            --notes-file "$RUNNER_TEMP/core-release-notes.md"

.github/workflows/per-pr.yml

@@ -31,6 +31,12 @@ jobs:
       - run: cargo lint
       - run: cargo test-lint
       - run: cargo check
+      - run: cargo check --features experimental
+      - name: Check vendored proto compilation
+        run: cargo check --features temporalio-client/vendored-protox
+        env:
+          PROTOC: /does/not/exist
+          CARGO_TARGET_DIR: /tmp/vendored-protox-target
       - run: git diff --exit-code
 
   test:
@@ -67,12 +73,12 @@ jobs:
         with:
           script: |
             core.exportVariable('RUSTFLAGS', '-Csymbol-mangling-version=v0');
-      - run: cargo test -- --include-ignored --nocapture
+      - run: cargo test --features experimental -- --include-ignored --nocapture
       - name: Find test executable for cgroup tests
         id: find-cgroup-test
         if: runner.os == 'Linux' && runner.arch == 'X64'
         run: |
-          test_executable=$(cargo build --tests --message-format json | jq -r 'select(.profile?.test == true and .target?.name == "temporalio_sdk_core" and .executable) | .executable')
+          test_executable=$(cargo build --tests --features experimental --message-format json | jq -r 'select(.profile?.test == true and .target?.name == "temporalio_sdk_core" and .executable) | .executable')
           cp $test_executable ./core-tests
       - name: Upload cgroup test executable
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
@@ -90,17 +96,29 @@ jobs:
           path: machine_coverage/
 
   msrv:
-    name: "Verify MSRV"
-    timeout-minutes: ${{ github.ref == 'refs/heads/main' && 15 || 10 }}
+    name: "Verify MSRV (${{ matrix.group }})"
+    timeout-minutes: ${{ github.ref == 'refs/heads/main' && 20 || 15 }}
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - group: rust-1.88
+            crates: client common common-wasm macros protos sdk-core workflow
+          - group: rust-1.92
+            crates: sdk
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/actions/setup
         with:
           mise-install-args: protoc cargo:cargo-msrv
-          rust-cache-key: msrv
-      - run: cargo msrv verify
-        working-directory: ./crates/sdk-core
+          rust-cache-key: msrv-${{ matrix.group }}
+      - name: Verify crate MSRVs
+        run: |
+          read -ra crates <<< "${{ matrix.crates }}"
+          for crate in "${crates[@]}"; do
+            cargo msrv verify --all-features --path "crates/$crate"
+          done
 
   cgroup-tests:
     name: cgroup tests
@@ -171,21 +189,73 @@ jobs:
       - run: cargo integ-test -t wasm_workflow_tests -- --test-threads 1
 
   cloud-tests:
-    if: github.event.pull_request.head.repo.full_name == '' || github.event.pull_request.head.repo.full_name == 'temporalio/sdk-rust'
+    if: github.actor != 'dependabot[bot]' && (github.event.pull_request.head.repo.full_name == '' || github.event.pull_request.head.repo.full_name == 'temporalio/sdk-rust')
     name: Cloud tests
     env:
-      TEMPORAL_CLOUD_ADDRESS: https://${{ vars.TEMPORAL_CLIENT_NAMESPACE }}.tmprl.cloud:7233
-      TEMPORAL_NAMESPACE: ${{ vars.TEMPORAL_CLIENT_NAMESPACE }}
-      TEMPORAL_CLIENT_CERT: ${{ secrets.TEMPORAL_CLIENT_CERT }}
-      TEMPORAL_CLIENT_KEY: ${{ secrets.TEMPORAL_CLIENT_KEY }}
+      TEMPORAL_CLIENT_CLOUD_API_VERSION: v0.19.1
     timeout-minutes: ${{ github.ref == 'refs/heads/main' && 25 || 20 }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/actions/setup
         with:
           mise-install-args: protoc
-      - run: cargo test --features=test-utilities --test cloud_tests
+      - env:
+          TEMPORAL_CLOUD_ADDRESS: https://${{ vars.TEMPORAL_CLIENT_NAMESPACE }}.tmprl.cloud:7233
+          TEMPORAL_NAMESPACE: ${{ vars.TEMPORAL_CLIENT_NAMESPACE }}
+          TEMPORAL_CLIENT_CERT: ${{ secrets.TEMPORAL_CLIENT_CERT }}
+          TEMPORAL_CLIENT_KEY: ${{ secrets.TEMPORAL_CLIENT_KEY }}
+        run: cargo test --features=test-utilities,temporalio-sdk/experimental --test cloud_tests
+      - name: Generate Cloud test certificates
+        run: |
+          umask 077
+          cert_dir="$RUNNER_TEMP/cloud-test-certs"
+          mkdir "$cert_dir"
+          openssl req -x509 -newkey rsa:2048 -nodes -days 1 \
+            -keyout "$cert_dir/ca.key" -out "$cert_dir/ca.pem" \
+            -subj '/CN=Temporal Rust SDK Cloud CI CA'
+          openssl req -newkey rsa:2048 -nodes \
+            -keyout "$cert_dir/client.key" -out "$cert_dir/client.csr" \
+            -subj '/CN=Temporal Rust SDK Cloud CI'
+          openssl x509 -req -days 1 -in "$cert_dir/client.csr" \
+            -CA "$cert_dir/ca.pem" -CAkey "$cert_dir/ca.key" -CAcreateserial \
+            -out "$cert_dir/client.pem" -extfile <(printf 'extendedKeyUsage=clientAuth')
+          {
+            echo "TEMPORAL_CLOUD_CLIENT_CA_PATH=$cert_dir/ca.pem"
+            echo "TEMPORAL_TLS_CLIENT_CERT_PATH=$cert_dir/client.pem"
+            echo "TEMPORAL_TLS_CLIENT_KEY_PATH=$cert_dir/client.key"
+          } >> "$GITHUB_ENV"
+      - name: Create Cloud namespace
+        id: create-cloud-namespace
+        env:
+          TEMPORAL_CLIENT_CLOUD_API_KEY: ${{ secrets.TEMPORAL_CLIENT_CLOUD_API_KEY }}
+        run: cargo integ-test cloud-namespace create
+      - name: Run Cloud-eligible integration tests
+        timeout-minutes: 20
+        env:
+          TEMPORAL_ADDRESS: ${{ steps.create-cloud-namespace.outputs.namespace }}.tmprl.cloud:7233
+          TEMPORAL_NAMESPACE: ${{ steps.create-cloud-namespace.outputs.namespace }}
+        run: |
+          set -o pipefail
+          cargo integ-test -s envconfig --cloud 2>&1 | tee cloud-integration.log
+      - name: Delete Cloud namespace
+        id: delete-cloud-namespace
+        if: ${{ always() && steps.create-cloud-namespace.outputs.namespace != '' }}
+        continue-on-error: true
+        env:
+          TEMPORAL_CLIENT_CLOUD_API_KEY: ${{ secrets.TEMPORAL_CLIENT_CLOUD_API_KEY }}
+        run: cargo integ-test cloud-namespace delete "${{ steps.create-cloud-namespace.outputs.namespace }}"
+      - name: Report Cloud namespace cleanup failure
+        if: ${{ always() && steps.delete-cloud-namespace.outcome == 'failure' }}
+        run: echo "::warning title=Cloud namespace cleanup failed::Failed to delete Cloud namespace ${{ steps.create-cloud-namespace.outputs.namespace }}"
+      - name: Upload Cloud test output
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: cloud-integration-tests-output
+          path: cloud-integration.log
+          if-no-files-found: ignore
+          retention-days: 14
 
   docker-integ-tests:
     name: Docker integ tests
@@ -203,7 +273,7 @@ jobs:
         with:
           mise-install-args: protoc
       - name: Start container for otel-collector and prometheus
-        uses: hoverkraft-tech/compose-action@d2bee4f07e8ca410d6b196d00f90c12e7d48c33a # v2.6.0
+        uses: hoverkraft-tech/compose-action@ee6af68587292d72db67743171809c19787df4c9 # v3.1.0
         with:
           compose-file: ./etc/docker/docker-compose-ci.yaml
       - run: cargo integ-test docker_
@@ -223,11 +293,23 @@ jobs:
           )"
           test -x "$integ_test_binary"
           test -x "$integ_runner_binary"
+          # The CLI is cached under a version-derived name, so the container only finds the one
+          # the previous step downloaded if it asks for the same version. Cargo's `[env]` does not
+          # reach a directly invoked binary, hence passing the pin, if any, explicitly.
+          cli_version_override="$(
+            sed -n 's/^CLI_VERSION_OVERRIDE = "\(.*\)"$/\1/p' .cargo/config.toml
+          )"
+          cli_version_env=()
+          if [ -n "$cli_version_override" ]; then
+            cli_version_env=(--env "CLI_VERSION_OVERRIDE=$cli_version_override")
+          fi
           docker run --rm \
             --env TMPDIR="$RUNNER_TEMP" \
             --env TEMPORAL_TEST_EXPECT_DOCKER=true \
+            "${cli_version_env[@]}" \
             --volume "$RUNNER_TEMP:$RUNNER_TEMP" \
             --volume "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" \
+            --volume /etc/ssl/certs/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt:ro \
             --workdir "$GITHUB_WORKSPACE" \
             ubuntu:24.04 \
             "$integ_runner_binary" --test-executable "$integ_test_binary" \

.github/workflows/sdk-sentinel-pr-responder.yml

@@ -0,0 +1,57 @@
+name: SDK Sentinel PR responder relay
+
+on:
+  issue_comment:
+    types: [created]
+
+permissions: {}
+
+jobs:
+  relay:
+    if: >-
+      github.event.issue.pull_request &&
+      github.event.comment.user.login != 'sdk-sentinel-bot' &&
+      contains(github.event.comment.body, '@sdk-sentinel-bot') &&
+      contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Mint a Sentinel-only dispatch token from the Relay App
+        id: dispatch-token
+        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
+        with:
+          app-id: ${{ vars.SDK_SENTINEL_RELAY_APP_ID }}
+          private-key: ${{ secrets.SDK_SENTINEL_RELAY_PRIVATE_KEY }}
+          owner: temporalio
+          repositories: sdk-sentinel
+          permission-actions: write
+          permission-metadata: read
+      - name: Verify the Sentinel Relay installation
+        env:
+          ACTUAL_APP_SLUG: ${{ steps.dispatch-token.outputs.app-slug }}
+          ACTUAL_INSTALLATION_ID: ${{ steps.dispatch-token.outputs.installation-id }}
+          EXPECTED_INSTALLATION_ID: ${{ vars.SDK_SENTINEL_RELAY_INSTALLATION_ID }}
+        run: |
+          test "$ACTUAL_APP_SLUG" = sdk-sentinel-relay
+          test "$ACTUAL_INSTALLATION_ID" = "$EXPECTED_INSTALLATION_ID"
+      - name: Dispatch the trusted central responder
+        env:
+          COMMENT_ID: ${{ github.event.comment.id }}
+          DISPATCH_TOKEN: ${{ steps.dispatch-token.outputs.token }}
+          PR_NUMBER: ${{ github.event.issue.number }}
+          TARGET_ID: rust
+        run: |
+          payload="$(
+            jq -cn \
+              --arg target "$TARGET_ID" \
+              --arg pr_number "$PR_NUMBER" \
+              --arg comment_id "$COMMENT_ID" \
+              '{ref:"main",inputs:{target:$target,pr_number:$pr_number,comment_id:$comment_id}}'
+          )"
+          curl --fail --silent --show-error \
+            --request POST \
+            --header "Accept: application/vnd.github+json" \
+            --header "Authorization: Bearer $DISPATCH_TOKEN" \
+            --header "X-GitHub-Api-Version: 2022-11-28" \
+            --data "$payload" \
+            https://api.github.com/repos/temporalio/sdk-sentinel/actions/workflows/sdk-pr-responder.yml/dispatches