Publish prebuilt FlowScope CLI binaries

.github/workflows/ci.yml

@@ -353,6 +353,7 @@ jobs:
 
       - name: Upload to Codecov
         uses: codecov/codecov-action@v5
+        continue-on-error: ${{ github.repository != 'pondpilot/flowscope' }}
         with:
           disable_search: true
           fail_ci_if_error: true

.github/workflows/publish-core.yml

@@ -21,6 +21,9 @@ env:
 jobs:
   publish-packages:
     name: Publish crates and core npm package
+    # Forks may use this workflow to test CLI release assets, but must never
+    # publish packages to the public registries.
+    if: ${{ github.repository == 'pondpilot/flowscope' }}
     runs-on: ubuntu-latest
     environment: prod
     env:
@@ -147,3 +150,273 @@ jobs:
           fi
         env:
           NODE_AUTH_TOKEN: ''
+
+  build-cli-linux-binaries:
+    name: Build CLI (${{ matrix.platform.name }})
+    runs-on: ${{ matrix.platform.runs-on }}
+    # Build against an older glibc so the published binaries run on common
+    # long-term-support distributions. The image supports both amd64 and arm64.
+    container:
+      image: rust:1.95-bullseye@sha256:28afaeb8445f2a2e7d878bd34ed39ba02bb517efb29986188cbd59b7cf4f2fdf
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - name: Linux x86_64
+            runs-on: ubuntu-24.04
+            target: x86_64-unknown-linux-gnu
+          - name: Linux aarch64
+            runs-on: ubuntu-24.04-arm
+            target: aarch64-unknown-linux-gnu
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Resolve CLI version
+        id: cli_version
+        shell: bash
+        run: |
+          python3 - <<'PY' >> "$GITHUB_OUTPUT"
+          import pathlib
+          import re
+
+          data = pathlib.Path('Cargo.toml').read_text()
+          match = re.search(r'^version\s*=\s*"([^"]+)"', data, re.MULTILINE)
+          if not match:
+              raise SystemExit('Could not find workspace version in Cargo.toml')
+          print(f"version={match.group(1)}")
+          PY
+
+      - name: Verify release tag
+        if: ${{ github.ref_type == 'tag' }}
+        shell: bash
+        env:
+          CLI_VERSION: ${{ steps.cli_version.outputs.version }}
+        run: |
+          set -euo pipefail
+          expected_tag="v${CLI_VERSION}"
+          if [[ "$GITHUB_REF_NAME" != "$expected_tag" ]]; then
+            echo "Release tag '$GITHUB_REF_NAME' does not match CLI version '$CLI_VERSION'."
+            exit 1
+          fi
+
+      - name: Build CLI binary
+        run: |
+          cargo build -p flowscope-cli --release --locked
+          strip target/release/flowscope
+
+      - name: Smoke test CLI on glibc 2.31
+        run: target/release/flowscope --version
+
+      - name: Package CLI archive
+        uses: houseabsolute/actions-rust-release@v1
+        with:
+          executable-name: flowscope
+          archive-name: flowscope-v${{ steps.cli_version.outputs.version }}-${{ matrix.platform.target }}
+          changes-file: ''
+          extra-files: README.md
+
+  build-cli-other-binaries:
+    name: Build CLI (${{ matrix.platform.name }})
+    runs-on: ${{ matrix.platform.runs-on }}
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - name: macOS x86_64
+            runs-on: macos-15-intel
+            target: x86_64-apple-darwin
+          - name: macOS aarch64
+            runs-on: macos-15
+            target: aarch64-apple-darwin
+          - name: Windows x86_64
+            runs-on: windows-2022
+            target: x86_64-pc-windows-msvc
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Resolve CLI version
+        id: cli_version
+        shell: bash
+        run: |
+          python - <<'PY' >> "$GITHUB_OUTPUT"
+          import pathlib
+          import re
+
+          data = pathlib.Path('Cargo.toml').read_text()
+          match = re.search(r'^version\s*=\s*"([^"]+)"', data, re.MULTILINE)
+          if not match:
+              raise SystemExit('Could not find workspace version in Cargo.toml')
+          print(f"version={match.group(1)}")
+          PY
+
+      - name: Verify release tag
+        if: ${{ github.ref_type == 'tag' }}
+        shell: bash
+        env:
+          CLI_VERSION: ${{ steps.cli_version.outputs.version }}
+        run: |
+          set -euo pipefail
+          expected_tag="v${CLI_VERSION}"
+          if [[ "$GITHUB_REF_NAME" != "$expected_tag" ]]; then
+            echo "Release tag '$GITHUB_REF_NAME' does not match CLI version '$CLI_VERSION'."
+            exit 1
+          fi
+
+      - name: Build CLI binary
+        uses: houseabsolute/actions-rust-cross@v1
+        with:
+          command: build
+          target: ${{ matrix.platform.target }}
+          args: '--package flowscope-cli --locked --release'
+          strip: true
+
+      - name: Package CLI archive
+        uses: houseabsolute/actions-rust-release@v1
+        with:
+          executable-name: flowscope
+          target: ${{ matrix.platform.target }}
+          archive-name: flowscope-v${{ steps.cli_version.outputs.version }}-${{ matrix.platform.target }}
+          changes-file: ''
+          extra-files: README.md
+
+  publish-cli-binaries:
+    name: Publish CLI binaries
+    needs:
+      - publish-packages
+      - build-cli-linux-binaries
+      - build-cli-other-binaries
+    if: >-
+      ${{
+        always() &&
+        github.ref_type == 'tag' &&
+        (github.event_name == 'push' || inputs.dry_run != 'true') &&
+        needs['build-cli-linux-binaries'].result == 'success' &&
+        needs['build-cli-other-binaries'].result == 'success' &&
+        (
+          github.repository != 'pondpilot/flowscope' ||
+          needs['publish-packages'].result == 'success'
+        )
+      }}
+    runs-on: ubuntu-24.04
+    permissions:
+      actions: read
+      attestations: write
+      contents: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download packaged CLI assets
+        uses: actions/download-artifact@v4
+        with:
+          pattern: flowscope-v*
+          path: release-assets
+          merge-multiple: true
+
+      - name: Generate aggregate SHA-256 checksums
+        shell: bash
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          mapfile -t archives < <(
+            find release-assets -maxdepth 1 -type f \
+              \( -name 'flowscope-*.tar.gz' -o -name 'flowscope-*.zip' \) \
+              -printf '%f\n' | sort
+          )
+          if [[ "${#archives[@]}" -ne 5 ]]; then
+            echo "Expected five CLI archives, found ${#archives[@]}."
+            printf '%s\n' "${archives[@]}"
+            exit 1
+          fi
+          (
+            cd release-assets
+            sha256sum "${archives[@]}" > "flowscope-${RELEASE_TAG}-SHA256SUMS"
+          )
+
+      - name: Upload aggregate checksum artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: flowscope-${{ github.ref_name }}-SHA256SUMS
+          path: release-assets/flowscope-${{ github.ref_name }}-SHA256SUMS
+          if-no-files-found: error
+
+      - name: Attest CLI release assets
+        uses: actions/attest-build-provenance@v4
+        with:
+          subject-path: |
+            release-assets/*.tar.gz
+            release-assets/*.zip
+            release-assets/*.sha256
+            release-assets/*SHA256SUMS
+
+      - name: Publish CLI release
+        uses: houseabsolute/actions-rust-release/publish@v1
+        with:
+          executable-name: flowscope
+          artifact-regex: '\Aflowscope-v.*(\.tar\.gz|\.zip|-SHA256SUMS)\Z'
+          changes-file: ''
+          generate-release-notes: true
+
+  publish-fork-core-package:
+    name: Publish fork core package asset
+    needs: publish-cli-binaries
+    if: ${{ github.repository != 'pondpilot/flowscope' && github.ref_type == 'tag' && needs.publish-cli-binaries.result == 'success' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@1.95.0
+        with:
+          targets: wasm32-unknown-unknown
+
+      - name: Install wasm-pack
+        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: yarn
+
+      - name: Install dependencies
+        run: yarn install --frozen-lockfile
+
+      - name: Build core package
+        run: yarn workspace @pondpilot/flowscope-core build
+
+      - name: Run core package tests
+        run: yarn workspace @pondpilot/flowscope-core test --silent
+
+      - name: Pack core package
+        working-directory: packages/core
+        run: |
+          mkdir -p ../../release-assets
+          npm pack --workspaces=false --pack-destination ../../release-assets
+          package=$(find ../../release-assets -maxdepth 1 -name '*.tgz' -print -quit)
+          test -n "$package"
+          mv "$package" "../../release-assets/flowscope-core-${GITHUB_REF_NAME}.tgz"
+
+      - name: Generate package checksum
+        run: |
+          set -euo pipefail
+          sha256sum "release-assets/flowscope-core-${GITHUB_REF_NAME}.tgz" \
+            > "release-assets/flowscope-core-${GITHUB_REF_NAME}-SHA256SUMS"
+
+      - name: Upload core package assets
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release upload "$GITHUB_REF_NAME" \
+            "release-assets/flowscope-core-${GITHUB_REF_NAME}.tgz" \
+            "release-assets/flowscope-core-${GITHUB_REF_NAME}-SHA256SUMS" \
+            --clobber

CHANGELOG.md

@@ -11,6 +11,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Kept `@pondpilot/flowscope-react` as a private monorepo workspace and removed it from the npm release pipeline
 
+## [0.9.1] - 2026-09-16
+
+### Fixed
+
+- Improved MSSQL batch handling, multi-file diagnostic attribution, CLI lint metadata, and HTML/CSV/XLSX issue exports.
+- Preserved WASM HTML and filename export metadata from TypeScript callers.
+
+### Added
+
+- QUALIFY filter attribution and parsed OPENJSON/XMLTABLE source extraction.
+- Fork release assets for the CLI and the built core npm package.
+
 ## [0.9.0] - 2026-08-12
 
 ### Added

Cargo.toml

@@ -8,15 +8,15 @@ members = [
 resolver = "2"
 
 [workspace.package]
-version = "0.9.0"
+version = "0.9.1"
 authors = ["PondPilot Team"]
 edition = "2021"
 license = "Apache-2.0"
 repository = "https://github.com/pondpilot/flowscope"
 
 [workspace.dependencies]
-flowscope-core = { version = "0.9.0", path = "crates/flowscope-core", default-features = false }
-flowscope-export = { version = "0.9.0", path = "crates/flowscope-export", default-features = false }
+flowscope-core = { version = "0.9.1", path = "crates/flowscope-core", default-features = false }
+flowscope-export = { version = "0.9.1", path = "crates/flowscope-export", default-features = false }
 sqlparser = "0.61"
 serde = { version = "1.0", features = ["derive", "rc"] }
 serde_json = "1.0"

crates/flowscope-cli/src/main.rs

@@ -486,6 +486,18 @@ fn to_file_lint_result(
                 code: i.code.clone(),
                 message: i.message.clone(),
                 severity: i.severity,
+                metadata: {
+                    let mut metadata = serde_json::to_value(i).unwrap_or(serde_json::Value::Null);
+                    if let Some(object) = metadata.as_object_mut() {
+                        object.insert(
+                            "sourceName".to_string(),
+                            serde_json::Value::String(
+                                i.source_name.clone().unwrap_or_else(|| source.name.clone()),
+                            ),
+                        );
+                    }
+                    metadata
+                },
             }
         })
         .collect();