chore: align admina-core to 0.9.2 + CI version-alignment guard

Author: stefanoferi

.github/workflows/ci.yml

@@ -21,6 +21,19 @@ on:
     branches: [main]
 
 jobs:
+  # ── Version alignment ───────────────────────────────────────
+  # Cross-manifest guard: pyproject (framework), __init__, core-rust
+  # (pyproject + Cargo.toml + Cargo.lock) must all carry the same
+  # version.  Independent of release-time tag checks; catches drift
+  # at PR time.
+  versions:
+    name: Version alignment
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - name: Check artefact versions are aligned
+        run: python3 scripts/check-versions.py
+
   # ── Python: lint ────────────────────────────────────────────
   lint:
     name: Python Lint

CHANGELOG.md

@@ -44,6 +44,14 @@ seeing a working `admina dev` after `pip install`.
 
 - Funding link in `.github/FUNDING.yml` points to the dedicated sponsor
   landing page (`https://admina.org/sponsor/`).
+- **admina-core bumped to 0.9.2 (sync release)** — no Rust changes,
+  but the crate / wheel / sdist versions now track admina-framework so
+  the two artefacts always carry the same number on PyPI, crates.io,
+  and ghcr.io. From this release on, every published artefact in the
+  monorepo (admina-framework, admina-core, admina-proxy image,
+  admina-dashboard image) ships with the same version. A new CI job
+  (`scripts/check-versions.py`) blocks PRs that drift the manifests
+  out of alignment.
 
 ---
 

core-rust/Cargo.lock

@@ -15,7 +15,7 @@
 
 [package]
 name = "admina_core"
-version = "0.9.1"
+version = "0.9.2"
 edition = "2021"
 description = "Admina governance engines — Rust core with Python bindings"
 license = "Apache-2.0"

core-rust/Cargo.toml

@@ -19,7 +19,7 @@ build-backend = "maturin"
 
 [project]
 name = "admina-core"
-version = "0.9.1"
+version = "0.9.2"
 description = "Admina governance engines — Rust core with Python bindings (firewall, PII, loop breaker, hash chain)"
 readme = "README.md"
 requires-python = ">=3.11"

core-rust/pyproject.toml

@@ -0,0 +1,102 @@
+#!/usr/bin/env python3
+
+# Copyright © 2025–2026 Stefano Noferi & Admina contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Assert all admina artefact versions are aligned.
+
+Run from the repository root.  Exits non-zero (and prints a table) when
+any of the tracked manifests disagrees with the canonical version in
+``pyproject.toml``.
+
+Tracked points of truth:
+    1. pyproject.toml                 →  admina-framework  (canonical)
+    2. admina/__init__.py             →  runtime __version__
+    3. core-rust/pyproject.toml       →  admina-core       (PyPI)
+    4. core-rust/Cargo.toml           →  admina_core crate
+    5. core-rust/Cargo.lock           →  resolved admina_core entry
+
+Docker images and dashboard HTML derive their version dynamically from
+pyproject.toml at build time, so they need no separate check here.
+"""
+
+from __future__ import annotations
+
+import re
+import sys
+import tomllib
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+
+
+def _toml_version(path: Path, *, table: str = "project") -> str:
+    data = tomllib.loads(path.read_text(encoding="utf-8"))
+    if table == "project":
+        return data["project"]["version"]
+    if table == "package":
+        return data["package"]["version"]
+    raise ValueError(f"unknown table {table!r}")
+
+
+def _python_dunder_version(path: Path) -> str:
+    m = re.search(r'__version__\s*=\s*"([^"]+)"', path.read_text(encoding="utf-8"))
+    if not m:
+        raise RuntimeError(f"__version__ not found in {path}")
+    return m.group(1)
+
+
+def _cargo_lock_admina_core(path: Path) -> str:
+    """Pull the `version = "..."` line that follows `name = "admina_core"`."""
+    text = path.read_text(encoding="utf-8")
+    m = re.search(r'name = "admina_core"\s*\nversion = "([^"]+)"', text)
+    if not m:
+        raise RuntimeError("admina_core entry not found in Cargo.lock")
+    return m.group(1)
+
+
+def main() -> int:
+    versions: dict[str, str] = {
+        "pyproject.toml": _toml_version(REPO / "pyproject.toml"),
+        "admina/__init__.py": _python_dunder_version(REPO / "admina" / "__init__.py"),
+        "core-rust/pyproject.toml": _toml_version(REPO / "core-rust" / "pyproject.toml"),
+        "core-rust/Cargo.toml": _toml_version(REPO / "core-rust" / "Cargo.toml", table="package"),
+        "core-rust/Cargo.lock": _cargo_lock_admina_core(REPO / "core-rust" / "Cargo.lock"),
+    }
+
+    canonical = versions["pyproject.toml"]
+    width = max(len(p) for p in versions)
+    print(f"Canonical (pyproject.toml): {canonical}\n")
+    print(f"{'File':<{width}}  Version    Status")
+    print(f"{'-' * width}  {'-' * 9}  {'-' * 6}")
+    drift = []
+    for path, ver in versions.items():
+        ok = ver == canonical
+        status = "OK" if ok else "DRIFT"
+        print(f"{path:<{width}}  {ver:<9}  {status}")
+        if not ok:
+            drift.append(path)
+
+    if drift:
+        print(
+            f"\nERROR: {len(drift)} file(s) drift from canonical {canonical}: {', '.join(drift)}",
+            file=sys.stderr,
+        )
+        return 1
+    print("\nAll versions aligned.")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())