Merge branch 'develop' into ngates/arrow-executor

Author: gatesn

.github/release-drafter.yml

@@ -1,4 +1,4 @@
-name-template: "🌪 $RESOLVED_VERSION"
+name-template: "$RESOLVED_VERSION"
 tag-template: "$RESOLVED_VERSION"
 categories:
   - title: "⚠️ Breaks"
@@ -36,6 +36,9 @@ version-resolver:
       - "wire-break"
   default: patch
 
+exclude-labels:
+  - "skip-changelog"
+
 template: |
   ## Changes
 

.github/workflows/bench-pr.yml

@@ -2,11 +2,17 @@
 
 name: PR Benchmarks
 
+concurrency:
+  # The group causes runs to queue instead of running in parallel.
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  # Don't cancel benchmarks that are already running, instead just queue them up.
+  cancel-in-progress: false
+
 on:
   pull_request:
     types: [labeled, synchronize]
     branches: ["develop"]
-  workflow_dispatch: {}
+  workflow_dispatch: { }
 
 permissions:
   actions: write  # for removing labels

.github/workflows/ci.yml

@@ -1,14 +1,18 @@
 name: CI
 
+# Concurrency control:
+# - PRs: new commits on a feature branch will cancel in-progress (outdated) runs.
+# - Push to develop: runs queue sequentially, never cancelled. This allows us to have benchmarks
+#   run on every commit for our benchmarks website.
+# - `workflow_dispatch`: groups by branch and queues if run on develop.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/develop' }}
-
 on:
   push:
-    branches: ["develop"]
-  pull_request: {}
-  workflow_dispatch: {}
+    branches: [develop]
+  pull_request: { }
+  workflow_dispatch: { }
 
 permissions:
   actions: read
@@ -38,8 +42,7 @@ jobs:
           # Lint the workflows and yamllint's configuration file.
           yamllint \
             --strict \
-            -c yamllint-config.yaml \
-            yamllint-config.yaml \
+            -c .yamllint.yaml \
             .github/
 
   python-lint:
@@ -311,6 +314,43 @@ jobs:
           # https://spiraldb.slack.com/archives/C07BV3GKAJ2/p1732736281946729
           cargo hack clippy --no-default-features -- -D warnings
 
+  rust-semver:
+    name: "Rust (semver checks)"
+    timeout-minutes: 120
+    if: github.ref != 'refs/heads/develop'
+    runs-on:
+      - runs-on=${{ github.run_id }}
+      - family=m7i+m7i-flex+m7a
+      - cpu=16
+      - image=ubuntu24-full-x64
+      - extras=s3-cache
+      - tag=rust-semver
+    steps:
+      - uses: runs-on/action@v2
+        with:
+          sccache: s3
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+      - uses: ./.github/actions/setup-rust
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+
+      # We have to set the correct Cargo.toml versions so semver checks uses the previous release.
+      - name: Latest Tag
+        id: latest-tag
+        run: |
+          LATEST_TAG=$(git describe --tags --abbrev=0)
+          echo "tag=$LATEST_TAG" >> $GITHUB_OUTPUT
+      - name: Cargo Set Version
+        run: |
+          cargo install cargo-edit
+          cargo set-version --workspace ${{ steps.latest-tag.outputs.tag }}
+
+      - name: Check semver
+        uses: obi1kenobi/cargo-semver-checks-action@v2
+
   rust-coverage:
     name: "Rust tests (coverage)"
     timeout-minutes: 120
@@ -351,6 +391,8 @@ jobs:
           tool: nextest
       - name: Rust Tests
         if: ${{ matrix.suite == 'tests' }}
+        env:
+          RUSTFLAGS: "-Cinstrument-coverage -A warnings --cfg vortex_nightly"
         run: |
           cargo +nightly nextest run --locked --workspace --all-features --no-fail-fast
       - name: Run TPC-H
@@ -397,7 +439,7 @@ jobs:
       - tag=rust-test-sanitizer
     env:
       # Add debug symbols and enable ASAN/LSAN with better output
-      RUSTFLAGS: "-A warnings -Zsanitizer=address -Zsanitizer=leak --cfg disable_loom -C debuginfo=2 -C opt-level=0 -C strip=none"
+      RUSTFLAGS: "-A warnings -Zsanitizer=address -Zsanitizer=leak --cfg disable_loom --cfg vortex_nightly -C debuginfo=2 -C opt-level=0 -C strip=none"
       ASAN_OPTIONS: "symbolize=1:print_stats=1:check_initialization_order=1:detect_leaks=1:halt_on_error=0:verbosity=1:leak_check_at_exit=1"
       LSAN_OPTIONS: "verbosity=1:report_objects=1"
       ASAN_SYMBOLIZER_PATH: "/usr/bin/llvm-symbolizer"
@@ -637,7 +679,7 @@ jobs:
     timeout-minutes: 120
     env:
       MIRIFLAGS: -Zmiri-strict-provenance -Zmiri-symbolic-alignment-check -Zmiri-disable-isolation -Zmiri-env-forward=RUST_BACKTRACE
-      RUSTFLAGS: "-A warnings"
+      RUSTFLAGS: "-A warnings --cfg vortex_nightly"
       RUST_BACKTRACE: full
     steps:
       - uses: actions/checkout@v6

.github/workflows/claude.yml

@@ -1,5 +1,10 @@
 name: Claude Code
 
+concurrency:
+  # We shouldn't have multiple instances of Claude running on the same PR.
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 on:
   issue_comment:
     types: [created]

.github/workflows/docs.yml

@@ -1,9 +1,13 @@
 name: Vortex Docs
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
 on:
   push:
     branches: [develop]
-  workflow_dispatch: {}
+  workflow_dispatch: { }
 
 permissions:
   contents: read

.github/workflows/fuzz.yml

@@ -1,9 +1,16 @@
 name: Fuzz
 
+concurrency:
+  # The group causes runs to queue instead of running in parallel.
+  group: fuzz
+  # This ensures each run builds on the previous run's corpus discoveries rather than losing them to
+  # failed compare-and-swap uploads.
+  cancel-in-progress: false
+
 on:
   schedule:
     - cron: "0 */4 * * *"  # every 4 hours
-  workflow_dispatch:
+  workflow_dispatch: { }
 
 jobs:
   io_fuzz:
@@ -49,7 +56,7 @@ jobs:
       - name: Run fuzzing target
         id: fuzz
         run: |
-          RUST_BACKTRACE=1 cargo +nightly fuzz run --release --debug-assertions file_io -- -max_total_time=7200 2>&1 | tee fuzz_output.log
+          RUSTFLAGS="--cfg vortex_nightly" RUST_BACKTRACE=1 cargo +nightly fuzz run --release --debug-assertions file_io -- -max_total_time=7200 2>&1 | tee fuzz_output.log
         continue-on-error: true
       - name: Check for crashes
         id: check
@@ -182,7 +189,7 @@ jobs:
       - name: Run fuzzing target
         id: fuzz
         run: |
-          RUST_BACKTRACE=1 cargo +nightly fuzz run --release --debug-assertions array_ops -- -max_total_time=7200 2>&1 | tee fuzz_output.log
+          RUSTFLAGS="--cfg vortex_nightly" RUST_BACKTRACE=1 cargo +nightly fuzz run --release --debug-assertions array_ops -- -max_total_time=7200 2>&1 | tee fuzz_output.log
         continue-on-error: true
       - name: Check for crashes
         id: check

.github/workflows/fuzzer-fix-automation.yml

@@ -1,5 +1,9 @@
 name: Fuzzer Fix Automation
 
+concurrency:
+  group: fuzzer-fix-${{ inputs.issue_number || github.run_id }}
+  cancel-in-progress: true
+
 on:
   workflow_dispatch:
     inputs:
@@ -163,7 +167,7 @@ jobs:
           echo "Building fuzzer target: ${{ steps.extract.outputs.target }} (debug mode for faster build)"
 
           # Build the fuzzer target in debug mode (faster than release)
-          if cargo +nightly fuzz build --dev --sanitizer=none "${{ steps.extract.outputs.target }}" 2>&1 | tee fuzzer_build.log; then
+          if RUSTFLAGS="--cfg vortex_nightly" cargo +nightly fuzz build --dev --sanitizer=none "${{ steps.extract.outputs.target }}" 2>&1 | tee fuzzer_build.log; then
             echo "✅ Fuzzer target built successfully"
             echo "build_success=true" >> $GITHUB_OUTPUT
           else
@@ -183,7 +187,7 @@ jobs:
           echo "Attempting to reproduce crash with fuzzer (debug mode)..."
 
           # Run fuzzer with crash file (debug mode, no sanitizer, full backtrace)
-          RUST_BACKTRACE=full timeout 30s cargo +nightly fuzz run --dev --sanitizer=none "${{ steps.extract.outputs.target }}" "${{ steps.download.outputs.crash_file_path }}" -- -runs=1 2>&1 | tee crash_reproduction.log
+          RUSTFLAGS="--cfg vortex_nightly" RUST_BACKTRACE=full timeout 30s cargo +nightly fuzz run --dev --sanitizer=none "${{ steps.extract.outputs.target }}" "${{ steps.download.outputs.crash_file_path }}" -- -runs=1 2>&1 | tee crash_reproduction.log
 
           FUZZ_EXIT_CODE=${PIPESTATUS[0]}
 

.github/workflows/labels.yml

@@ -1,8 +1,13 @@
 name: PR Labels
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
 on:
   pull_request:
-    types: [opened, reopened, synchronize, labeled, unlabeled]  # Trigger on these PR activities
+    # Trigger on these PR activities
+    types: [opened, reopened, synchronize, labeled, unlabeled]
 
 jobs:
   check_changelog_label:
@@ -34,6 +39,7 @@ jobs:
             "performance"
             "break"
             "wire-break"
+            "skip-changelog"
           )
           REQUIRED_LABELS_JSON=$(jq -n '$ARGS.positional' --args "${REQUIRED_LABELS[@]}")
           echo "Required Labels: $REQUIRED_LABELS_JSON"

.github/workflows/minimize_fuzz_corpus.yml

@@ -1,7 +1,13 @@
 name: Minimize Fuzz Corpus
 
+concurrency:
+  # The group causes runs to queue instead of running in parallel.
+  group: minimize-corpus
+  # This prevents one run from overwriting another's minimization work (no compare-and-swap used).
+  cancel-in-progress: false
+
 on:
-  workflow_dispatch:
+  workflow_dispatch: { }
 
 jobs:
   io_fuzz_minimize:

.github/workflows/nightly-bench.yml

@@ -1,9 +1,15 @@
 name: Nightly Benchmarks
 
+concurrency:
+  # The group causes runs to queue instead of running in parallel.
+  group: nightly-bench
+  # This queues manual triggers to run after scheduled benchmarks complete.
+  cancel-in-progress: false
+
 on:
   schedule:
     - cron: "0 0 * * *"  # daily
-  workflow_dispatch:
+  workflow_dispatch: { }
 
 permissions:
   id-token: write  # enables AWS-GitHub OIDC