[szymeo]

Summary

ci: release automatically from conventional commits

Publish malini/01JCECE4BA8D75944779F5EABA against main.

• .github/workflows/check-deployed-package.yml
• .github/workflows/ci.yml
• .github/workflows/pr-title.yml
• check-deployed-package/README.md
• scripts/version.ts

Validation

• Passed - Validation: cargo fmt --all -- --check; cargo clippy --all --tests --no-deps; cargo test
• Passed - Validation: cargo fmt --all -- --check; cargo clippy --all --tests --no-deps; cargo clippy --all --tests --no-deps…
• Passed - Validation: cargo clippy --all --tests --no-deps
• Passed - Validation: cargo clippy --all --tests --no-deps -- -D warnings; cargo clippy --all --tests --no-deps --no-default-features…
• Passed - Validation: cargo build; cargo build
• Passed - Validation: node --test 'scripts/*.test.ts'
• Passed - Validation: node --test 'scripts/.test.ts'; node --test 'scripts/.test.ts'

[szymeo]

Lead review: logdash moved from services to domains, so the smoke test must use the domain model instead of a project.

• LOGDASH_API_KEY becomes the ingest key of one shared domain, "SDK smoke tests" (its Settings page, "Ingest key": one write-only key for every app on the domain). The owner adds it, replacing this repo's old per-service key.
• Send with the SDK's app option set to rust-sdk, so each SDK shows up as its own app on that domain.
• LOGDASH_PERSONAL_API_KEY is a read-only key (Logs read, Metrics read) restricted to that domain. GET https://api.logdash.io/personal-api-keys/whoami returns access: { kind: "clusters", ids: [domainId] }. Fail with a clear message unless the kind is clusters and there is an id.
• Read logs from GET /clusters/{domainId}/logs?apps=rust-sdk (narrowed to this run's seed) and metrics from GET /clusters/{domainId}/metrics (each entry has app, name, value: match on app and name), both with the same bearer. Drop /projects/{id}/....
• Never print an API key, not even one CI masks.

Check paths, query params and response shapes against logdash-io/logdash.io: apps/backend/src/log/core/log-core.controller.ts (readClusterLogs, ReadClusterLogsQuery in log/core/dto/cluster-logs.query.ts) and apps/backend/src/metric/core/metric-core.controller.ts (readClusterMetrics). The check program needs the app option, so it runs against the version this PR releases; before that, a manual run on this branch is not expected to pass.

[szymeo]

Lead review: no blocking code findings (release computes 1.1.0, publishes once before tagging, smoke test pins logdash@=$V, endpoints match the backend). Fix these before merge:

• ci.yml ~125: replace secrets: inherit, which hands CARGO_REGISTRY_TOKEN to the smoke test, with only LOGDASH_API_KEY and LOGDASH_PERSONAL_API_KEY, declared under the smoke workflow's workflow_call.
• ci.yml ~104: persist-credentials: false on the release checkout, so the write token is not on disk while cargo publish runs dependency build scripts.
• ci.yml ~112, make the release re-runnable: skip the publish when the version is already in the index, e.g. curl -fsS https://index.crates.io/lo/gd/logdash | grep -qF "\"vers\":\"$V\"" || cargo publish --allow-dirty, then tag, so a rerun after a failed gh release create just tags.
• pr-title.yml: permissions: {} above jobs:; check-deployed-package.yml: permissions: contents: read.
• scripts/version.ts ~4: the comment still names tony's Info.plist; say the Cargo.toml version is the placeholder CI overwrites. check-deployed-package/README.md ~12: say the check needs a version with Config::app (1.1.0 or later).

LOGDASH_PERSONAL_API_KEY is coming from the owner; LOGDASH_API_KEY is already the smoke-test domain's ingest key.