chore: prepare pishoo v0.8.0-beta.4

.github/workflows/release.yml

@@ -224,19 +224,34 @@ jobs:
           if [[ "$mode" == "dry-run" ]]; then
             publish_cmd+=(--dry-run)
           fi
-          "${publish_cmd[@]}" deb
+          "${publish_cmd[@]}" --publish-report target/publish-reports/deb.toml deb
 
       - name: Upload deb packages to GitHub Release
         if: github.ref_type == 'tag' && startsWith(github.ref_name, 'v')
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          shopt -s nullglob
-          assets=(target/common/deb/*.deb target/*/release/deb/*.deb)
+          report=target/publish-reports/deb.toml
+          test -f "$report"
+          assets=()
+          while IFS= read -r asset; do
+            assets+=("$asset")
+          done < <(python3 - "$report" <<'PY'
+          import sys
+          import tomllib
+
+          with open(sys.argv[1], "rb") as handle:
+              report = tomllib.load(handle)
+
+          for manifest in report.get("manifests", []):
+              for asset in manifest.get("artifacts", []):
+                  print(asset["local-path"])
+          PY
+          )
           if [ "${#assets[@]}" -eq 0 ]; then
-            echo "no deb release assets found" >&2
-            exit 1
+            echo "no deb release assets selected by publish report; skipping GitHub Release upload"
+            exit 0
           fi
           for attempt in {1..30}; do
             if gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
@@ -258,6 +273,7 @@ jobs:
           if-no-files-found: ignore
           path: |
             gateway/target/common/deb/**
+            gateway/target/publish-reports/*.toml
 
   linux-rpm:
     needs: github-release
@@ -369,19 +385,34 @@ jobs:
           if [[ "$mode" == "dry-run" ]]; then
             publish_cmd+=(--dry-run)
           fi
-          "${publish_cmd[@]}" rpm
+          "${publish_cmd[@]}" --publish-report target/publish-reports/rpm.toml rpm
 
       - name: Upload rpm packages to GitHub Release
         if: github.ref_type == 'tag' && startsWith(github.ref_name, 'v')
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          shopt -s nullglob
-          assets=(target/common/rpm/*.rpm target/*/release/rpm/*.rpm)
+          report=target/publish-reports/rpm.toml
+          test -f "$report"
+          assets=()
+          while IFS= read -r asset; do
+            assets+=("$asset")
+          done < <(python3 - "$report" <<'PY'
+          import sys
+          import tomllib
+
+          with open(sys.argv[1], "rb") as handle:
+              report = tomllib.load(handle)
+
+          for manifest in report.get("manifests", []):
+              for asset in manifest.get("artifacts", []):
+                  print(asset["local-path"])
+          PY
+          )
           if [ "${#assets[@]}" -eq 0 ]; then
-            echo "no rpm release assets found" >&2
-            exit 1
+            echo "no rpm release assets selected by publish report; skipping GitHub Release upload"
+            exit 0
           fi
           for attempt in {1..30}; do
             if gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
@@ -403,6 +434,7 @@ jobs:
           if-no-files-found: ignore
           path: |
             gateway/target/common/rpm/**
+            gateway/target/publish-reports/*.toml
 
   homebrew:
     needs: github-release
@@ -519,7 +551,7 @@ jobs:
           if [[ "$mode" == "dry-run" ]]; then
             publish_cmd+=(--dry-run)
           fi
-          "${publish_cmd[@]}" brew
+          "${publish_cmd[@]}" --publish-report target/publish-reports/brew.toml brew
 
       - name: Create Homebrew tap pull request
         if: github.ref_type == 'tag' && startsWith(github.ref_name, 'v')
@@ -578,11 +610,26 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          shopt -s nullglob
-          assets=(target/*/release/brew/*.tar.gz target/common/brew/pishoo-*.rb)
+          report=target/publish-reports/brew.toml
+          test -f "$report"
+          assets=()
+          while IFS= read -r asset; do
+            assets+=("$asset")
+          done < <(python3 - "$report" <<'PY'
+          import sys
+          import tomllib
+
+          with open(sys.argv[1], "rb") as handle:
+              report = tomllib.load(handle)
+
+          for manifest in report.get("manifests", []):
+              for asset in manifest.get("artifacts", []):
+                  print(asset["local-path"])
+          PY
+          )
           if [ "${#assets[@]}" -eq 0 ]; then
-            echo "no Homebrew release assets found" >&2
-            exit 1
+            echo "no Homebrew release assets selected by publish report; skipping GitHub Release upload"
+            exit 0
           fi
           for attempt in {1..30}; do
             if gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
@@ -604,3 +651,4 @@ jobs:
           if-no-files-found: ignore
           path: |
             gateway/target/common/brew/**
+            gateway/target/publish-reports/*.toml

CHANGELOG.md

@@ -2,6 +2,39 @@
 
 ## Unreleased
 
+## [0.8.0-beta.4] - 2026-07-09
+
+### Added
+
+- pishoo now keeps identity access-rule databases as live policy sources instead
+  of loading only a static in-memory snapshot.
+- Gateway and pishoo access checks now evaluate rules through the shared
+  `dhttp` access policy evaluator trait.
+
+### Changed
+
+- pishoo enables the `dhttp` access ORM facade feature for access-rule database
+  evaluation.
+
+### Fixed
+
+- Release workflows upload package assets from publish reports instead of broad
+  local artifact globs.
+
+### Dependencies
+
+- Release manifests now target `dhttp` v0.5.0-beta.3, `dhttp-access`
+  v0.4.0-beta.1 through the `dhttp` facade, `dhttp-home`
+  v0.4.0-beta.1, `dhttp-identity` v0.3.0-beta.1, `dyns`
+  v0.6.0-beta.3, `h3x` v0.6.0-beta.3, and `dshell`
+  v0.6.0-beta.2.
+
+### Components
+
+- `gateway` v0.8.0-beta.4
+- `pishoo` v0.8.0-beta.4
+- `pishoo-common` v0.5.1-1
+
 ## [0.8.0-beta.3] - 2026-07-06
 
 ### Fixed

Cargo.toml

@@ -48,7 +48,7 @@ tower = { version = "0.5", default-features = false, features = ["util"] }
 tower-service = "0.3"
 
 # --- QUIC Implementation ---
-h3x = { version = "0.6.0-beta.2" }
+h3x = { version = "0.6.0-beta.3" }
 
 # --- IPC / RPC ---
 remoc = { version = "0.18", default-features = false, features = [
@@ -89,7 +89,7 @@ form_urlencoded = "1"
 percent-encoding = "2"
 socket2 = "0.6"
 x509-parser = "0.18"
-dhttp = { version = "0.5.0-beta.2" }
+dhttp = { version = "0.5.0-beta.3" }
 
 # --- System Interaction ---
 libc = "0.2"

gateway/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "gateway"
-version = "0.8.0-beta.3"
+version = "0.8.0-beta.4"
 edition = "2024"
 license = "Apache-2.0"