fleet: one busbar pin (86904c800d80)

.busbar-ref

@@ -1 +1 @@
-e1d3d8b097201859751d77208e66249d98b50a4b 1.6.0
+8fc3b1b2a6d123575a77ce505e501b595fb24cef 1.6.0

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# RENDERED by `busbar-release plugin sync` from GetBusbar/busbar-release template/.
+* @MattJackson

.github/dependabot.yml

@@ -1,13 +1,101 @@
-# Dependency updates target dev; they reach main only through a release.
+# RENDERED by `busbar-release plugin sync` from GetBusbar/busbar-release template/.
+# Dependency updates target dev. GitHub Actions are pinned by the fleet template (busbar-release),
+# so only cargo is watched here. Every update of an ecosystem is ONE grouped PR, and
+# .github/workflows/dependabot-bundle.yml folds all of them into one branch and one PR (DEPENDABOT-ONE).
+# The crates busbar's dependency policy owns (busbar's root [workspace.dependencies] and
+# .github/fleet/deps.toml) are ignored here: they move centrally, in busbar, and reach this repo
+# through `busbar-release plugin sync` with the pin, so Cargo.lock stays at parity with busbar's.
 version: 2
 updates:
   - package-ecosystem: cargo
     directory: "/"
     target-branch: dev
     schedule:
       interval: weekly
-  - package-ecosystem: github-actions
-    directory: "/"
-    target-branch: dev
-    schedule:
-      interval: weekly
+    groups:
+      all:
+        patterns:
+          - "*"
+    ignore:
+      - dependency-name: "a2a-lf"
+      - dependency-name: "a2a-pb"
+      - dependency-name: "arc-swap"
+      - dependency-name: "async-trait"
+      - dependency-name: "axum"
+      - dependency-name: "base64"
+      - dependency-name: "bumpalo"
+      - dependency-name: "bytes"
+      - dependency-name: "core_affinity"
+      - dependency-name: "crc32fast"
+      - dependency-name: "criterion"
+      - dependency-name: "dimpl"
+      - dependency-name: "ed25519-dalek"
+      - dependency-name: "flate2"
+      - dependency-name: "futures"
+      - dependency-name: "getrandom"
+      - dependency-name: "h2"
+      - dependency-name: "hex"
+      - dependency-name: "hmac"
+      - dependency-name: "http"
+      - dependency-name: "http-body"
+      - dependency-name: "http-body-util"
+      - dependency-name: "httpdate"
+      - dependency-name: "hyper"
+      - dependency-name: "hyper-rustls"
+      - dependency-name: "hyper-util"
+      - dependency-name: "indexmap"
+      - dependency-name: "jsonschema"
+      - dependency-name: "ldap3"
+      - dependency-name: "libc"
+      - dependency-name: "libloading"
+      - dependency-name: "log"
+      - dependency-name: "loom"
+      - dependency-name: "memchr"
+      - dependency-name: "metrics"
+      - dependency-name: "metrics-exporter-prometheus"
+      - dependency-name: "metrics-util"
+      - dependency-name: "mysql"
+      - dependency-name: "oauth-as"
+      - dependency-name: "opentelemetry-proto"
+      - dependency-name: "postgres"
+      - dependency-name: "proc-macro2"
+      - dependency-name: "proptest"
+      - dependency-name: "prost"
+      - dependency-name: "rcgen"
+      - dependency-name: "redis"
+      - dependency-name: "reqwest"
+      - dependency-name: "ring"
+      - dependency-name: "rmcp"
+      - dependency-name: "rusqlite"
+      - dependency-name: "rustls"
+      - dependency-name: "rustls-pki-types"
+      - dependency-name: "schemars"
+      - dependency-name: "serde"
+      - dependency-name: "serde_json"
+      - dependency-name: "serde_urlencoded"
+      - dependency-name: "serde_yaml"
+      - dependency-name: "sha2"
+      - dependency-name: "smallvec"
+      - dependency-name: "socket2"
+      - dependency-name: "sonic-rs"
+      - dependency-name: "syn"
+      - dependency-name: "tar"
+      - dependency-name: "tikv-jemalloc-ctl"
+      - dependency-name: "tikv-jemallocator"
+      - dependency-name: "tokio"
+      - dependency-name: "tokio-rustls"
+      - dependency-name: "tokio-tungstenite"
+      - dependency-name: "tokio-util"
+      - dependency-name: "tonic"
+      - dependency-name: "tonic-types"
+      - dependency-name: "tower"
+      - dependency-name: "tracing"
+      - dependency-name: "tracing-core"
+      - dependency-name: "tracing-log"
+      - dependency-name: "tracing-subscriber"
+      - dependency-name: "tungstenite"
+      - dependency-name: "ulid"
+      - dependency-name: "url"
+      - dependency-name: "webpki"
+      - dependency-name: "webpki-roots"
+      - dependency-name: "zeroize"

.github/workflows/ci.yml

@@ -1,6 +1,8 @@
-# RENDERED by `cargo xtask fleet render busbar-store-sqlite` from GetBusbar/busbar's plugins.yaml and
-# .github/fleet/ templates; `cargo xtask fleet check` is red on any edit here. The CI itself is
-# busbar's plugin-ci.yml, taken at the busbar commit this repo pins (.busbar-ref).
+# RENDERED by `busbar-release plugin sync busbar-store-sqlite` from GetBusbar/busbar-release template/; a hand
+# edit is overwritten by the next sync. THIS REPO TESTS ITSELF AGAINST BUSBAR with the fleet's ONE
+# harness: busbar's reusable plugin-ci.yml, taken at the busbar commit this repo pins (.busbar-ref), so
+# the CI logic, the gates (busbar scripts/fleet/plugin-gates.py), the dependency policy
+# (.github/fleet/deps.toml) and the contract move together (OWNER 2026-10-02). No CI logic lives here.
 name: ci
 
 on:
@@ -9,13 +11,15 @@ on:
   pull_request:
     branches: [dev, qa, main]
   workflow_dispatch: {}
+  # release.yml runs this file on the tagged commit before it publishes.
+  workflow_call: {}
 
 permissions:
   contents: read
 
 jobs:
   ci:
-    uses: GetBusbar/busbar/.github/workflows/plugin-ci.yml@e1d3d8b097201859751d77208e66249d98b50a4b
+    uses: GetBusbar/busbar/.github/workflows/plugin-ci.yml@8fc3b1b2a6d123575a77ce505e501b595fb24cef
     with:
       service: none
       busbar_checkout: true

.github/workflows/consumer-verify.yml

@@ -1,5 +1,5 @@
-# RENDERED by `cargo xtask fleet render busbar-store-sqlite` from GetBusbar/busbar's plugins.yaml and
-# .github/fleet/ templates; `cargo xtask fleet check` is red on any edit here. Daily: does the newest
+# RENDERED by `busbar-release plugin sync busbar-store-sqlite` from GetBusbar/busbar-release template/; a hand
+# edit is overwritten by the next sync. Daily: does the newest
 # PUBLISHED release still work for a user (busbar's plugin-consumer-verify.yml)? A publish-time check
 # cannot see an artifact that rots afterwards; release.yml verifies each release as it publishes.
 name: consumer-verify
@@ -21,7 +21,7 @@ permissions:
 
 jobs:
   consumer:
-    uses: GetBusbar/busbar/.github/workflows/plugin-consumer-verify.yml@e1d3d8b097201859751d77208e66249d98b50a4b
+    uses: GetBusbar/busbar/.github/workflows/plugin-consumer-verify.yml@8fc3b1b2a6d123575a77ce505e501b595fb24cef
     with:
       version: ${{ inputs.version || '' }}
       asset_prefix: busbar-store-sqlite

.github/workflows/dependabot-bundle.yml

@@ -0,0 +1,58 @@
+# RENDERED by `busbar-release plugin sync busbar-store-sqlite` from GetBusbar/busbar-release template/; a hand
+# edit is overwritten by the next sync (DEPENDABOT-ONE).
+# dependabot-bundle: every open dependabot PR (whatever its base today) is merged into ONE branch (deps/bundle),
+# which carries ONE PR with auto-merge on. Merged PRs are closed with a link; a PR that conflicts
+# is listed in the bundle PR body and left open. The branch is only ever fast-forwarded (no force).
+# Secrets: BUNDLE_TOKEN (or FLEET_TOKEN) lets the bundle PR run CI and lets a github-actions bump
+# (a workflow-file change) be pushed; without one GITHUB_TOKEN is used and those cases fail loudly.
+# pull_request_target runs the BASE branch's copy of this file and never executes PR code: it only
+# fetches and merges the PR heads.
+name: dependabot-bundle
+on:
+  pull_request_target:
+    types: [opened, synchronize]
+    branches: [dev]
+  schedule:
+    - cron: "23 5 * * *"
+  workflow_dispatch:
+permissions:
+  contents: write
+  pull-requests: write
+concurrency:
+  group: dependabot-bundle
+env:
+  TARGET: dev
+  BUNDLE: deps/bundle
+  GH_TOKEN: ${{ secrets.BUNDLE_TOKEN || secrets.FLEET_TOKEN || github.token }}
+jobs:
+  bundle:
+    if: github.event_name != 'pull_request_target' || github.actor == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    steps:
+      - run: |
+          set -euo pipefail
+          gh auth setup-git
+          git clone -q "https://github.com/$GITHUB_REPOSITORY" w && cd w
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          if git ls-remote --exit-code --heads origin "$BUNDLE" >/dev/null; then
+            git checkout -q -B "$BUNDLE" "origin/$BUNDLE"
+            git merge -q -m "deps: merge $TARGET" "origin/$TARGET"
+          else
+            git checkout -q -B "$BUNDLE" "origin/$TARGET"
+          fi
+          merged=(); bad=()
+          while IFS=$'\t' read -r n t; do
+            [ -n "$n" ] || continue
+            git fetch -q origin "pull/$n/head"
+            if git merge -q -m "deps: merge #$n $t" FETCH_HEAD; then merged+=("$n"); else git merge --abort; bad+=("$n"); fi
+          done < <(gh pr list --state open --author 'app/dependabot' --json number,title --jq '.[]|"\(.number)\t\(.title)"')
+          [ "$(git rev-list --count "origin/$TARGET..HEAD")" -gt 0 ] || { echo "nothing to bundle"; exit 0; }
+          git push -q origin "$BUNDLE"
+          body="Bundled dependabot updates, merged from: $(printf '#%s ' "${merged[@]}")"
+          [ ${#bad[@]} -eq 0 ] || body="$body"$'\n\n'"CONFLICT, left open (resolve or close by hand): $(printf '#%s ' "${bad[@]}")"
+          pr=$(gh pr list --head "$BUNDLE" --base "$TARGET" --state open --json number --jq '.[0].number // empty')
+          if [ -n "$pr" ]; then gh pr edit "$pr" --body "$body"
+          else pr=$(gh pr create --head "$BUNDLE" --base "$TARGET" --title "deps: bundled dependabot updates" --body "$body" | sed 's|.*/||'); fi
+          gh pr merge "$pr" --auto --merge || echo "::warning::auto-merge not enabled on #$pr"
+          for n in "${merged[@]}"; do gh pr close "$n" --comment "Merged into the bundle branch; continues in #$pr."; done

.github/workflows/release.yml

@@ -1,7 +1,7 @@
-# RENDERED by `cargo xtask fleet render busbar-store-sqlite` from GetBusbar/busbar's plugins.yaml and
-# .github/fleet/ templates; `cargo xtask fleet check` is red on any edit here. On a v* tag: this
-# repo's CI on the tagged commit, then busbar's plugin-release.yml (build, sign, pack, publish), then
-# the consumer verification of what was published, each at the busbar commit this repo pins.
+# RENDERED by `busbar-release plugin sync busbar-store-sqlite` from GetBusbar/busbar-release template/; a hand
+# edit is overwritten by the next sync. On a v* tag: this repo's own ci.yml (the fleet harness) on the
+# tagged commit, then busbar's plugin-release.yml (build, sign, pack, publish), then the consumer
+# verification of what was published, each at the busbar commit this repo pins.
 name: release
 
 on:
@@ -21,16 +21,11 @@ permissions:
 
 jobs:
   ci:
-    uses: GetBusbar/busbar/.github/workflows/plugin-ci.yml@e1d3d8b097201859751d77208e66249d98b50a4b
-    with:
-      service: none
-      busbar_checkout: true
-      macos_test: "cargo test --workspace --locked"
-      extra_test: ""
+    uses: ./.github/workflows/ci.yml
     secrets: inherit
   release:
     needs: ci
-    uses: GetBusbar/busbar/.github/workflows/plugin-release.yml@e1d3d8b097201859751d77208e66249d98b50a4b
+    uses: GetBusbar/busbar/.github/workflows/plugin-release.yml@8fc3b1b2a6d123575a77ce505e501b595fb24cef
     with:
       plugin_crate: busbar-store-sqlite-plugin
       manifest_name: busbar-store-sqlite
@@ -46,7 +41,7 @@ jobs:
   consumer-verify:
     needs: release
     if: ${{ !cancelled() }}
-    uses: GetBusbar/busbar/.github/workflows/plugin-consumer-verify.yml@e1d3d8b097201859751d77208e66249d98b50a4b
+    uses: GetBusbar/busbar/.github/workflows/plugin-consumer-verify.yml@8fc3b1b2a6d123575a77ce505e501b595fb24cef
     with:
       version: ${{ github.ref_name }}
       asset_prefix: busbar-store-sqlite

.github/workflows/repin.yml

@@ -1,5 +1,5 @@
-# RENDERED by `cargo xtask fleet render busbar-store-sqlite` from GetBusbar/busbar's plugins.yaml and
-# .github/fleet/ templates; `cargo xtask fleet check` is red on any edit here. Moves this repo's
+# RENDERED by `busbar-release plugin sync busbar-store-sqlite` from GetBusbar/busbar-release template/; a hand
+# edit is overwritten by the next sync. Moves this repo's
 # busbar pin (busbar's plugin-repin.yml) when busbar dispatches `busbar-repin` or on demand; the
 # cut/skip decision is by commit, and the commit goes to dev only.
 name: repin
@@ -28,7 +28,7 @@ permissions:
 
 jobs:
   repin:
-    uses: GetBusbar/busbar/.github/workflows/plugin-repin.yml@e1d3d8b097201859751d77208e66249d98b50a4b
+    uses: GetBusbar/busbar/.github/workflows/plugin-repin.yml@8fc3b1b2a6d123575a77ce505e501b595fb24cef
     with:
       busbar_sha: ${{ github.event.client_payload.sha || inputs.busbar_sha }}
       busbar_version: ${{ github.event.client_payload.version || inputs.busbar_version }}

.gitignore

@@ -1,5 +1,5 @@
-# RENDERED by `cargo xtask fleet render` from GetBusbar/busbar's plugins.yaml (the entry's
-# `gitignore:` lines follow the fleet's own) and .github/fleet/gitignore.
+# RENDERED by `busbar-release plugin sync` from GetBusbar/busbar-release template/ (the plugins.yaml
+# entry's `gitignore:` lines follow the fleet's own).
 /target
 /mutants.out*
 busbar-governance.db*

.mailmap

@@ -1,4 +1,4 @@
-# RENDERED by `cargo xtask fleet render` from GetBusbar/busbar's plugins.yaml and .github/fleet/.
+# RENDERED by `busbar-release plugin sync` from GetBusbar/busbar-release template/.
 # Canonical authorship. Commits go out under Matthew Jackson's GitHub noreply only.
 Matthew Jackson <1085847+MattJackson@users.noreply.github.com> <dev3@getbusbar.com>
 Matthew Jackson <1085847+MattJackson@users.noreply.github.com> Matthew <dev3@getbusbar.com>

CONTRIBUTING.md

@@ -7,15 +7,28 @@ Thanks for your interest in improving `busbar-store-sqlite`.
 - Be respectful and constructive in all project spaces (see
   [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md)).
 - By contributing, you agree your contributions are licensed under the project's
-  [Apache-2.0](LICENSE) license.
+  [MIT](LICENSE) license.
 - Security issues go through [SECURITY.md](SECURITY.md), **not** public issues.
 
 ## Layout
 
 Every busbar plugin repo has the same skeleton. This one is a two-crate Cargo workspace: `store-sqlite/` holds the plugin's logic and `store-sqlite-plugin/` is the thin `cdylib` that packages it as a droppable `kind: store` plugin. busbar itself is a git dependency
-pinned to the commit in `.busbar-ref`. The CI, release and lint configuration are
-rendered from [busbar's plugin registry](https://github.com/GetBusbar/busbar/blob/main/plugins.yaml);
-change them there, not here.
+pinned to the commit in `.busbar-ref`. The CI, release, dependency and lint configuration
+are rendered by `busbar-release plugin sync` from the fleet template (GetBusbar/busbar-release
+`template/`), [busbar's plugin registry](https://github.com/GetBusbar/busbar/blob/main/plugins.yaml)
+and busbar's dependency policy (`.github/fleet/deps.toml` and the root `[workspace.dependencies]`
+at the pin); change them there, not here.
+
+## This repo tests itself against busbar
+
+CI runs the fleet's one harness, busbar's reusable `plugin-ci.yml`, at the busbar commit in
+`.busbar-ref`: fmt, clippy -D warnings, the whole test suite, `cargo deny`, the dependency wall
+(busbar-contract plus third-party only), the socket/TLS ban (no plugin opens its own socket, dials,
+binds or does TLS), the C-dependency allow-list, `Cargo.lock` parity with busbar's lock at the pin,
+the both-ways conformance and the busbar conformance kit for this kind. The tests are this repo's:
+`store-sqlite-plugin/tests/conformance.rs` loads the LINKED door and the BUILT cdylib through busbar's
+plugin loader and requires one transcript (a test named `the_linked_and_the_dropped_in_*`), and keeps
+at least one RED arm (any other test in that target) that proves the comparison can fail.
 
 ## Before you open a pull request