Bump uuid, gate publishes per-registry, and stop Go caching the corpus

.changeset/uuid-bump-and-release-gating.md

@@ -0,0 +1,19 @@
+---
+"@smooai/logger": patch
+---
+
+Bump `uuid` to `^11.1.1`, gate each registry publish on that registry, and stop Go caching the parity corpus.
+
+- **`uuid` 9.0.1 → 11.1.1.** The moderate advisory (missing buffer bounds check in v3/v5/v6 when
+  `buf` is provided) is **not reachable** here — logger only ever calls `v4()` with no arguments —
+  but every consumer of `@smooai/logger` was inheriting the advisory and having to carry its own
+  `pnpm.overrides` pin. Fixed at the source instead. `@types/uuid` dropped; uuid 11 ships its own.
+- **Publish steps no longer gate on `steps.changesets.outputs.published`.** That output is true only
+  when the publish command shipped something _in that run_, so a run that died after npm left the
+  other four behind — and the follow-up run, with no changesets left, reported `published=false`,
+  skipped all four, and went **green having published nothing**. That is exactly how 4.5.1 and
+  4.5.2 stranded crates.io, NuGet and the Go tag at 4.5.0. Each step now asks its own registry
+  whether the version is already there, which also lets a re-run heal a partial release.
+- **`go:test` gains `-count=1`.** Go currently refuses to cache `parity_corpus_test.go` because it
+  reads `../parity-corpus.json` from outside the package dir — verified — but a parity guarantee
+  should not rest on that.

.github/workflows/release.yml

@@ -109,8 +109,56 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GH_PAT }}
           NPM_TOKEN: ${{ secrets.SMOOAI_NPM_TOKEN }}
 
+      # Gate each registry on whether IT is behind, not on whether npm published
+      # in THIS run. `steps.changesets.outputs.published` is only true when the
+      # publish command actually shipped something, so a run that died after npm
+      # left PyPI/crates.io/Go/NuGet behind, and the NEXT run had no changesets
+      # left, reported published=false, skipped all four, and went GREEN having
+      # published nothing. That is how 4.5.1 and 4.5.2 stranded three registries
+      # at 4.5.0 here. Asking each registry directly also makes a re-run heal it.
+      - name: Which registries are behind package.json?
+        id: lag
+        run: |
+          set -euo pipefail
+          VERSION=$(node -p "require('./package.json').version")
+          echo "Target version: ${VERSION}"
+
+          # npm is the source of truth for "this version is released". The
+          # changesets action leaves the workspace on the version branch, so in a
+          # run that only OPENS the version PR, package.json is already bumped to
+          # a version nothing has published yet — without this gate the four
+          # steps below would ship it ahead of npm, from an unmerged branch.
+          if ! npm view "@smooai/logger@${VERSION}" version >/dev/null 2>&1; then
+            echo "npm does not have ${VERSION} yet — nothing to backfill."
+            {
+              echo "pypi=no"; echo "crates=no"; echo "nuget=no"; echo "gotag=no"
+            } >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # "behind" = this registry does NOT already have ${VERSION}.
+          # A failed/garbled lookup counts as behind, i.e. we try to publish:
+          # every path below is duplicate-tolerant or version-guarded, so a
+          # redundant attempt is cheap and a skipped one loses a release.
+          behind() {
+            if jq -e --arg v "$VERSION" "$2" >/dev/null 2>&1 <<<"$1"; then echo no; else echo yes; fi
+          }
+
+          PYPI=$(behind "$(curl -sfL https://pypi.org/pypi/smooai-logger/json || true)" '.releases | has($v)')
+          CRATES=$(behind "$(curl -sfL -H 'User-Agent: SmooAI-logger-release' https://crates.io/api/v1/crates/smooai-logger/versions || true)" '[.versions[].num] | index($v)')
+          NUGET=$(behind "$(curl -sfL https://api.nuget.org/v3-flatcontainer/smooai.logger/index.json || true)" '.versions | index($v)')
+          if git ls-remote --exit-code --tags origin "refs/tags/go/v${VERSION}" >/dev/null 2>&1; then GOTAG=no; else GOTAG=yes; fi
+
+          echo "behind -> pypi:${PYPI} crates:${CRATES} nuget:${NUGET} go-tag:${GOTAG}"
+          {
+            echo "pypi=${PYPI}"
+            echo "crates=${CRATES}"
+            echo "nuget=${NUGET}"
+            echo "gotag=${GOTAG}"
+          } >> "$GITHUB_OUTPUT"
+
       - name: Publish smooai-logger to PyPI
-        if: steps.changesets.outputs.published == 'true'
+        if: steps.lag.outputs.pypi == 'yes'
         working-directory: python
         env:
           UV_PUBLISH_TOKEN: ${{ secrets.SMOOAI_PYPI_TOKEN }}
@@ -120,13 +168,13 @@ jobs:
           uv run poe publish
 
       - name: Publish smooai-logger to crates.io
-        if: steps.changesets.outputs.published == 'true'
+        if: steps.lag.outputs.crates == 'yes'
         run: cargo publish --locked --manifest-path rust/logger/Cargo.toml
         env:
           CARGO_REGISTRY_TOKEN: ${{ secrets.SMOOAI_CARGO_REGISTRY_TOKEN }}
 
       - name: Tag and publish Go module
-        if: steps.changesets.outputs.published == 'true'
+        if: steps.lag.outputs.gotag == 'yes'
         run: |
           # Guard here, not just in the pre-flight checks: changesets has
           # bumped package.json by this point, so this is the only place the
@@ -143,15 +191,15 @@ jobs:
           echo "Go module tagged and pushed: ${TAG}"
 
       - name: Build and test .NET
-        if: steps.changesets.outputs.published == 'true'
+        if: steps.lag.outputs.nuget == 'yes'
         working-directory: dotnet
         run: |
           dotnet restore SmooAI.Logger.sln
           dotnet build SmooAI.Logger.sln -c Release --no-restore
           dotnet test SmooAI.Logger.sln -c Release --no-build --nologo
 
       - name: Pack and publish SmooAI.Logger to NuGet
-        if: steps.changesets.outputs.published == 'true'
+        if: steps.lag.outputs.nuget == 'yes'
         run: |
           VERSION=$(node -p "require('./package.json').version")
           echo "Packing SmooAI.Logger ${VERSION}"

package.json

@@ -93,7 +93,7 @@
     "go:fmt": "(cd go && gofmt -w .)",
     "go:fmt:check": "(cd go && test -z \"$(gofmt -l .)\")",
     "go:lint": "(cd go && go vet ./...)",
-    "go:test": "(cd go && go test -v ./...)",
+    "go:test": "(cd go && go test -count=1 -v ./...)",
     "lint": "oxlint . && pnpm run python:lint && pnpm run rust:lint && pnpm run go:lint",
     "lint:fix": "oxlint --fix . && pnpm run python:lint:fix",
     "pre-commit-check": "(zsh .husky/pre-commit)",
@@ -130,7 +130,7 @@
     "rotating-file-stream": "^3.2.6",
     "serialize-error": "^11.0.3",
     "source-map-support": "^0.5.21",
-    "uuid": "^9.0.0",
+    "uuid": "^11.1.1",
     "zod": "^4.0.0"
   },
   "devDependencies": {
@@ -147,7 +147,6 @@
     "@types/lodash.merge": "^4.6.9",
     "@types/node": "^22.13.10",
     "@types/source-map-support": "^0.5.10",
-    "@types/uuid": "^9.0.2",
     "glob": "^11.0.1",
     "oxfmt": "^0.28.0",
     "oxlint": "^0.16.0",