Release 0.1.5 [auto-version-bump]

.gitea/workflows/publish.yaml

@@ -100,9 +100,12 @@ jobs:
           install "$RUNNER_TEMP/oras/oras" "$RUNNER_TEMP/oras-bin"
           printf '%s' "$HARBOR_PASSWORD" | "$RUNNER_TEMP/oras-bin" login harbor.k3s.k0.nu --username "$HARBOR_USERNAME" --password-stdin
           unset HARBOR_PASSWORD
-          "$RUNNER_TEMP/oras-bin" push --artifact-type application/vnd.ai-spel.kubernetes-manifest.v1 \
-            "harbor.k3s.k0.nu/ai-spel/rule-engine-manifest:$version" \
-            "$package_dir/manifest.yaml:application/yaml"
+          (
+            cd "$package_dir"
+            "$RUNNER_TEMP/oras-bin" push --artifact-type application/vnd.ai-spel.kubernetes-manifest.v1 \
+              "harbor.k3s.k0.nu/ai-spel/rule-engine-manifest:$version" \
+              "manifest.yaml:application/yaml"
+          )
           echo "version=$version" >> "$GITHUB_OUTPUT"
 
       - name: Deploy rule engine through Argo CD

Cargo.lock

@@ -13,7 +13,7 @@ dependencies = [
 
 [[package]]
 name = "ai-spel-rule-engine"
-version = "0.1.4"
+version = "0.1.5"
 dependencies = [
  "async-nats",
  "axum",

Cargo.toml

@@ -3,7 +3,7 @@ members = ["crates/rule-engine"]
 resolver = "2"
 
 [workspace.package]
-version = "0.1.4"
+version = "0.1.5"
 edition = "2024"
 license = "MIT"
 

README.md

@@ -14,7 +14,9 @@ Responses echo the correlation ID and have status `evaluated` or `rejected`.
 
 The NATS user may subscribe only to the evaluation subject and publish only to
 reply inboxes. The service receives no credentials other than its own NATS
-identity and has no configured database or AI-provider secrets.
+identity and has no configured database or AI-provider secrets. Its chart
+limits pod egress to NATS and cluster DNS; Luau evaluation has no external
+network path.
 
 ## Local commands
 

contracts/rule-evaluation-v1.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://gitea.k3s.k0.nu/ai-spel/ai-spel-rule-engine/raw/tag/v0.1.4/contracts/rule-evaluation-v1.schema.json",
+  "$id": "https://gitea.k3s.k0.nu/ai-spel/ai-spel-rule-engine/raw/tag/v0.1.5/contracts/rule-evaluation-v1.schema.json",
   "title": "AI Spel Luau rule evaluation contract v1",
   "type": "object",
   "additionalProperties": false,

deploy/argocd/application.yaml

@@ -8,7 +8,7 @@ spec:
   source:
     repoURL: harbor.k3s.k0.nu/ai-spel
     chart: ai-spel-rule-engine
-    targetRevision: "0.1.4"
+    targetRevision: "0.1.5"
     helm:
       releaseName: ai-spel-rule-engine
   destination:

deploy/helm/ai-spel-rule-engine/Chart.yaml

@@ -2,5 +2,5 @@ apiVersion: v2
 name: ai-spel-rule-engine
 description: Isolated, sandboxed Luau proposal evaluator
 type: application
-version: 0.1.4
-appVersion: "0.1.4"
+version: 0.1.5
+appVersion: "0.1.5"

deploy/helm/ai-spel-rule-engine/templates/networkpolicy.yaml

@@ -12,6 +12,7 @@ spec:
     - to:
         - podSelector:
             matchLabels:
+              app.kubernetes.io/name: ai-spel-nats
               app.kubernetes.io/instance: ai-spel-nats
       ports:
         - protocol: TCP
@@ -20,9 +21,6 @@ spec:
         - namespaceSelector:
             matchLabels:
               kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              k8s-app: kube-dns
       ports:
         - protocol: UDP
           port: 53