From 12e1400f6ca74d9da579ff88bcd60b023353ad13 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 31 Aug 2026 06:05:38 +0000
Subject: [PATCH] chore: state the lock sed's safety invariant and drop the
 dead mac script

---
 .github/change-versions-mac.sh | 29 -----------------------------
 .github/change-versions.sh     |  9 +++++----
 2 files changed, 5 insertions(+), 33 deletions(-)
 delete mode 100755 .github/change-versions-mac.sh

diff --git a/.github/change-versions-mac.sh b/.github/change-versions-mac.sh
deleted file mode 100755
index 2f23b21eb8..0000000000
--- a/.github/change-versions-mac.sh
+++ /dev/null
@@ -1,29 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-script_dirpath="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-root_dirpath="$(cd "${script_dirpath}/.." && pwd)"
-
-VERSION=$1
-echo "Updating versions to: $VERSION"
-
-sed -i '' -e "/^version =/s/= .*/= \"$VERSION\"/" ${root_dirpath}/backend/Cargo.toml
-sed -i '' -e "/^export const VERSION =/s/= .*/= \"v$VERSION\";/"  ${root_dirpath}/cli/src/core/constants.ts
-sed -i '' -e "/^export const VERSION =/s/= .*/= \"v$VERSION\";/" ${root_dirpath}/benchmarks/lib.ts
-sed -i '' -e "/version: /s/: .*/: $VERSION/" ${root_dirpath}/backend/windmill-api/openapi.yaml
-sed -i '' -e "/version: /s/: .*/: $VERSION/" ${root_dirpath}/openflow.openapi.yaml
-sed -i '' -e "/\"version\": /s/: .*,/: \"$VERSION\",/" ${root_dirpath}/typescript-client/package.json
-sed -i '' -e "/\"version\": /s/: .*,/: \"$VERSION\",/" ${root_dirpath}/frontend/package.json
-sed -i '' -e "/^version =/s/= .*/= \"$VERSION\"/" ${root_dirpath}/python-client/wmill/pyproject.toml
-sed -i '' -e "/^windmill-api =/s/= .*/= \"\\^$VERSION\"/" ${root_dirpath}/python-client/wmill/pyproject.toml
-sed -i '' -e "/^[[:space:]]*ModuleVersion[[:space:]]*=/s/= .*/= '$VERSION'/" ${root_dirpath}/powershell-client/WindmillClient/WindmillClient.psd1
-sed -i '' -e "/^wmill =/s/= .*/= \">=$VERSION\"/" ${root_dirpath}/lsp/Pipfile
-
-sed -i '' -E "s/name = \"windmill\"\nversion = \"[^\"]*\"\\n(.*)/name = \"windmill\"\nversion = \"$VERSION\"\\n\\1/" ${root_dirpath}/backend/Cargo.lock
-
-# windmill-parser-wasm is its own workspace (excluded from the backend workspace
-# because of nightly-only cargo-features), so its version lives in
-# [workspace.package] and its Cargo.lock is not regenerated by the backend step.
-sed -i '' -e "/^version =/s/= .*/= \"$VERSION\"/" ${root_dirpath}/backend/parsers/windmill-parser-wasm/Cargo.toml
-sed -i '' -E "s/(name = \"windmill[^\"]*\"\nversion = )\"[^\"]*\"/\\1\"$VERSION\"/g" ${root_dirpath}/backend/parsers/windmill-parser-wasm/Cargo.lock
-
-cd ${root_dirpath}/frontend && npm i --package-lock-only
diff --git a/.github/change-versions.sh b/.github/change-versions.sh
index 958829a3ce..3410cfdff5 100755
--- a/.github/change-versions.sh
+++ b/.github/change-versions.sh
@@ -20,10 +20,11 @@ sed -i -e "/^windmill-api =/s/= .*/= \"\\^$VERSION\"/" ${root_dirpath}/python-cl
 sed -i -e "/^[[:space:]]*ModuleVersion[[:space:]]*=/s/= .*/= '$VERSION'/" ${root_dirpath}/powershell-client/WindmillClient/WindmillClient.psd1
 sed -i -e "/^wmill =/s/= .*/= \">=$VERSION\"/" ${root_dirpath}/lsp/Pipfile
 
-# Every workspace member is named windmill*, so rewriting their entries in place
-# keeps the lockfile consistent with Cargo.toml. Never regenerate it here: a
-# release must not re-resolve third-party dependencies, or a `^0` requirement
-# silently pulls a breaking 0.x bump into the tag that CI then fails to build.
+# Bumps every workspace member in place. Safe only while every `name = "windmill*"`
+# entry here is a member on the shared version: windmill_duckdb_ffi_internal (0.1.0)
+# stays out of the lock only via `exclude` in backend/Cargo.toml.
+# Never regenerate the lock instead — re-resolving lets a `^0` requirement pull a
+# breaking 0.x bump into the release tag.
 sed -i -zE "s/(name = \"windmill[^\"]*\"\nversion = )\"[^\"]*\"/\\1\"$VERSION\"/g" ${root_dirpath}/backend/Cargo.lock
 
 # windmill-parser-wasm is its own workspace (excluded from the backend workspace