Fix SIGKILL in CI

.github/workflows/ci.yml

@@ -338,6 +338,9 @@ jobs:
     needs: [lints]
     name: Keynote Bench
     runs-on: spacetimedb-benchmark-runner
+    concurrency:
+      group: ci-benchmark-runner
+      queue: max
     timeout-minutes: 60
     env:
       CARGO_TARGET_DIR: ${{ github.workspace }}/target
@@ -392,6 +395,50 @@ jobs:
       - name: Run keynote-2 benchmark regression check
         run: cargo ci keynote-bench
 
+  index_scan_bench:
+    needs: [lints]
+    name: Index Scan Bench
+    runs-on: spacetimedb-benchmark-runner
+    concurrency:
+      group: ci-benchmark-runner
+      queue: max
+    timeout-minutes: 60
+    env:
+      CARGO_TARGET_DIR: ${{ github.workspace }}/target
+      RUST_BACKTRACE: full
+    steps:
+      - name: Find Git ref
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          PR_NUMBER="${{ github.event.inputs.pr_number || null }}"
+          if test -n "${PR_NUMBER}"; then
+            GIT_REF="$( gh pr view --repo clockworklabs/SpacetimeDB $PR_NUMBER --json headRefName --jq .headRefName )"
+          else
+            GIT_REF="${{ github.ref }}"
+          fi
+          echo "GIT_REF=${GIT_REF}" >>"$GITHUB_ENV"
+
+      - name: Checkout sources
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ env.GIT_REF }}
+
+      - uses: dsherret/rust-toolchain-file@v1
+      - name: Set default rust toolchain
+        run: rustup default $(rustup show active-toolchain | cut -d' ' -f1)
+
+      - name: Cache Rust dependencies
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: ${{ github.workspace }}
+          shared-key: spacetimedb
+          save-if: false
+          prefix-key: v1
+
+      - name: Run index scan benchmark regression check
+        run: cargo bench -p spacetimedb-bench --bench index_scan_gate
+
   lints:
     name: Lints
     runs-on: spacetimedb-new-runner-2

.github/workflows/cla-gate.yml

@@ -0,0 +1,114 @@
+name: CLA Gate
+
+# This workflow publishes a repository-owned commit status named `CLA Gate`.
+# Make `CLA Gate` required instead of requiring CLA Assistant's raw `license/cla`
+# status directly. That lets merge queue entries pass without waiting for CLA
+# Assistant to report on the synthetic merge-group SHA, while pull requests still
+# mirror the real CLA Assistant result.
+
+on:
+  status:
+  merge_group:
+
+permissions:
+  contents: read
+  statuses: write
+
+jobs:
+  publish-cla-gate-status:
+    name: CLA status
+    runs-on: ubuntu-latest
+    if: github.event_name != 'status' || github.event.context == 'license/cla'
+
+    steps:
+      - name: Check out trusted base code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+
+      - uses: dsherret/rust-toolchain-file@v1
+
+      - name: Publish CLA Gate status
+        uses: actions/github-script@v7
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        with:
+          script: |
+            const { execFileSync } = require("child_process");
+
+            function claStatus(args) {
+              const command = ["ci", "cla-assistant", "status", ...args];
+              core.info(`Running cargo ${command.join(" ")}`);
+              const output = execFileSync("cargo", command, {
+                encoding: "utf8",
+                env: process.env,
+              });
+              core.info(`cargo ci output: ${output.trim()}`);
+              const status = JSON.parse(output);
+              core.info(
+                `Resolved license/cla for ${status.sha}: state=${status.state || "missing"} ` +
+                  `description=${status.description || "<none>"} ` +
+                  `target_url=${status.target_url || "<none>"}`
+              );
+              return status;
+            }
+
+            async function postStatus({ sha, state, description, targetUrl }) {
+              const statusContext = "CLA Gate";
+              core.info(
+                `Publishing ${statusContext}=${state} for ${sha}: ${description}`
+              );
+
+              await github.rest.repos.createCommitStatus({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                sha,
+                state,
+                description,
+                context: statusContext,
+                target_url: targetUrl,
+              });
+            }
+
+            let targetSha;
+            let claStatusArgs;
+
+            core.info(
+              `Handling ${context.eventName} event for workflow SHA ${process.env.GITHUB_SHA}`
+            );
+
+            if (context.eventName === "merge_group") {
+              core.info(`Merge group SHA is ${process.env.GITHUB_SHA}`);
+              await postStatus({
+                sha: process.env.GITHUB_SHA,
+                state: "success",
+                description: "Merge group entry; CLA already checked before queue",
+              });
+              return;
+            }
+
+            if (context.eventName === "status") {
+              targetSha = context.payload.sha;
+              claStatusArgs = ["--sha", targetSha];
+              core.info(
+                `status event context=${context.payload.context} state=${context.payload.state} sha=${targetSha}`
+              );
+            } else {
+              core.setFailed(`Unsupported event type: ${context.eventName}`);
+              return;
+            }
+
+            core.info(`Checking license/cla with args: ${claStatusArgs.join(" ")}`);
+            const status = claStatus(claStatusArgs);
+
+            if (!status.state) {
+              core.info(`No CLA Gate status to publish for ${targetSha}`);
+              return;
+            }
+
+            await postStatus({
+              sha: targetSha,
+              state: status.state,
+              description: status.description || undefined,
+              targetUrl: status.target_url || undefined,
+            });

.github/workflows/release.yml

@@ -0,0 +1,19 @@
+name: Release
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  packages: write
+
+concurrency:
+  group: manual-release
+  cancel-in-progress: true
+
+jobs:
+  foo:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Be done
+        run: echo

.github/workflows/retry-cla-assistant.yml

@@ -77,6 +77,6 @@ jobs:
         run: |
           while read -r pr_number; do
             if [ -n "${pr_number}" ]; then
-              cargo ci retry-cla-assistant --pr-number "${pr_number}"
+              cargo ci cla-assistant retry --pr-number "${pr_number}"
             fi
           done < "${{ steps.prs.outputs.path }}"

.github/workflows/tag-release.yml

@@ -2,6 +2,8 @@ on:
   release:
     types: [published]
 
+permissions: {}
+
 jobs:
   on-release:
     name: Re-tag latest
@@ -21,3 +23,18 @@ jobs:
         run: |
           VERSION=${GITHUB_REF#refs/*/}
           docker buildx imagetools create clockworklabs/spacetimedb:$VERSION --tag clockworklabs/spacetimedb:latest
+
+  announce-release:
+    name: Announce GitHub release
+    runs-on: ubuntu-latest
+    needs: on-release
+    if: always()
+    steps:
+      - name: Send Discord notification
+        run: |
+          set -euo pipefail
+
+          message="SpacetimeDB GitHub release published: [${{ github.event.release.name }}](<${{ github.event.release.html_url }}>)"
+
+          data="$(jq --null-input --arg msg "$message" '.content=$msg')"
+          curl -X POST -H 'Content-Type: application/json' -d "$data" "${{ secrets.DISCORD_WEBHOOK_RELEASE_ANNOUNCE_URL }}"