Match portal v0.3.39

iris reports its own version as the portal it matches; the tag, the
pin and the changelog line are written by portal's release step.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4jrCgLiKKHAEFuZUJjckH

.gitea/workflows/publish.yml

@@ -12,7 +12,9 @@ jobs:
   publish:
     runs-on: bare
     env:
-      CARGO_HOME: /var/local/cargo
+      # Writable, unlike the shared /var/local/cargo - see test.yml.
+      CARGO_HOME: /var/local/cargo-target/iris-cargo-home
+      RUSTC_WRAPPER: /usr/bin/sccache
       RUSTUP_HOME: /var/local/rustup
       PATH: /var/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/bin
       SCCACHE_DIR: /var/local/sccache

.gitea/workflows/test.yml

@@ -10,7 +10,12 @@ jobs:
     runs-on: bare
     env:
       # Same shared toolchain and cache as uhhm/portal's workflows.
-      CARGO_HOME: /var/local/cargo
+      # Not the shared /var/local/cargo: the runner may only read it, and
+      # the portal git dependency has to be cloned into CARGO_HOME. This
+      # one lives under the writable target dir; the rustc wrapper the
+      # shared config would have set is given here instead.
+      CARGO_HOME: /var/local/cargo-target/iris-cargo-home
+      RUSTC_WRAPPER: /usr/bin/sccache
       RUSTUP_HOME: /var/local/rustup
       PATH: /var/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/bin
       SCCACHE_DIR: /var/local/sccache

CHANGELOG.md

@@ -3,6 +3,14 @@
 One line per change, grouped by the release that shipped it. Newest
 first. Each release names the portal tag it is built against.
 
+## 0.3.39 (2026-09-23) - portal v0.3.39
+
+- Matches portal v0.3.39 (released by portal's publish job).
+
+## 0.1.1 (2026-09-22) - portal v0.3.36
+
+- `check --repo` fetches needs.yaml itself; the v0.1.0 tag never published (a cache permission on the runner, since fixed).
+
 ## 0.1.0 (2026-09-22) - portal v0.3.36
 
 - First release: the lint moved out of portal (`question_lint` becomes

Cargo.lock

@@ -2036,7 +2036,7 @@ checksum = "791930b43c0d5973160d90a8f3894509f2b273430f5c5c73b668636d0287c5c0"
 
 [[package]]
 name = "iris"
-version = "0.1.0"
+version = "0.3.39"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -2971,8 +2971,8 @@ dependencies = [
 
 [[package]]
 name = "portal"
-version = "0.3.36"
-source = "git+https://project.uhhm.no/uhhm/portal.git?tag=v0.3.36#e4e97a1adae47d65bdb12d54bb5d8137430df6bc"
+version = "0.3.39"
+source = "git+https://project.uhhm.no/uhhm/portal.git?tag=v0.3.39#7f23ef2de07b8fd60702f9ceeeaf00c6205edac3"
 dependencies = [
  "anyhow",
  "arc-swap",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "iris"
-version = "0.1.0"
+version = "0.3.39"
 edition = "2021"
 description = "The iris over a portal site: nothing from a content repo comes through until it checks out"
 license = "MIT"
@@ -10,7 +10,7 @@ repository = "https://project.uhhm.no/uhhm/iris"
 # The site's own content types and loaders, so iris reads a repo exactly
 # the way the running site does. Pinned to the portal release it
 # matches; bumping this tag is what a new iris release is.
-portal = { git = "https://project.uhhm.no/uhhm/portal.git", tag = "v0.3.36", features = ["ssr"] }
+portal = { git = "https://project.uhhm.no/uhhm/portal.git", tag = "v0.3.39", features = ["ssr"] }
 anyhow = "1"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

README.md

@@ -39,15 +39,19 @@ what sits around those.
 ## Matching the site
 
 Every type iris reads is portal's own: portal is a library dependency
-pinned to a release tag in `Cargo.toml`, and `iris --version` says
-which. A content repo should run the iris that matches the portal
-release its site runs. Portal's own release tarball ships an `iris`
-binary built the same way, so a site that pins nothing extra has one
-at `/srv/app/<instance>/current/iris`.
+pinned to a release tag in `Cargo.toml`, and iris carries the same
+version number as that tag, so `iris v0.3.39` is the lint for portal
+v0.3.39 and nothing else. A content repo pins `IRIS_RELEASE` to the
+`PORTAL_RELEASE` its site runs. Portal's own release tarball ships the
+matching `iris` binary too, at `/srv/app/<instance>/current/iris`.
 
 ## Release
 
-Move the `Unreleased` lines in `CHANGELOG.md` under a heading for the
-version, bump `Cargo.toml`, commit, tag `v<version>`, push. CI builds
-the binary and attaches it to the Gitea release as `iris`, with that
-section as the notes.
+Iris is released by portal's publish job, never by hand: when a
+portal tag is pushed, that job re-pins this crate to the tag, sets
+the version to match, builds and tests it, adds the changelog line,
+and pushes the commit and the tag here. This repo's own CI then
+attaches the binary to the Gitea release as `iris`. A portal change
+to something the lint reads fails the portal release at that step.
+Changes to iris itself land on `main` between releases and ship with
+the next portal tag.

src/check.rs

@@ -57,7 +57,8 @@ pub async fn run(argv: Vec<String>) -> anyhow::Result<()> {
         // load_site_from_gitea already validates; a missing file is
         // the default config, same as at portal boot.
         let site = content::load_site_from_gitea(&repo_url, &branch).await?;
-        let needs_raw = content::load_needs_from_gitea(&repo_url, &branch).await?;
+        // Optional: a fetch failure means the repo declares no needs.
+        let needs_raw = portal::http::get_text(&format!("{}/needs.yaml?ref={branch}", content::gitea_raw_base(&repo_url)?), portal::http::GITEA_CAP).await.ok();
         (questions, aggregates_map, site, needs_raw)
     } else {
         eprintln!(
@@ -108,7 +109,7 @@ pub async fn run(argv: Vec<String>) -> anyhow::Result<()> {
     }
 }
 
-/// The business-needs pass (see `portal::needs`): structure always,
+/// The business-needs pass (see `crate::needs`): structure always,
 /// then the wording tasks written out and/or an engine's answers
 /// scored, when asked. A repo without `needs.yaml` skips all of it.
 fn check_needs(

src/local.rs

@@ -82,7 +82,7 @@ fn collect_yaml(
     Ok(())
 }
 
-/// The offline counterpart to `content::load_needs_from_gitea` -
+/// The offline counterpart to `check`'s needs.yaml fetch -
 /// `needs.yaml` sits at the repo root beside `aggregates.yaml`.
 pub fn load_needs_from_dir(dir: &str) -> anyhow::Result<Option<String>> {
     let needs_path = std::path::Path::new(dir)

src/main.rs

@@ -38,19 +38,17 @@ async fn main() -> anyhow::Result<()> {
             replay::run(argv).await
         }
         Some("--version") | Some("-V") => {
-            println!("iris {} (portal {})", env!("CARGO_PKG_VERSION"), PORTAL_TAG);
+            println!("iris {v} (portal v{v})", v = env!("CARGO_PKG_VERSION"));
             Ok(())
         }
         Some(flag) if flag.starts_with("--") => check::run(argv).await,
         _ => {
             eprintln!(
-                "iris {} - matches portal {PORTAL_TAG}\n\nusage:\n  iris check (--repo <gitea-url> [--branch main] [--subdir questions] | --path <dir>) [--needs-tasks <out.jsonl> [--skim]] [--needs-sim <model.json>] [--needs-score <answers.jsonl> [--min-accuracy 0.8]]\n  iris replay --path <dir> --nats <url> (--cases <cases.jsonl> | --report-only)",
-                env!("CARGO_PKG_VERSION")
+                "iris {v} - matches portal v{v}\n\nusage:\n  iris check (--repo <gitea-url> [--branch main] [--subdir questions] | --path <dir>) [--needs-tasks <out.jsonl> [--skim]] [--needs-sim <model.json>] [--needs-score <answers.jsonl> [--min-accuracy 0.8]]\n  iris replay --path <dir> --nats <url> (--cases <cases.jsonl> | --report-only)",
+                v = env!("CARGO_PKG_VERSION")
             );
             std::process::exit(2)
         }
     }
 }
 
-/// The portal release this iris was built against (see Cargo.toml).
-const PORTAL_TAG: &str = "v0.3.36";