Match portal v0.3.39

iris reports its own version as the portal it matches; the tag, the
pin and the changelog line are written by portal's release step.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4jrCgLiKKHAEFuZUJjckH

.gitea/workflows/publish.yml

@@ -12,7 +12,9 @@ jobs:
   publish:
     runs-on: bare
     env:
-      CARGO_HOME: /var/local/cargo
+      # Writable, unlike the shared /var/local/cargo - see test.yml.
+      CARGO_HOME: /var/local/cargo-target/iris-cargo-home
+      RUSTC_WRAPPER: /usr/bin/sccache
       RUSTUP_HOME: /var/local/rustup
       PATH: /var/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/bin
       SCCACHE_DIR: /var/local/sccache

.gitea/workflows/test.yml

@@ -10,7 +10,12 @@ jobs:
     runs-on: bare
     env:
       # Same shared toolchain and cache as uhhm/portal's workflows.
-      CARGO_HOME: /var/local/cargo
+      # Not the shared /var/local/cargo: the runner may only read it, and
+      # the portal git dependency has to be cloned into CARGO_HOME. This
+      # one lives under the writable target dir; the rustc wrapper the
+      # shared config would have set is given here instead.
+      CARGO_HOME: /var/local/cargo-target/iris-cargo-home
+      RUSTC_WRAPPER: /usr/bin/sccache
       RUSTUP_HOME: /var/local/rustup
       PATH: /var/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/bin
       SCCACHE_DIR: /var/local/sccache

CHANGELOG.md

@@ -3,6 +3,10 @@
 One line per change, grouped by the release that shipped it. Newest
 first. Each release names the portal tag it is built against.
 
+## 0.3.39 (2026-09-23) - portal v0.3.39
+
+- Matches portal v0.3.39 (released by portal's publish job).
+
 ## 0.1.1 (2026-09-22) - portal v0.3.36
 
 - `check --repo` fetches needs.yaml itself; the v0.1.0 tag never published (a cache permission on the runner, since fixed).

Cargo.lock

@@ -2036,7 +2036,7 @@ checksum = "791930b43c0d5973160d90a8f3894509f2b273430f5c5c73b668636d0287c5c0"
 
 [[package]]
 name = "iris"
-version = "0.1.1"
+version = "0.3.39"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -2971,8 +2971,8 @@ dependencies = [
 
 [[package]]
 name = "portal"
-version = "0.3.36"
+version = "0.3.39"
-source = "git+https://project.uhhm.no/uhhm/portal.git?tag=v0.3.36#e4e97a1adae47d65bdb12d54bb5d8137430df6bc"
+source = "git+https://project.uhhm.no/uhhm/portal.git?tag=v0.3.39#7f23ef2de07b8fd60702f9ceeeaf00c6205edac3"
 dependencies = [
  "anyhow",
  "arc-swap",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "iris"
-version = "0.1.1"
+version = "0.3.39"
 edition = "2021"
 description = "The iris over a portal site: nothing from a content repo comes through until it checks out"
 license = "MIT"
@@ -10,7 +10,7 @@ repository = "https://project.uhhm.no/uhhm/iris"
 # The site's own content types and loaders, so iris reads a repo exactly
 # the way the running site does. Pinned to the portal release it
 # matches; bumping this tag is what a new iris release is.
-portal = { git = "https://project.uhhm.no/uhhm/portal.git", tag = "v0.3.36", features = ["ssr"] }
+portal = { git = "https://project.uhhm.no/uhhm/portal.git", tag = "v0.3.39", features = ["ssr"] }
 anyhow = "1"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

README.md

@@ -39,15 +39,19 @@ what sits around those.
 ## Matching the site
 
 Every type iris reads is portal's own: portal is a library dependency
-pinned to a release tag in `Cargo.toml`, and `iris --version` says
+pinned to a release tag in `Cargo.toml`, and iris carries the same
-which. A content repo should run the iris that matches the portal
+version number as that tag, so `iris v0.3.39` is the lint for portal
-release its site runs. Portal's own release tarball ships an `iris`
+v0.3.39 and nothing else. A content repo pins `IRIS_RELEASE` to the
-binary built the same way, so a site that pins nothing extra has one
+`PORTAL_RELEASE` its site runs. Portal's own release tarball ships the
-at `/srv/app/<instance>/current/iris`.
+matching `iris` binary too, at `/srv/app/<instance>/current/iris`.
 
 ## Release
 
-Move the `Unreleased` lines in `CHANGELOG.md` under a heading for the
+Iris is released by portal's publish job, never by hand: when a
-version, bump `Cargo.toml`, commit, tag `v<version>`, push. CI builds
+portal tag is pushed, that job re-pins this crate to the tag, sets
-the binary and attaches it to the Gitea release as `iris`, with that
+the version to match, builds and tests it, adds the changelog line,
-section as the notes.
+and pushes the commit and the tag here. This repo's own CI then
+attaches the binary to the Gitea release as `iris`. A portal change
+to something the lint reads fails the portal release at that step.
+Changes to iris itself land on `main` between releases and ship with
+the next portal tag.

src/main.rs

@@ -38,19 +38,17 @@ async fn main() -> anyhow::Result<()> {
             replay::run(argv).await
         }
         Some("--version") | Some("-V") => {
-            println!("iris {} (portal {})", env!("CARGO_PKG_VERSION"), PORTAL_TAG);
+            println!("iris {v} (portal v{v})", v = env!("CARGO_PKG_VERSION"));
             Ok(())
         }
         Some(flag) if flag.starts_with("--") => check::run(argv).await,
         _ => {
             eprintln!(
-                "iris {} - matches portal {PORTAL_TAG}\n\nusage:\n  iris check (--repo <gitea-url> [--branch main] [--subdir questions] | --path <dir>) [--needs-tasks <out.jsonl> [--skim]] [--needs-sim <model.json>] [--needs-score <answers.jsonl> [--min-accuracy 0.8]]\n  iris replay --path <dir> --nats <url> (--cases <cases.jsonl> | --report-only)",
+                "iris {v} - matches portal v{v}\n\nusage:\n  iris check (--repo <gitea-url> [--branch main] [--subdir questions] | --path <dir>) [--needs-tasks <out.jsonl> [--skim]] [--needs-sim <model.json>] [--needs-score <answers.jsonl> [--min-accuracy 0.8]]\n  iris replay --path <dir> --nats <url> (--cases <cases.jsonl> | --report-only)",
-                env!("CARGO_PKG_VERSION")
+                v = env!("CARGO_PKG_VERSION")
             );
             std::process::exit(2)
         }
     }
 }
 
-/// The portal release this iris was built against (see Cargo.toml).
-const PORTAL_TAG: &str = "v0.3.36";