chore(release): publish maintained crate update

.github/MAINTAINERS.md

@@ -36,7 +36,7 @@ To ensure all commits are signed, configure branch protection rules:
 gh api repos/agnos-ai/dotenvage/branches/main/protection
 
 # Or check in the web UI:
-# https://github.com/dataroadinc/dotenvage/settings/branch_protection_rules
+# https://github.com/legra-ai/dotenvage/settings/branch_protection_rules
 ```
 
 ### Required Branch Protection Rules

.github/OIDC_SETUP.md

@@ -38,7 +38,7 @@ configuration
 
 **All fields are case-sensitive and must match exactly:**
 
-- **Owner**: `dataroadinc`
+- **Owner**: `legra-ai`
 - **Repository**: `dotenvage` (without the `.git` extension)
 - **Workflow filename**: `ci.yml` (the exact filename in
   `.github/workflows/`)
@@ -56,7 +56,7 @@ Click **"Save"** or **"Add Trusted Publisher"** to complete the setup.
 1. Go to: https://www.npmjs.com/package/@dotenvage/node
 2. Navigate to **Package settings** → **Trusted Publishers**
 3. Verify the configuration matches exactly:
-   - **Owner**: `dataroadinc` (case-sensitive)
+   - **Owner**: `legra-ai` (case-sensitive)
    - **Repository**: `dotenvage` (case-sensitive, no `.git`)
    - **Workflow filename**: `ci.yml` (case-sensitive, exact match)
    - **Environment**: (should be empty or match GitHub environment)
@@ -93,7 +93,7 @@ If publishing still fails after configuration:
 
 1. **Double-check all fields match exactly** (case-sensitive):
 
-   - Owner: `dataroadinc`
+   - Owner: `legra-ai`
    - Repository: `dotenvage`
    - Workflow: `ci.yml`
 

.github/PUBLISH.md

@@ -49,7 +49,7 @@ merge. Both packages will be published together.
 
 2. Add to GitHub repository secrets:
    - Go to:
-     https://github.com/dataroadinc/dotenvage/settings/secrets/actions
+     https://github.com/legra-ai/dotenvage/settings/secrets/actions
    - Click "New repository secret"
    - Name: `CRATES_IO` (or `CRATES_IO_TOKEN`)
    - Value: `<your-crates-io-token>`
@@ -75,7 +75,7 @@ This project uses npm's **Trusted Publishing** with OpenID Connect
 
 3. Configure the Trusted Publisher (all fields are case-sensitive):
 
-   - **Owner:** `dataroadinc`
+   - **Owner:** `legra-ai`
    - **Repository:** `dotenvage`
    - **Workflow filename:** `ci.yml` (the exact filename in
      `.github/workflows/`)
@@ -217,7 +217,7 @@ BREAKING CHANGE: Default key path changed from
 
 After pushing your version bump:
 
-1. Go to: https://github.com/dataroadinc/dotenvage/actions
+1. Go to: https://github.com/legra-ai/dotenvage/actions
 2. Watch the "CI/CD" workflow
 3. The "Release" job will show:
    - Version sync verification
@@ -233,7 +233,7 @@ After the workflow completes:
 
 ```bash
 # Check the new release
-open https://github.com/dataroadinc/dotenvage/releases
+open https://github.com/legra-ai/dotenvage/releases
 
 # Check crates.io (Rust crate)
 open https://crates.io/crates/dotenvage
@@ -290,7 +290,7 @@ incorrect.
   - Go to https://www.npmjs.com/package/@dotenvage/node → Package
     settings → Trusted Publishers
   - Check that all fields match exactly:
-    - Owner: `dataroadinc`
+    - Owner: `legra-ai`
     - Repository: `dotenvage`
     - Workflow filename: `ci.yml`
 - Ensure the workflow has `id-token: write` permission (already
@@ -306,7 +306,7 @@ The crates.io token is missing or invalid.
 set correctly in GitHub settings:
 
 - Go to:
-  https://github.com/dataroadinc/dotenvage/settings/secrets/actions
+  https://github.com/legra-ai/dotenvage/settings/secrets/actions
 - Ensure `CRATES_IO` or `CRATES_IO_TOKEN` exists with a valid token
 
 ### "Version mismatch detected"
@@ -341,7 +341,7 @@ The release won't happen if any check fails.
 - [x] Clippy passes (`cargo clippy`)
 - [ ] `CRATES_IO` token added to GitHub secrets
 - [ ] npm Trusted Publishing (OIDC) configured on npmjs.com
-  - [ ] Owner: `dataroadinc`
+  - [ ] Owner: `legra-ai`
   - [ ] Repository: `dotenvage`
   - [ ] Workflow: `ci.yml`
 - [ ] `@dotenvage` scope exists on npmjs.org

.github/actions/README.md

@@ -1,21 +1,21 @@
 # Reusable GitHub Actions
 
 This repository now uses shared actions from
-[dataroadinc/github-actions](https://github.com/dataroadinc/github-actions).
+[legra-ai/github-actions](https://github.com/legra-ai/github-actions).
 
 ## Migration Notice
 
 All local actions have been migrated to use the shared actions
 repository. Workflows now reference:
 
 ```yaml
-uses: dataroadinc/github-actions/.github/actions/action-name@main
+uses: legra-ai/github-actions/.github/actions/action-name@main
 ```
 
 ## Available Shared Actions
 
 See the
-[shared actions repository](https://github.com/dataroadinc/github-actions)
+[shared actions repository](https://github.com/legra-ai/github-actions)
 for complete documentation of all available actions.
 
 ### Actions Used in This Repository
@@ -27,10 +27,10 @@ for complete documentation of all available actions.
 
 ```yaml
 - name: Setup Cocogitto
-  uses: dataroadinc/github-actions/.github/actions/setup-cocogitto@main
+  uses: legra-ai/github-actions/.github/actions/setup-cocogitto@main
 
 - name: Generate changelog
-  uses: dataroadinc/github-actions/.github/actions/generate-changelog@main
+  uses: legra-ai/github-actions/.github/actions/generate-changelog@main
   with:
     release-tag: v0.1.0
 ```
@@ -39,5 +39,5 @@ for complete documentation of all available actions.
 
 All shared actions support versioning via inputs and environment
 variables. See the
-[shared actions documentation](https://github.com/dataroadinc/github-actions)
+[shared actions documentation](https://github.com/legra-ai/github-actions)
 for details.

.github/workflows/auto-version-bump.yml

@@ -14,8 +14,15 @@ permissions:
 
 jobs:
   bump:
-    uses: dataroadinc/github-actions/.github/workflows/cargo-auto-version-bump.yml@main
+    uses: legra-ai/github-actions/.github/workflows/cargo-auto-version-bump.yml@main
     with:
       crate-name: dotenvage
       match-mode: first-line-prefix
+      version-files: |
+        Cargo.toml
+        Cargo.lock
+        npm/package.json
+        python/pyproject.toml
+        python/uv.lock
+        package.json
     secrets: inherit

.github/workflows/ci.yml

@@ -16,7 +16,7 @@ jobs:
     name: Format
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@nightly
         with:
           components: rustfmt
@@ -28,7 +28,7 @@ jobs:
     name: Clippy
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
           components: clippy
@@ -44,7 +44,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions-rust-lang/setup-rust-toolchain@v1
       - name: Run tests
         run: cargo test
@@ -59,7 +59,7 @@ jobs:
       matrix:
         node: [22, 24]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Setup pnpm
         uses: pnpm/action-setup@v6
         with:
@@ -90,7 +90,7 @@ jobs:
       matrix:
         python: ["3.10", "3.11", "3.12", "3.13", "3.14"]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv
         uses: astral-sh/setup-uv@v7
         with:
@@ -124,12 +124,12 @@ jobs:
       version_changed: ${{ steps.version.outputs.version_changed }}
       new_version: ${{ steps.version.outputs.version }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Get version info
         id: version
-        uses: dataroadinc/github-actions/.github/actions/get-version@main
+        uses: legra-ai/github-actions/.github/actions/get-version@main
 
   # Build all artifacts BEFORE creating release
   # This ensures we don't create a release if builds fail
@@ -157,7 +157,7 @@ jobs:
             use_zig: true
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Rust
         uses: actions-rust-lang/setup-rust-toolchain@v1
@@ -321,7 +321,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -333,7 +333,7 @@ jobs:
 
       # Use reusable actions for tool setup
       - name: Setup cocogitto
-        uses: dataroadinc/github-actions/.github/actions/setup-cocogitto@main
+        uses: legra-ai/github-actions/.github/actions/setup-cocogitto@main
 
       - name: Create Release Tag
         run: |
@@ -388,7 +388,7 @@ jobs:
       - name: Release Summary
         run: |
           echo "✅ Created GitHub release v${{ needs.version-check.outputs.new_version }}"
-          echo "📝 https://github.com/dataroadinc/dotenvage/releases/tag/v${{ needs.version-check.outputs.new_version }}"
+          echo "📝 https://github.com/legra-ai/dotenvage/releases/tag/v${{ needs.version-check.outputs.new_version }}"
 
   # Publish all packages after release is created
   publish-all:
@@ -401,7 +401,7 @@ jobs:
       id-token: write  # Required for OIDC authentication (npm/PyPI Trusted Publishing)
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: refs/tags/v${{ needs.version-check.outputs.new_version }}
 
@@ -431,10 +431,14 @@ jobs:
           WORKSPACE_VERSION=$(grep '^\[workspace\.package\]' -A 10 Cargo.toml | grep '^version' | head -1 | sed 's/.*"\(.*\)".*/\1/')
           NPM_VERSION=$(grep '"version"' npm/package.json | head -1 | sed 's/.*"\(.*\)".*/\1/')
           PYTHON_VERSION=$(grep '^version' python/pyproject.toml | head -1 | sed 's/.*"\(.*\)".*/\1/')
+          UV_LOCK_VERSION=$(awk '/^name = "dotenvage"$/ { getline; if ($1 == "version") { gsub(/"/, "", $3); print $3; exit } }' python/uv.lock)
+          ROOT_PACKAGE_VERSION=$(grep '"version"' package.json | head -1 | sed 's/.*"\(.*\)".*/\1/')
 
           echo "Workspace version: $WORKSPACE_VERSION"
           echo "NPM version: $NPM_VERSION"
           echo "Python version: $PYTHON_VERSION"
+          echo "uv lock version: $UV_LOCK_VERSION"
+          echo "Root package version: $ROOT_PACKAGE_VERSION"
 
           MISMATCH=0
           if [ "$WORKSPACE_VERSION" != "$NPM_VERSION" ]; then
@@ -445,6 +449,14 @@ jobs:
             echo "❌ Python version mismatch!"
             MISMATCH=1
           fi
+          if [ "$WORKSPACE_VERSION" != "$UV_LOCK_VERSION" ]; then
+            echo "❌ uv lock version mismatch!"
+            MISMATCH=1
+          fi
+          if [ "$WORKSPACE_VERSION" != "$ROOT_PACKAGE_VERSION" ]; then
+            echo "❌ Root package version mismatch!"
+            MISMATCH=1
+          fi
           if [ "$MISMATCH" -eq 1 ]; then
             exit 1
           fi
@@ -469,11 +481,12 @@ jobs:
         working-directory: npm
         run: |
           echo "Verifying .node files:"
-          ls -lh *.node
+          ls -lh ./*.node
           NODE_COUNT=$(find . -name "*.node" | wc -l | tr -d ' ')
           echo "Found $NODE_COUNT .node file(s)"
           if [ "$NODE_COUNT" -lt 5 ]; then
-            echo "⚠️  Warning: Expected at least 5 .node files (found $NODE_COUNT)"
+            echo "Expected at least 5 .node files, found $NODE_COUNT" >&2
+            exit 1
           fi
 
       # Download Python wheel artifacts
@@ -490,13 +503,14 @@ jobs:
           WHEEL_COUNT=$(find python-wheels -name "*.whl" | wc -l | tr -d ' ')
           echo "Found $WHEEL_COUNT wheel file(s)"
           if [ "$WHEEL_COUNT" -lt 5 ]; then
-            echo "⚠️  Warning: Expected at least 5 wheels (found $WHEEL_COUNT)"
+            echo "Expected at least 5 wheels, found $WHEEL_COUNT" >&2
+            exit 1
           fi
 
       # Publish to crates.io (treats "already published" as success)
       - name: Publish to crates.io
         env:
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CRATES_IO }}
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CRATES_IO_TOKEN }}
           VERSION: ${{ needs.version-check.outputs.new_version }}
         run: |
           rc=0