[codedmart]

Summary

Prepare the existing post-0.3.0 connector changes for a reviewed 0.4.0 release.
This change does not publish a tag, release an image, or deploy a connector.

1. Build tooling

• Pin cargo-chef to 0.1.71 with its lockfile, retaining Rust 1.89.
• Use locked dependency builds for the container, CLI matrix, and connector definition.
• Use Ubuntu 24.04 rather than a moving runtime tag.

2. Version and delivery

• Align the workspace and local lockfile packages to 0.4.0.
• Fold the unpublished 0.3.1 changelog into 0.4.0 and describe the existing breaking interface/union output migration.
• Validate tag/workspace/lock/changelog agreement before publication.
• Include manifest.yaml in release assets; document catalog and self-hosted delivery checks.

3. Validation and security

• Gate the tag publication path on reusable test/format and security workflows.
• Add five positive/negative tests for release version preflight.
• Pin cargo-audit 0.22.2 (supports the current CVSS 4 advisory format).
• Update affected locked dependencies without changing the pinned NDC SDK/spec.
• Replace unmaintained rustls-pemfile with the maintained rustls-pki-types PEM API, with certificate/bundle/malformed-file tests.
• Reject audit warnings as well as vulnerabilities, without advisory ignores.

4. Handler edge cases

• Return no RowSets and perform no upstream request for an explicit empty variables batch.
• Fail on missing function result aliases rather than silently returning null; preserve valid explicit null.
• Avoid query and mutation panics on empty GraphQL errors arrays.
• Add eight local HTTP-backed tests calling the production handlers: no variables, zero/one/multiple inputs, input ordering, duplicates, string identifiers, empty/null list results, per-parent response headers, and upstream errors.
• Existing main already contains the normal batch split/rename correction; these tests exercise that production path rather than duplicating it.

Validation

• cargo test --workspace --all-features --locked: 41 passed, 2 existing ignored generators.
• python3 -m unittest discover -s ci -p 'test_*.py': 5 passed.
• cargo fmt --all --check, git diff --check, actionlint 1.7.12: passed.
• New handler tests against the original handlers: five correctly fail; restored fixed handlers pass.
• cargo audit --deny warnings against freshly fetched RustSec advisory-db commit edb58f5974b83eb8302332821cb6d389777aa351: zero vulnerabilities and zero warnings. The original lockfile produced 17 vulnerability findings plus warnings; no suppressions were added.
• Final local Docker build and docker run --rm ndc-graphql:0.4.0-review --help: passed on Linux amd64.

Before release

• Review CI results, including the five platform-specific CLI builds.
• Validate the connector with representative cross-subgraph list-valued command metadata on the deployed engine version. Connector handler tests are not exact-engine compatibility certification.
• Confirm schema migration, image source/digest, architecture, catalog/plugin registration, and self-hosted distribution/rollback.
• Only after approval should a maintainer create v0.4.0.

AI-assisted implementation prepared by Hasura Bot for maintainer review.