chore: bump workspace to 1.9.0 + CHANGELOG

Workspace version goes from 1.8.1 → 1.9.0. Internal crate deps that
carry an explicit version (wfe-buildkit-protos, wfe-containerd-protos,
wfe in wfe-deno) are bumped to match.

CHANGELOG.md documents the release under `## [1.9.0] - 2026-04-07`:

* wfectl CLI with 17 subcommands
* wfectl validate (local YAML compile, no round-trip)
* Human-friendly workflow names (instance sequencing + definition
  display name)
* wfe-server full feature set (kubernetes + deno + buildkit +
  containerd + rustlang) on a debian base
* wfe-ci builder Dockerfile
* /bin/bash for run scripts
* ensure_store_exists called on host start
* SubWorkflowStep parent data inheritance
* workflows.yaml restructured for YAML 1.1 shallow-merge semantics

CHANGELOG.md

@@ -2,6 +2,57 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.9.0] - 2026-04-07
+
+### Added
+
+- **wfectl**: New command-line client for wfe-server with 17 subcommands
+  (login, logout, whoami, register, validate, definitions, run, get, list,
+  cancel, suspend, resume, publish, watch, logs, search-logs). Supports
+  OAuth2 PKCE login flow via Ory Hydra, direct bearer-token auth, and
+  configurable output formats (table/JSON).
+- **wfectl validate**: Local YAML validation command that compiles workflow
+  files in-process via `wfe-yaml` with the full executor feature set
+  (rustlang, buildkit, containerd, kubernetes, deno). No server round-trip
+  or auth required — instant feedback before push.
+- **Human-friendly workflow names**: `WorkflowInstance` now has a `name`
+  field (unique alongside the UUID primary key). The host auto-assigns
+  `{definition_id}-{N}` using a per-definition monotonic counter, with
+  optional caller override via `start_workflow_with_name` /
+  `StartWorkflowRequest.name`. All gRPC read/mutate APIs accept either the
+  UUID or the human name interchangeably. `WorkflowDefinition` now has an
+  optional display `name` declared in YAML (e.g. `name: "Continuous
+  Integration"`) that surfaces in listings.
+- **wfe-server**: Full executor feature set enabled in the shipped binary —
+  kubernetes, deno, buildkit, containerd, rustlang step types all compiled
+  in.
+- **wfe-server**: Dockerfile switched from `rust:alpine` to
+  `rust:1-bookworm` + `debian:bookworm-slim` runtime because `deno_core`'s
+  bundled v8 only ships glibc binaries.
+- **wfe-ci**: New `Dockerfile.ci` builder image with rust stable,
+  cargo-nextest, cargo-llvm-cov, sccache, buildctl, kubectl, tea, git.
+  Used as the base image for kubernetes-executed CI steps.
+- **wfe-kubernetes**: `run:` scripts now execute under `/bin/bash -c`
+  instead of `/bin/sh -c` so workflows can rely on `set -o pipefail`,
+  process substitution, arrays, and other bashisms dash doesn't support.
+
+### Fixed
+
+- **wfe**: `WorkflowHost::start()` now calls
+  `persistence.ensure_store_exists()`, which was previously defined but
+  never invoked — the Postgres/SQLite schema was never auto-created on
+  startup, causing `relation "wfc.workflows" does not exist` errors on
+  first run.
+- **wfe-core**: `SubWorkflowStep` now inherits the parent workflow's data
+  when no explicit inputs are set, so child workflows see the same
+  top-level fields (e.g. `$REPO_URL`, `$COMMIT_SHA`) without every
+  `type: workflow` step having to re-declare them.
+- **workflows.yaml**: Restructured all step references from
+  `<<: *ci_step` / `<<: *ci_long` (which relied on YAML 1.1 shallow merge
+  over-writing the `config:` block) to inner-config merges of the form
+  `config: {<<: *ci_config, ...}`. Secret env vars moved into the shared
+  `ci_env` anchor so individual steps don't fight the shallow merge.
+
 ## [1.8.1] - 2026-04-06
 
 ### Added

Cargo.toml

@@ -1,9 +1,9 @@
 [workspace]
-members = ["wfe-core", "wfe-sqlite", "wfe-postgres", "wfe-opensearch", "wfe-valkey", "wfe", "wfe-yaml", "wfe-buildkit", "wfe-containerd", "wfe-containerd-protos", "wfe-buildkit-protos", "wfe-rustlang", "wfe-server-protos", "wfe-server", "wfe-kubernetes", "wfe-deno"]
+members = ["wfe-core", "wfe-sqlite", "wfe-postgres", "wfe-opensearch", "wfe-valkey", "wfe", "wfe-yaml", "wfe-buildkit", "wfe-containerd", "wfe-containerd-protos", "wfe-buildkit-protos", "wfe-rustlang", "wfe-server-protos", "wfe-server", "wfe-kubernetes", "wfe-deno", "wfectl"]
 resolver = "2"
 
 [workspace.package]
-version = "1.8.1"
+version = "1.9.0"
 edition = "2024"
 license = "MIT"
 repository = "https://src.sunbeam.pt/studio/wfe"
@@ -38,16 +38,17 @@ redis = { version = "0.27", features = ["tokio-comp", "connection-manager"] }
 opensearch = "2"
 
 # Internal crates
-wfe-core = { version = "1.8.1", path = "wfe-core", registry = "sunbeam" }
+wfe-core = { version = "1.9.0", path = "wfe-core", registry = "sunbeam" }
-wfe-sqlite = { version = "1.8.1", path = "wfe-sqlite", registry = "sunbeam" }
+wfe-sqlite = { version = "1.9.0", path = "wfe-sqlite", registry = "sunbeam" }
-wfe-postgres = { version = "1.8.1", path = "wfe-postgres", registry = "sunbeam" }
+wfe-postgres = { version = "1.9.0", path = "wfe-postgres", registry = "sunbeam" }
-wfe-opensearch = { version = "1.8.1", path = "wfe-opensearch", registry = "sunbeam" }
+wfe-opensearch = { version = "1.9.0", path = "wfe-opensearch", registry = "sunbeam" }
-wfe-valkey = { version = "1.8.1", path = "wfe-valkey", registry = "sunbeam" }
+wfe-valkey = { version = "1.9.0", path = "wfe-valkey", registry = "sunbeam" }
-wfe-yaml = { version = "1.8.1", path = "wfe-yaml", registry = "sunbeam" }
+wfe-yaml = { version = "1.9.0", path = "wfe-yaml", registry = "sunbeam" }
-wfe-buildkit = { version = "1.8.1", path = "wfe-buildkit", registry = "sunbeam" }
+wfe-buildkit = { version = "1.9.0", path = "wfe-buildkit", registry = "sunbeam" }
-wfe-containerd = { version = "1.8.1", path = "wfe-containerd", registry = "sunbeam" }
+wfe-containerd = { version = "1.9.0", path = "wfe-containerd", registry = "sunbeam" }
-wfe-rustlang = { version = "1.8.1", path = "wfe-rustlang", registry = "sunbeam" }
+wfe-rustlang = { version = "1.9.0", path = "wfe-rustlang", registry = "sunbeam" }
-wfe-kubernetes = { version = "1.8.1", path = "wfe-kubernetes", registry = "sunbeam" }
+wfe-kubernetes = { version = "1.9.0", path = "wfe-kubernetes", registry = "sunbeam" }
+wfe-server-protos = { version = "1.9.0", path = "wfe-server-protos", registry = "sunbeam" }
 
 # YAML
 serde_yaml = "0.9"

wfe-buildkit/Cargo.toml

@@ -16,7 +16,7 @@ async-trait = { workspace = true }
 tracing = { workspace = true }
 thiserror = { workspace = true }
 regex = { workspace = true }
-wfe-buildkit-protos = { version = "1.8.1", path = "../wfe-buildkit-protos", registry = "sunbeam" }
+wfe-buildkit-protos = { version = "1.9.0", path = "../wfe-buildkit-protos", registry = "sunbeam" }
 tonic = "0.14"
 tower = { version = "0.4", features = ["util"] }
 hyper-util = { version = "0.1", features = ["tokio"] }

wfe-containerd/Cargo.toml

@@ -9,7 +9,7 @@ description = "containerd container runner executor for WFE"
 
 [dependencies]
 wfe-core = { workspace = true }
-wfe-containerd-protos = { version = "1.8.1", path = "../wfe-containerd-protos", registry = "sunbeam" }
+wfe-containerd-protos = { version = "1.9.0", path = "../wfe-containerd-protos", registry = "sunbeam" }
 tokio = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }

wfe-deno/Cargo.toml

@@ -9,7 +9,7 @@ description = "Deno bindings for the WFE workflow engine"
 
 [dependencies]
 wfe-core = { workspace = true, features = ["test-support"] }
-wfe = { version = "1.8.1", path = "../wfe", registry = "sunbeam" }
+wfe = { version = "1.9.0", path = "../wfe", registry = "sunbeam" }
 deno_core = { workspace = true }
 deno_error = { workspace = true }
 tokio = { workspace = true }