Validate metadata extraction helpers

.github/actions/workspace-release/action.yml

@@ -0,0 +1,107 @@
+name: workspace-release
+description: "Dry-run or publish Rust workspace crates using cargo"
+
+inputs:
+  mode:
+    description: "Release mode: dry-run or publish"
+    required: true
+    default: "dry-run"
+  verify-main-head:
+    description: "If true, ensure the triggering SHA matches main's HEAD"
+    required: false
+    default: "false"
+
+runs:
+  using: "composite"
+  steps:
+    # Optional: guard that release happens from latest main
+    - name: Verify tag matches main HEAD
+      if: ${{ inputs.verify-main-head == 'true' }}
+      shell: bash
+      run: |
+        git fetch origin main --depth=1
+        main_sha="$(git rev-parse origin/main)"
+        tag_sha="$(git rev-parse HEAD)"
+
+        echo "main_sha=$main_sha"
+        echo "tag_sha=$tag_sha"
+
+        if [ "$main_sha" != "$tag_sha" ]; then
+          echo "::error::The release/tag commit does not match origin/main HEAD. Aborting."
+          exit 1
+        fi
+
+    - name: Install Rust toolchain
+      uses: dtolnay/rust-toolchain@stable
+
+    - name: Cache cargo registry and git index
+      uses: actions/cache@v4
+      with:
+        path: |
+          ~/.cargo/registry
+          ~/.cargo/git
+        key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+        restore-keys: |
+          ${{ runner.os }}-cargo-
+
+    - name: Cleanup large tools for build space
+      uses: ./.github/actions/cleanup-runner
+
+    # Install cargo-msrv for MSRV checks
+    # Using binstall with --force to avoid stale cached binaries (see PR #2234)
+    - name: Install cargo-binstall
+      uses: taiki-e/install-action@v2
+      with:
+        tool: cargo-binstall
+
+    - name: Install cargo-msrv
+      shell: bash
+      run: cargo binstall --no-confirm --force cargo-msrv
+
+    # Keep your existing MSRV check
+    # PATH export required for check-msrv.sh subprocess (see PR #2234)
+    - name: Check MSRV
+      shell: bash
+      run: |
+        export PATH="$HOME/.cargo/bin:$PATH"
+        chmod +x scripts/check-msrv.sh
+        ./scripts/check-msrv.sh
+
+    # Clean packaging directory to avoid stale/corrupted tmp-registry state
+    - name: Clean packaging directory
+      shell: bash
+      run: |
+        echo "Cleaning target/package directory to ensure fresh state"
+        rm -rf target/package
+
+    # Clear cargo registry to ensure fresh resolution during verification.
+    # This prevents issues where cached metadata from previous runs
+    # might interfere with workspace dependency feature resolution
+    # during the verification step (related to cargo#14283, cargo#14789).
+    # Specifically, this ensures the temp registry used during workspace
+    # publish verification doesn't conflict with cached crates.io data.
+    - name: Clear cargo registry for fresh resolution
+      if: ${{ inputs.mode == 'dry-run' }}
+      shell: bash
+      run: |
+        echo "Clearing cargo registry for fresh resolution"
+        rm -rf ~/.cargo/registry/cache
+        rm -rf ~/.cargo/registry/index
+        rm -rf ~/.cargo/registry/src
+
+    # Dry-run vs real publish
+    - name: Dry-run workspace publish
+      if: ${{ inputs.mode == 'dry-run' }}
+      shell: bash
+      run: |
+        echo "Running cargo publish --workspace --dry-run"
+        cargo publish --workspace --dry-run
+
+    - name: Publish workspace crates
+      if: ${{ inputs.mode == 'publish' }}
+      shell: bash
+      env:
+        CARGO_REGISTRY_TOKEN: ${{ env.CARGO_REGISTRY_TOKEN }}
+      run: |
+        echo "Publishing workspace crates to crates.io"
+        cargo publish --workspace

.github/workflows/workspace-dry-run.yml

@@ -0,0 +1,33 @@
+name: Workspace release dry-run
+
+on:
+  push:
+    branches:
+      - main
+      - next
+
+permissions:
+  contents: read
+  id-token: write  # Required for OIDC token exchange
+
+concurrency:
+  group: "${{ github.workflow }} @ ${{ github.ref }}"
+  cancel-in-progress: true
+
+jobs:
+  release-dry-run:
+    if: ${{ github.repository_owner == '0xMiden' }}
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Dry-run workspace release
+        uses: ./.github/actions/workspace-release
+        with:
+          mode: "dry-run"
+          verify-main-head: "false"
+          # ref left blank: uses the pushed ref

.github/workflows/workspace-publish.yml

@@ -0,0 +1,34 @@
+name: Publish workspace to crates.io
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+  id-token: write  # Required for OIDC token exchange
+
+jobs:
+  publish:
+    if: ${{ github.repository_owner == '0xMiden' }}
+    runs-on: ubuntu-latest
+    environment: release  # Optional: for enhanced security
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: main
+
+      - name: Authenticate with crates.io
+        uses: rust-lang/crates-io-auth-action@v1
+        id: auth
+
+      - name: Publish workspace crates
+        uses: ./.github/actions/workspace-release
+        with:
+          mode: "publish"
+          verify-main-head: "true"
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}

CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.14.0 (TBD)
+
+### Features
+
+- Enable `CodeBuilder` to add advice map entries to compiled scripts ([#2275](https://github.com/0xMiden/miden-base/pull/2275)).
+- Added `BlockNumber::MAX` constant to represent the maximum block number ([#2324](https://github.com/0xMiden/miden-base/pull/2324)).
+- Added single-word `Array` standard ([#2203](https://github.com/0xMiden/miden-base/pull/2203)).
+
+### Changes
+
+- [BREAKING] Renamed `WellKnownComponent` to `StandardAccountComponent`, `WellKnownNote` to `StandardNote`, and `WellKnownNoteAttachment` to `StandardNoteAttachment` ([#2332](https://github.com/0xMiden/miden-base/pull/2332)).
+- Skip requests to the `DataStore` for asset vault witnesses which are already in transaction inputs ([#2298](https://github.com/0xMiden/miden-base/pull/2298)).
+- [BREAKING] refactored `TransactionAuthenticator::get_public_key()` method to return `Arc<PublicKey> `instead of `&PublicKey` ([#2304](https://github.com/0xMiden/miden-base/pull/2304)).
+- [BREAKING] Renamed `NoteInputs` to `NoteStorage` to better reflect that values are stored data associated with a note rather than inputs ([#1662](https://github.com/0xMiden/miden-base/issues/1662), [#2316](https://github.com/0xMiden/miden-base/issues/2316)).
+- Removed `NoteType::Encrypted` ([#2315](https://github.com/0xMiden/miden-base/pull/2315)).
+
+# 0.13.3 (TBD)
+
+- Added standards for working with `NetworkAccountTarget` attachments ([#2338](https://github.com/0xMiden/miden-base/pull/2338)).
+
 ## 0.13.2 (2026-01-21)
 
 - Make transaction executor respect debug mode settings ([#2327](https://github.com/0xMiden/miden-base/pull/2327)).