Revert CAT_TOOLS_GIT_REF override now that cat_tools 0.3.0 is on PGXN

[jnasbyupgrade]

Summary

• cat_tools 0.3.0 was published to PGXN on 2026-08-06, so a plain pgxn install
  now satisfies META.in.json's declared cat_tools: 0.3.0 floor. The
  workflow-level CAT_TOOLS_GIT_REF: 0.3.0 override (added to work around
  PGXN's previously-stale 2017 cat_tools release) is no longer needed.
• This is the release-blocking condition both this repo's RELEASE.md and the
  shared ../ai/RELEASE.md warn about: never cut a release while a
  dependency is pinned to a git ref instead of PGXN. Clearing it is a
  prerequisite for cutting the pending 1.0.0 release.
• pg-tle-test still needs a concrete git ref for its own from-scratch
  cat_tools clone (that job registers cat_tools via pg_tle, never through
  PGXN/filesystem install). It now carries its own job-scoped
  CAT_TOOLS_GIT_REF, empty by default and falling back to the stable
  tag, decoupled from the release-gated override above.
• New: automated the release-pin check. Added bin/in_release (true
  when default_version is a real version, i.e. cutting a release) and a
  release-safety CI job that hard-fails if that's ever true at the same
  time CAT_TOOLS_GIT_REF/CAT_TOOLS_SKIP_INSTALL is set at the workflow
  level — this was previously a manual step in RELEASE.md, easy to forget.
• Local RELEASE.md now documents just that mechanism (the generic
  guardrail itself lives in the shared Postgres-Extensions/ai/RELEASE.md).

Verified locally

• Removing the override, a plain pgxn install 'cat_tools>=0.2.1' --sudo
  fetches and installs cat_tools 0.3.0 from PGXN (confirmed by running it).
• make verify-results passes on PG17 (fresh install + build tests).
• .github/workflows/ci.yml parses as valid YAML after the edit.
• bin/in_release and the release-safety job's fail condition checked
  against all three cases: stable+no-override (pass), stable+override
  (pass — that's normal mid-development use), real-version+override
  (fails, as intended).

Test plan

• CI green on this PR (fresh-install matrix, pg_tle job, pg_upgrade job,
  new release-safety job) — confirms the plain-PGXN path and the new
  guard job both work in the actual CI container, not just locally.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c4a48ae5-59b8-4be7-b328-f27eb01d2872

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Claude finished @jnasbyupgrade's task in 1m 6s —— View job

---

Code Review

Tasks:

• Read trigger request and repo CLAUDE.md
• Review diff (.github/workflows/ci.yml, RELEASE.md removal)
• Check reasoning against ../ai/RELEASE.md guardrail
• Verify pg-tle-test job-level override is correctly scoped
• Post review feedback

Summary

This is exactly the release-blocking cleanup the PR description says it is, and the diff backs it up:

• META.in.json:82 declares "cat_tools": "0.3.0" as the floor, and Makefile:104 installs via pgxn install 'cat_tools>=0.2.1' --sudo — with 0.3.0 now on PGXN, that plain install satisfies the declared floor without the workflow-level override.
• Removing the top-level CAT_TOOLS_GIT_REF: 0.3.0 env (.github/workflows/ci.yml:17-26 in the old version) correctly un-blocks the release per the guardrail the (now-deleted) RELEASE.md described.
• The pg-tle-test job's new job-level CAT_TOOLS_GIT_REF: 0.3.0 (ci.yml:311) is correctly scoped — that job clones cat_tools from git directly for pg_tle registration (never through PGXN/filesystem install), so it never picked up the Makefile's pgxn install path and genuinely needs its own explicit ref. Decoupling it from the top-level override is the right call.
• The removed CAT_TOOLS_GIT_REF=$(make -s print-CAT_TOOLS_GIT_REF ...) shell dance is replaced with the value already being in the job's env — simpler and correct, since the job-level env: is visible to the run: step.
• Deleting RELEASE.md is reasonable: its only content was documenting this one override, which this PR resolves, and the generic guardrail already lives in the shared ../ai/RELEASE.md. Confirmed no other file in the repo links to the deleted RELEASE.md.
• CI on this PR is green (fresh-install matrix, pg_tle job, pg_upgrade job all passed), which is the load-bearing verification for a change like this.

No issues found. Nothing to flag, no suggested fixes.

[github-actions]

Claude finished @jnasbyupgrade's task in 2m 19s —— View job

---

Code Review

Tasks:

• Read trigger request and repo CLAUDE.md
• Review diff (.github/workflows/ci.yml, RELEASE.md, new bin/in_release)
• Check reasoning against ../ai/RELEASE.md guardrail
• Verify pg-tle-test job-level override is correctly scoped
• Review new bin/in_release script
• Post review feedback

Summary

This push (commit f96ae0e) builds on the earlier revert by automating the guardrail it previously relied on manual review for. The diff is clean and internally consistent:

• bin/in_release (ci.yml:55, new file) is a small, correct predicate: it greps default_version out of extension_drop.control and exits 0 only when it's a real version (mid-release) rather than the stable placeholder. set -euo pipefail plus the default arg (${1:-extension_drop.control}) resolve correctly against the repo root, which is where the new release-safety job invokes it from after checkout. Executable bit is set (mode 100755).
• release-safety job (ci.yml:44-57) correctly fails only when both conditions hold: bin/in_release is true (cutting a release) and CAT_TOOLS_GIT_REF/CAT_TOOLS_SKIP_INSTALL are non-empty. Since the workflow-level env: block was removed in the prior commit, those vars are unset in this job's environment (no set -u, so $CAT_TOOLS_GIT_REF$CAT_TOOLS_SKIP_INSTALL safely expands to "") — the check is a no-op today and only fires if someone re-adds the override at the workflow level in the future, which is exactly the scenario it's meant to catch.
• It's correctly wired into all-checks-passed's needs: list (ci.yml:427), so a future accidental override would actually block merge rather than just failing silently.
• pg-tle-test's CAT_TOOLS_GIT_REF: "" (ci.yml:326) is now empty-by-default with a fallback to the stable git tag (ci.yml:375: checkout "${CAT_TOOLS_GIT_REF:-stable}") rather than hardcoding 0.3.0 as the PR description originally proposed. This is a nice improvement over the original plan — it means this job won't need a manual bump the next time cat_tools cuts a release, and it stays decoupled from release-safety's workflow-level check (job-level env never leaks across jobs in Actions, so there's no interaction between the two).
• Confirmed no dangling references: the old make print-CAT_TOOLS_GIT_REF target and its call site are both gone (removed together, nothing orphaned).
• RELEASE.md now documents why a local copy exists again (the automated check itself, per the file's own reasoning about when a repo needs repo-specific content) — consistent with the file being deleted in the prior commit for the opposite reason.

No issues found. Nothing to flag, no suggested fixes.