fix: align CLI version with Cargo.toml and use local wheels in CI

- goreleaser now reads COG_VERSION from Cargo.toml (set by mise
  build:cog) instead of git describe for ldflags and snapshot version
- CI integration tests set COG_WHEEL=dist to use the locally-built
  wheel rather than PyPI (where the version may not be published yet)
- IT harness propagates SSL_CERT_FILE, REQUESTS_CA_BUNDLE, COG_CA_CERT
  for corporate proxy/MITM environments (e.g. Cloudflare WARP)
- Include Cargo.lock update from 0.17.0-alpha3 version bump

Author: tempusfrangit

.github/workflows/ci.yaml

@@ -692,8 +692,10 @@ jobs:
       - uses: jdx/mise-action@v3
       - name: Build cog binary
         run: mise run build:cog
-      - name: Set runtime environment
+      - name: Set wheel environment
         run: |
+          # Use locally-built wheels, not PyPI (version may not be published yet)
+          echo "COG_WHEEL=dist" >> $GITHUB_ENV
           if [ "${{ matrix.runtime }}" = "cog-rust" ]; then
             echo "COGLET_WHEEL=dist" >> $GITHUB_ENV
           fi

.goreleaser.yaml

@@ -5,6 +5,10 @@ before:
 dist: ./dist/go
 env:
   - CGO_ENABLED=0
+  # COG_VERSION is set by mise build:cog from Cargo.toml (single source of truth).
+  # For tagged releases, goreleaser derives Version from the tag and COG_VERSION is unused in ldflags.
+  # For snapshot builds, COG_VERSION overrides the git-derived version.
+  - COG_VERSION={{ if index .Env "COG_VERSION" }}{{ .Env.COG_VERSION }}{{ else }}{{ .Version }}{{ end }}
 builds:
   - binary: cog
     id: cog
@@ -16,7 +20,7 @@ builds:
       - arm64
     main: ./cmd/cog
     ldflags:
-      - "-s -w -X github.com/replicate/cog/pkg/global.Version={{.Version}} -X github.com/replicate/cog/pkg/global.Commit={{.Commit}} -X github.com/replicate/cog/pkg/global.BuildTime={{.Date}}"
+      - "-s -w -X github.com/replicate/cog/pkg/global.Version={{ .Env.COG_VERSION }} -X github.com/replicate/cog/pkg/global.Commit={{.Commit}} -X github.com/replicate/cog/pkg/global.BuildTime={{.Date}}"
   - binary: base-image
     id: base-image
     goos:
@@ -27,7 +31,7 @@ builds:
       - arm64
     main: ./cmd/base-image
     ldflags:
-      - "-s -w -X github.com/replicate/cog/pkg/global.Version={{.Version}} -X github.com/replicate/cog/pkg/global.Commit={{.Commit}} -X github.com/replicate/cog/pkg/global.BuildTime={{.Date}}"
+      - "-s -w -X github.com/replicate/cog/pkg/global.Version={{ .Env.COG_VERSION }} -X github.com/replicate/cog/pkg/global.Commit={{.Commit}} -X github.com/replicate/cog/pkg/global.BuildTime={{.Date}}"
 archives:
   - formats: [binary]
     ids:
@@ -41,7 +45,7 @@ archives:
 checksum:
   name_template: "checksums.txt"
 snapshot:
-  version_template: "{{ incpatch .Version }}-dev+g{{ .ShortCommit }}{{ if .IsGitDirty }}.d{{ .Now.Format \"20060102\" }}{{ end }}"
+  version_template: "{{ .Env.COG_VERSION }}-dev+g{{ .ShortCommit }}{{ if .IsGitDirty }}.d{{ .Now.Format \"20060102\" }}{{ end }}"
 changelog:
   sort: asc
   filters:

crates/Cargo.lock

@@ -6,6 +6,7 @@ require (
 	github.com/anaskhan96/soup v1.2.5
 	github.com/aws/aws-sdk-go-v2 v1.39.4
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.88.7
+	github.com/containerd/errdefs v1.0.0
 	github.com/docker/cli v28.5.2+incompatible
 	github.com/docker/docker v28.5.2+incompatible
 	github.com/docker/go-connections v0.5.0
@@ -16,6 +17,7 @@ require (
 	github.com/mattn/go-isatty v0.0.20
 	github.com/mitchellh/go-homedir v1.1.0
 	github.com/moby/buildkit v0.22.0
+	github.com/moby/docker-image-spec v1.3.1
 	github.com/moby/term v0.5.2
 	github.com/opencontainers/image-spec v1.1.1
 	github.com/pkg/errors v0.9.1
@@ -63,7 +65,6 @@ require (
 	github.com/containerd/containerd/api v1.8.0 // indirect
 	github.com/containerd/containerd/v2 v2.0.7 // indirect
 	github.com/containerd/continuity v0.4.5 // indirect
-	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/containerd/platforms v1.0.0-rc.1 // indirect
@@ -107,7 +108,6 @@ require (
 	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-runewidth v0.0.16 // indirect
-	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/go-archive v0.1.0 // indirect
 	github.com/moby/locker v1.0.1 // indirect
 	github.com/moby/patternmatcher v0.6.0 // indirect

go.mod

@@ -275,6 +275,19 @@ func (h *Harness) Setup(env *testscript.Env) error {
 		env.Setenv("RUST_LOG", rustLog)
 	}
 
+	// Propagate SSL/TLS cert environment for corporate proxies (e.g. Cloudflare WARP)
+	if sslCertFile := os.Getenv("SSL_CERT_FILE"); sslCertFile != "" {
+		env.Setenv("SSL_CERT_FILE", sslCertFile)
+	}
+	if requestsCA := os.Getenv("REQUESTS_CA_BUNDLE"); requestsCA != "" {
+		env.Setenv("REQUESTS_CA_BUNDLE", requestsCA)
+	}
+
+	// Propagate COG_CA_CERT for CA certificate injection into Docker images
+	if cogCACert := os.Getenv("COG_CA_CERT"); cogCACert != "" {
+		env.Setenv("COG_CA_CERT", cogCACert)
+	}
+
 	// Generate unique image name for this test run
 	imageName := generateUniqueImageName()
 	env.Setenv("TEST_IMAGE", imageName)