Release v3.0.1: fix the multi-architecture Docker build

.github/workflows/publish-python.yml

@@ -130,5 +130,12 @@ jobs:
           name: python-dist
           path: dist
 
+      # PyPI reserves a version permanently once it is uploaded, so re-pushing a
+      # release tag -- to correct a Dockerfile, a workflow, or anything else
+      # outside the Python artifact -- used to fail this job on the duplicate.
+      # Skipping what is already published makes a tag re-push idempotent: the
+      # Docker and release jobs re-run, and PyPI is left exactly as it was.
       - name: Publish package
         uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          skip-existing: true

CITATION.cff

@@ -2,7 +2,7 @@ cff-version: 1.2.0
 message: "If you use VCF-RDFizer in your research, please cite it using the metadata below."
 title: "VCF-RDFizer"
 type: software
-version: "3.0.0"
+version: "3.0.1"
 authors:
   - name: "VCF-RDFizer maintainers"
 repository-code: "https://github.com/ecrum19/VCF-RDFizer"

Dockerfile

@@ -91,6 +91,12 @@ RUN cargo build --locked --release \
 # Named stage so the runtime image can COPY QLever's binaries out of it.
 FROM ${QLEVER_IMAGE} AS qlever
 
+# Upstream's image runs as a non-root user, so writing anywhere outside that
+# user's own tree fails. This stage needs to write a staging directory, so it
+# switches to root; the stage is discarded after the COPY below, and nothing
+# here changes the user the published image runs as.
+USER root
+
 # Stage QLever's binaries and the release-specific libraries they need into one
 # fixed layout, so the runtime image copies from architecture-independent paths.
 #
@@ -112,20 +118,22 @@ FROM ${QLEVER_IMAGE} AS qlever
 # runtime base is newer than QLever's. Only the families the binaries cannot
 # find in that base are taken, which is the same set the previous soname list
 # named.
+# /tmp rather than /opt: it is world-writable in every base image, so the
+# staging directory is created even if this stage ever runs unprivileged again.
 RUN set -eu; \
-  mkdir -p /opt/qlever-stage/bin /opt/qlever-stage/lib; \
+  mkdir -p /tmp/qlever-stage/bin /tmp/qlever-stage/lib; \
   for binary in qlever-index qlever-server; do \
     [ -f "/qlever/$binary" ] || continue; \
-    cp "/qlever/$binary" /opt/qlever-stage/bin/; \
+    cp "/qlever/$binary" /tmp/qlever-stage/bin/ || continue; \
     ldd "/qlever/$binary" 2>/dev/null \
       | sed -n 's/.*=> \(\/[^ ]*\).*/\1/p' \
       | grep -E '/(libboost_|libicu|libjemalloc|liburing|libgomp)[^/]*$' \
       | while read -r library; do \
-          cp -Ln "$library" /opt/qlever-stage/lib/ 2>/dev/null || true; \
-        done; \
+          cp -Ln "$library" /tmp/qlever-stage/lib/ 2>/dev/null || true; \
+        done || true; \
   done; \
-  echo "staged QLever binaries:"; ls -1 /opt/qlever-stage/bin || true; \
-  echo "staged QLever libraries:"; ls -1 /opt/qlever-stage/lib || true
+  echo "staged QLever binaries:"; ls -1 /tmp/qlever-stage/bin || true; \
+  echo "staged QLever libraries:"; ls -1 /tmp/qlever-stage/lib || true
 
 
 FROM eclipse-temurin:11-jre
@@ -205,8 +213,8 @@ COPY --from=build-hdtc /opt/third_party_licenses/ /usr/share/licenses/vcf-rdfize
 # pointed at, so they cannot shadow anything the rest of the image links
 # against. (glibc itself is not copied - it is backward compatible, and this
 # base is newer than QLever's.)
-COPY --from=qlever /opt/qlever-stage/bin/ /opt/qlever/bin/
-COPY --from=qlever /opt/qlever-stage/lib/ /opt/qlever/lib/
+COPY --from=qlever /tmp/qlever-stage/bin/ /opt/qlever/bin/
+COPY --from=qlever /tmp/qlever-stage/lib/ /opt/qlever/lib/
 COPY THIRD_PARTY_NOTICES.md /usr/share/licenses/vcf-rdfizer/THIRD_PARTY_NOTICES.md
 COPY src/*.sh /opt/vcf-rdfizer/
 COPY src/*.py /opt/vcf-rdfizer/

README.md

@@ -1080,7 +1080,7 @@ Safe termination:
 
 If you use VCF-RDFizer in a publication, please cite:
 
-VCF-RDFizer maintainers. (2026). *VCF-RDFizer* (Version 3.0.0) [Computer software]. GitHub. https://github.com/ecrum19/VCF-RDFizer
+VCF-RDFizer maintainers. (2026). *VCF-RDFizer* (Version 3.0.1) [Computer software]. GitHub. https://github.com/ecrum19/VCF-RDFizer
 
 BibTeX:
 
@@ -1089,7 +1089,7 @@ BibTeX:
   author  = {{VCF-RDFizer maintainers}},
   title   = {VCF-RDFizer},
   year    = {2026},
-  version = {3.0.0},
+  version = {3.0.1},
   url     = {https://github.com/ecrum19/VCF-RDFizer},
   note    = {Computer software}
 }

conda-recipe/README.md

@@ -7,11 +7,11 @@ do not submit this package to `staged-recipes`.
 
 ## Before submitting to conda-forge
 
-1. Commit the version bump, then create and push a Git tag (for example `v3.0.0`).
+1. Commit the version bump, then create and push a Git tag (for example `v3.0.1`).
 2. Download the source tarball and compute sha256:
    ```bash
    curl -L -o vcf-rdfizer.tar.gz \
-     https://github.com/ecrum19/VCF-RDFizer/archive/refs/tags/v3.0.0.tar.gz
+     https://github.com/ecrum19/VCF-RDFizer/archive/refs/tags/v3.0.1.tar.gz
    shasum -a 256 vcf-rdfizer.tar.gz
    ```
 3. Replace `version` and `sha256` in the feedstock's `recipe/meta.yaml`.

conda-recipe/meta.yaml

@@ -1,5 +1,5 @@
 {% set name = "vcf-rdfizer" %}
-{% set version = "3.0.0" %}
+{% set version = "3.0.1" %}
 
 package:
   name: {{ name|lower }}

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "vcf-rdfizer"
-version = "3.0.0"
+version = "3.0.1"
 description = "Docker-first VCF to RDF conversion targeting the VCF Core vocabulary, with compressed queryable representations (HDT, COTTAS), semantic validation, and data linking"
 readme = "README.md"
 requires-python = ">=3.10"