feat(ci): check only affected Rust packages

Replace full-workspace Rust pre-build checks with an affected-package
selection flow. The new xtask maps changed Git paths to workspace
packages, expands the selection to transitive workspace dependents, and
falls back to the full workspace when a change is global or cannot be
mapped safely.

This reduces CI time for package-scoped changes while preserving coverage
for shared inputs such as Cargo files, toolchain config, CI config,
custom lints, xtask code, and other global build inputs.

The affected check now runs:

- isolated default-feature package builds
- Clippy with all targets/features
- carbide-lints with all targets/features

Also add reviewer guidance for keeping the global-path fallback list
up to date.

Signed-off-by: Dmitry Porokh <dporokh@nvidia.com>

Author: poroh

.github/workflows/ci.yaml

@@ -1103,6 +1103,12 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          # actions/checkout fetches only one commit by default; a depth of 0 removes
+          # that limit and fetches the full history. The `check-affected`
+          # cargo-make task needs that history to find HEAD's common ancestor with
+          # origin/main.
+          fetch-depth: 0
 
       # PostgreSQL is required because sqlx proc macros (sqlx::query!) connect to
       # a local database at compile time to validate SQL queries and return types.
@@ -1114,11 +1120,13 @@ jobs:
           sudo -u postgres psql -c "ALTER USER root WITH SUPERUSER;"
           createdb root
 
-      - name: Run clippy
-        run: cargo make --no-workspace clippy-flow
-
-      - name: Run carbide lints
-        run: cargo make carbide-lints
+      # `check-affected` selects packages and replaces separate CI steps for
+      # Clippy, carbide-lints, and isolated default-feature builds. Formatting,
+      # workspace dependency, license, and ban checks remain global below.
+      - name: Run affected Rust checks
+        env:
+          AFFECTED_BASE: origin/main
+        run: cargo make --no-workspace check-affected
 
       - name: Check TOML formatting
         run: taplo fmt --check || echo "Please format toml files"
@@ -1135,9 +1143,6 @@ jobs:
       - name: Check bans
         run: cargo make --no-workspace check-bans
 
-      - name: Check isolated package builds
-        run: cargo xtask check-isolated-package-builds
-
       - name: Check repository is clean
         run: bash scripts/check-repo-clean.sh "Core pre-build checks"
 

AGENTS.md

@@ -124,14 +124,27 @@ cargo make format-nightly      # Also sort imports
 > `carbide-lints`. The stable toolchain pinned in `rust-toolchain.toml` is used
 > for everything else.
 
-### Top-level Makefile (rest-api entrypoint)
+#### Affected-package CI
+
+When reviewing changes that add, remove, rename, or repurpose shared Rust build
+inputs, verify that `is_global_path()` in
+`crates/xtask/src/affected_packages.rs` remains up to date. Currently matched
+shared inputs include the root Cargo files and `Cargo.lock`, cargo-make files,
+Rust toolchain configuration, `.cargo/`, CI configuration, custom lint and xtask
+code, and `include/`. Add any newly introduced or repurposed shared generated or
+configuration directories to the predicate. If a changed path cannot be mapped
+safely to exactly one workspace package, affected-package selection must fall
+back to the full workspace.
+
+### Top-level Makefile entrypoints
 
 A top-level [`Makefile`](Makefile) at the repo root provides a thin
-discoverable entrypoint for the `rest-api/` Go services. It just
-delegates to `rest-api/Makefile`.
+discoverable entrypoint for selected Core workflows and the `rest-api/` Go
+services.
 
 ```bash
-make help                # default goal: list rest-* targets
+make help                # default goal: list available targets
+make core/check-affected # check affected Rust packages and workspace dependents
 make rest-build          # build rest-api Go binaries
 make rest-test           # run rest-api unit tests
 make rest-lint           # lint rest-api
@@ -142,8 +155,8 @@ make rest-kind-reset     # spin up the local kind dev cluster (~10 min)
 make rest-api/<target>   # pass any target through to rest-api/Makefile
 ```
 
-Core (Rust) tasks are not in this Makefile; use cargo and `cargo make`
-directly as documented above.
+Other Core (Rust) tasks use cargo and `cargo make` directly as documented
+above.
 
 ## Coding Conventions
 

Makefile

@@ -14,18 +14,20 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
-# Top-level Makefile for the rest-api/ Go services.
+# Top-level Makefile for Core and rest-api workflows.
 #
-# Thin discoverable entrypoint that delegates to rest-api/Makefile.
-# rest-api/Makefile continues to work directly; this file is an
-# additive convenience layer.
+# Thin discoverable entrypoint that delegates Core tasks to cargo-make and Rest
+# tasks to rest-api/Makefile. Both underlying entrypoints continue to work
+# directly; this file is an additive convenience layer.
 #
 # Run `make help` (default goal) for the inventory of targets.
 
 SHELL := /bin/bash
 
 .DEFAULT_GOAL := help
 
+AFFECTED_BASE ?= origin/main
+
 # =============================================================================
 # Help (default goal)
 # =============================================================================
@@ -38,12 +40,23 @@ help: ## Show this help and exit (default goal)
 	@echo "Container images (build from a clean clone):"
 	@grep -E '^images[a-zA-Z0-9_-]*:.*## ' $(MAKEFILE_LIST) | awk 'BEGIN{FS=":.*?## "} {printf "  %-26s %s\n", $$1, $$2}'
 	@echo ""
+	@echo "Core (Rust):"
+	@grep -E '^core/check-affected:.*## ' $(MAKEFILE_LIST) | awk 'BEGIN{FS=":.*?## "} {printf "  %-26s %s\n", $$1, $$2}'
+	@echo ""
 	@echo "Rest (Go services in rest-api/):"
 	@grep -E '^rest-[a-zA-Z0-9_-]+:.*## ' $(MAKEFILE_LIST) | awk 'BEGIN{FS=":.*?## "} {printf "  %-26s %s\n", $$1, $$2}'
 	@echo "  rest-api/<target>          Pass any target through to rest-api/Makefile"
 	@echo ""
 	@echo "  cat rest-api/Makefile      See all rest-api/ targets directly"
 
+# =============================================================================
+# Core (Rust; delegate to cargo-make)
+# =============================================================================
+
+.PHONY: core/check-affected
+core/check-affected: ## Run Clippy, custom lints, and isolated builds for affected Rust packages
+	AFFECTED_BASE="$(AFFECTED_BASE)" cargo make --no-workspace check-affected
+
 # =============================================================================
 # Getting started (build host setup)
 # =============================================================================

Makefile.toml

@@ -828,6 +828,50 @@ workspace = false
 description = "Check that workspace packages build independently with default features"
 script = ["cargo xtask check-isolated-package-builds"]
 
+[tasks.check-affected]
+workspace = false
+description = "Run compilation checks for changed Rust packages and their workspace dependents"
+script = '''
+set -eu
+
+base="${AFFECTED_BASE:-origin/main}"
+affected_packages="$(cargo xtask affected-packages --base "${base}")"
+
+if [ -z "${affected_packages}" ]; then
+  echo "No affected Rust packages were selected" >&2
+  exit 1
+fi
+
+echo "Affected Rust packages:"
+printf '  %s\n' "${affected_packages}"
+
+set --
+while IFS= read -r package; do
+  [ -n "${package}" ] || continue
+  set -- "$@" -p "${package}"
+done <<EOF
+${affected_packages}
+EOF
+
+# These checks use different feature sets and compiler drivers. Keep their Cargo
+# artifacts separate so one check does not invalidate another check's cache.
+target_dir="${CARGO_TARGET_DIR:-${REPO_ROOT}/target}"
+
+echo "Checking isolated builds for affected packages"
+CARGO_TARGET_DIR="${target_dir}/isolated-checks" \
+  cargo xtask check-isolated-package-builds "$@"
+
+echo "Running Clippy for affected packages"
+cargo make --no-workspace install-clippy
+CARGO_TARGET_DIR="${target_dir}/clippy" \
+  cargo clippy --locked --all-targets --all-features "$@"
+
+echo "Running carbide-lints for affected packages"
+cargo make --no-workspace setup-carbide-lints
+CARGO_TARGET_DIR="${target_dir}/carbide-lints" \
+  cargo carbide-lints --all-targets --all-features "$@"
+'''
+
 [tasks.check-licenses]
 workspace = false
 description = "Check cargo-deny against licenses we're using to validate that we're not introducing new licenses inadvertently"