ci: migrate to the shared fleet workflow - #30
Merged
Conversation
Replaces seven hand-rolled jobs with the shared workflow and publishes `ci / All checks`. `public-api.yml`, `docs.yml`, `fuzz.yml`, `feed-watch.yml`, `release-plz.yml` and `release.yml` are untouched. The `snapshot` job moves to its own `snapshot.yml` rather than becoming a sibling of the `uses:` call. It is an ARTIFACT PRODUCER -- it runs an example and uploads the result -- so it asserts nothing and belongs outside the gate. Putting it in its own file says that, where leaving it beside `ci:` would invite a reader to mistake it for part of the gate. Migration ADDS coverage, secret-scan, rustdoc, fuzz-build, path-deps, unsafe-audit and package-check. Three of them found real problems. PACKAGE COMPLETENESS -- the worst of the three, and not a CI problem at all. Three PUBLISHED crates were reaching crates.io without a LICENSE file, and two without a README: forensicnomicon-core no README, no LICENSE forensicnomicon-data no README, no LICENSE forensicnomicon-cli no LICENSE `cargo package --list` is the only thing that shows what a consumer actually receives, and nothing had ever looked. Each now carries the Apache-2.0 LICENSE, and core and data have READMEs describing what they are rather than a blank crates.io page. MSRV -- the same false-declaration pattern the fleet keeps producing. The job this replaces ran `cargo test` at 1.75 against the ROOT package only, so the two binary crates were never checked. Both declared 1.75 while depending on hashbrown 0.17, which requires edition2024 and therefore cargo 1.85+. Note the error arrives disguised as `failed to download hashbrown v0.17.0`, which reads like a network problem and is not. Both are BINARY-ONLY -- no lib target, so nothing can pin either as a library dependency and neither has an MSRV promise to keep. Per fleet policy an app declares the pinned toolchain, so both now declare 1.96.0. The three published libraries keep 1.75, verified individually. RUSTDOC -- 25 errors, none of which had ever failed a build because nothing ran rustdoc with `-D warnings`. 158 bare URLs needed markdown autolinks; the rest were brackets that were never links: `[but]` inside a quotation, `[7]` as array notation, `[LOLDrivers]` as a dataset name, and enum variants referenced from a binary crate whose private items rustdoc does not document. COVERAGE is a FLOOR at 96, from a measured LINE figure of 96.59% read via `cargo llvm-cov --json` rather than the summary table, whose first percentage column is regions. Pre-flighted locally, reading each command's own exit code: fmt, clippy -D warnings, tests, rustdoc, deny, vet, unsafe-audit and package-check all clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces seven hand-rolled jobs with the shared workflow and publishes
ci / All checks.public-api.yml,docs.yml,fuzz.yml,feed-watch.yml,release-plz.ymlandrelease.ymluntouched.The
snapshotjob moves to its ownsnapshot.ymlrather than becoming a sibling of theuses:call. It is an artifact producer — runs an example, uploads the result — so it asserts nothing and belongs outside the gate. Its own file says that; leaving it besideci:would invite a reader to mistake it for part of the gate.Migration adds coverage, secret-scan, rustdoc, fuzz-build, path-deps, unsafe-audit and package-check. Three found real problems.
Package completeness — not a CI problem at all
Three published crates were reaching crates.io without a LICENSE, two without a README:
forensicnomicon-coreforensicnomicon-dataforensicnomicon-clicargo package --listis the only thing that shows what a consumer actually receives, and nothing had ever looked. Each now carries the Apache-2.0 LICENSE; core and data have READMEs describing what they are instead of a blank crates.io page.MSRV — a false declaration, disguised
The job this replaces ran
cargo testat 1.75 against the root package only, so the two binary crates were never checked. Both declared 1.75 while depending onhashbrown 0.17, which requiresedition2024and therefore cargo 1.85+.Note the error arrives disguised as
failed to download hashbrown v0.17.0— it reads like a network problem and is not.Both are binary-only (no lib target), so nothing can pin either as a library dependency and neither has an MSRV promise to keep. Per fleet policy an app declares the pinned toolchain: both now declare 1.96.0. The three published libraries keep 1.75, verified individually.
rustdoc — 25 errors nobody had seen
Nothing ran rustdoc with
-D warningsbefore. 158 bare URLs needed markdown autolinks; the rest were brackets that were never links —[but]inside a quotation,[7]as array notation,[LOLDrivers]as a dataset name, and enum variants referenced from a binary crate whose private items rustdoc does not document.Coverage
Floor at 96, from a measured line figure of 96.59% read via
cargo llvm-cov --jsonrather than the summary table, whose first percentage column is regions.Pre-flight
Reading each command's own exit code: fmt · clippy
-D warnings· tests · rustdoc · deny · vet · unsafe-audit · package-check — all clean.