ci: en setup-action, en lista över cargo-grindar, strukturella CI-tester (#358)

.github/actions/setup/action.yml

@@ -0,0 +1,103 @@
+name: Set up the CI toolchain
+description: >-
+  The preamble of every ci.yml lane (#358): Python, the Rust toolchain, Node.js, the Rust
+  dependency cache, the downloaded-model cache of the native build lanes and `npm ci`. The job
+  checks out the repository first, so this action always comes from the revision under test.
+  The toolchain and Node versions are pinned here once; scripts/test-rust-toolchain-pin.mjs
+  holds them to rust-toolchain.toml and .nvmrc.
+
+inputs:
+  python:
+    description: Install Python 3.12 (the dictation and diarization tests, the JSON stream verifier).
+    default: "true"
+  rust:
+    description: >-
+      "true" installs the pinned Rust toolchain. "msrv" installs the one `rust-version` declares
+      (minimal profile) and exports RUSTUP_TOOLCHAIN for every later step (#353). "false" installs none.
+    default: "true"
+  rust-components:
+    description: Extra toolchain components, comma separated (clippy, rustfmt).
+    default: ""
+  cache-key:
+    description: >-
+      Swatinem/rust-cache shared-key. Lanes that compile alike share one; rust-cache keeps OS and target
+      entries apart. Unless `native-build` is set, the hash of scripts/ci/cargo-gates.mjs is appended: the
+      cache holds what the gates compile, and rust-cache saves only when its key is new, so a changed gate
+      list needs a new key to get its artifacts cached.
+    required: true
+  cache-workspaces:
+    description: Cargo workspaces to cache, one per line. The standalone ORT engine host is its own workspace (#357).
+    default: src-tauri
+  native-build:
+    description: >-
+      The lane builds the native release binary and runs the CLI smoke tests (the macOS and Windows build
+      lanes): it caches the models they download, and its Rust cache key leaves out the gate list, which
+      such a lane never runs, so a gate change does not evict its cache.
+    default: "false"
+  linux-deps:
+    description: Install the Tauri system libraries and xdotool with apt (Linux lanes that compile the app crate).
+    default: "false"
+  npm-ci:
+    description: Run `npm ci`. test-windows turns it off to run its build identity gates first, then installs.
+    default: "true"
+
+runs:
+  using: composite
+  steps:
+    - if: ${{ inputs.linux-deps == 'true' }}
+      name: Install Tauri system dependencies
+      shell: bash
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev libasound2-dev build-essential file xdotool
+
+    - if: ${{ inputs.python == 'true' }}
+      name: Select evaluation Python runtime
+      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+      with:
+        python-version: "3.12"
+
+    - if: ${{ inputs.rust == 'true' }}
+      name: Install Rust
+      uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # v1; toolchain must match rust-toolchain.toml
+      with:
+        toolchain: 1.99.0
+        components: ${{ inputs.rust-components }}
+
+    - if: ${{ inputs.rust == 'msrv' }}
+      name: Install the declared MSRV toolchain
+      shell: bash
+      run: |
+        msrv=$(sed -n 's/^rust-version = "\(.*\)"$/\1/p' src-tauri/Cargo.toml)
+        ort_msrv=$(sed -n 's/^rust-version = "\(.*\)"$/\1/p' src-tauri/engine-host/ort/Cargo.toml)
+        test -n "$msrv"
+        test "$msrv" = "$ort_msrv"
+        rustup toolchain install "$msrv" --profile minimal
+        echo "RUSTUP_TOOLCHAIN=$msrv" >> "$GITHUB_ENV"
+        echo "Checking against Rust $msrv"
+
+    - name: Install Node.js
+      uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+      with:
+        node-version: 22
+        cache: npm
+
+    - name: Cache Rust dependencies
+      uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      with:
+        workspaces: ${{ inputs.cache-workspaces }}
+        shared-key: ${{ inputs.cache-key }}${{ inputs.native-build != 'true' && format('-{0}', hashFiles('scripts/ci/cargo-gates.mjs')) || '' }}
+
+    - if: ${{ inputs.native-build == 'true' }}
+      name: Cache downloaded models
+      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+      with:
+        path: ${{ runner.os == 'Windows' && '~\AppData\Roaming\Sagascript\Models' || '~/Library/Application Support/Sagascript/Models' }}
+        key: ${{ runner.os == 'Windows' && 'windows' || 'macos' }}-models-${{ hashFiles('src-tauri/crates/sagascript-core/src/settings/manager.rs', 'src-tauri/crates/sagascript-core/src/transcription/model.rs', 'src-tauri/crates/sagascript-core/src/diarization/model.rs') }}
+        restore-keys: |
+          ${{ runner.os == 'Windows' && 'windows' || 'macos' }}-models-
+
+    - if: ${{ inputs.npm-ci == 'true' }}
+      name: Install npm dependencies
+      shell: bash
+      run: npm ci

.github/dependabot.yml

@@ -33,8 +33,11 @@ updates:
         patterns: ["*"]
         update-types: ["minor", "patch"]
 
+  # The local composite actions hold SHA pins too (#358): list each one, or its pins go stale.
   - package-ecosystem: github-actions
-    directory: "/"
+    directories:
+      - "/"
+      - "/.github/actions/setup"
     schedule:
       interval: monthly
     open-pull-requests-limit: 5