ci: rebuild delivery around bounded Cargo Rail work - #101
Merged
Conversation
Plan each revision once and execute only selected feature, target, assurance, and policy work through repository-owned commands. Collapse qualification and release into exact-commit DAGs with isolated cache and publication authority.
actionlint reports its semantic version followed by installation and compiler metadata. Compare the first line so the checksum-verified release passes while preserving exact version enforcement and reporting mismatches clearly.
Advance every stale selected tool to its latest stable release and pin the installer action that carries Zizmor 1.30.0 metadata. Enforce one direct-archive version across supported Linux and macOS hosts while keeping source fallback disabled.
Install the pinned prebuilt Just release beside Zizmor so the hosted Actions policy lane has the same runtime contract as the local entry point without source builds.
Install checksum-verified ripgrep with actionlint from the central direct-archive manifest so the hosted policy lane matches its local runtime contract without package-manager or source-build overhead.
Verify ripgrep's exact name and semantic version while accepting the revision suffix emitted by its official version report.
Poison ambient plan transport in the regression harness and strip it from each executor case so local checks reproduce the same Cargo Rail environment used by hosted policy jobs.
Poison and clear the transported plan identity and head alongside the fake plan paths so the hosted environment is fully reproduced by local policy checks.
Poison GitHub's output file in the regression harness and clear it only for direct matrix capture so local policy checks reproduce hosted execution.
Strip carriage returns while reading and comparing target projections so Git Bash validates the same catalog as Unix hosts.
Keep the exact aarch64-pc-windows-msvc host check while ignoring the architecture reported by the emulated x86-64 Git Bash process in the compile-only Arm64 lane.
Add plan-selected MSRV, Cargo graph, and minimum-feature example gates to CI and Qualification. Report bounded Cargo Rail cache effectiveness from every cache-enabled lane. Harden fuzz target discovery against SIGPIPE and give valid RSA seeds a realistic per-input watchdog.
Run each runtime profile independently and use Nextest for the three full-suite baselines while retaining two compile shards. Align CI and Qualification display names with the proof each job provides.
Cargo Rail Action v8.2.0 loses its installer outputs on hosted Windows ARM. Preserve compile coverage by disabling cache acceleration for that row until upstream output transport is proven.
Keep Miri and coverage at opt-level 0 so optimization cannot narrow their evidence.
Gate Linux AEAD helpers and FFI declarations to their owning features, then require an independent compile contract for every Cargo feature.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validation
Hosted follow-up
This PR intentionally starts the hosted validation phase. Exercise representative PR, main, Qualification, cache, donated-runner, and release rehearsals before declaring the measured migration complete. The one-command release requires the next Cargo Rail release and the narrow release-maintainer main bypass before it is used for a real crate release.