fix: include crates/contracts/* in the workspace (#10550) (#10551)

* fix: include crates/contracts/* in the workspace (#10550)

cargo's `exclude` matches by path prefix and outranks the `members` globs, so
`exclude = ["crates/contracts"]` silently dropped all 18 `crates/contracts/*`
crates out of the workspace -- the `"crates/contracts/*"` members entry never
had any effect. cargo resolved 25 members against 43 crates on disk.

Nothing warned, because every contract crate is a path dependency of a member:
they still compiled, so `cargo build` stayed green while `--workspace` package
selection never saw them. 199 `#[test]` functions across 12 contract crates
were never compiled, let alone run, by `cargo check --workspace --tests`,
`cargo test --workspace`, or clippy.

The exclude was not gratuitous -- a bare `crates/*` glob also matches the
`crates/contracts` grouping directory, which has no manifest, and cargo hard
errors on it. Prefix-qualifying both globs as `homeboy-*` keeps the grouping
directory out of the match set, so the exclude is no longer needed. All 42
crates already carry that prefix.

Cargo.lock is unchanged and `--locked` still resolves.

Expect fallout: this compiles and runs 199 tests for the first time.

* test: fail closed when a crate is missing from workspace members (#10550)

The prefix-qualified members globs fix the contracts drop, but trade one silent
failure mode for another: a crate added under `crates/` without the `homeboy-`
prefix would be just as invisible to every `--workspace` gate as the contract
crates were.

Compare crate directories on disk against what the globs can match, and assert
the `exclude = ["crates/contracts"]` workaround is not reintroduced.

---------

Co-authored-by: chubes-bot <266378653+homeboy-ci[bot]@users.noreply.github.com>

Author: chubes4

Cargo.toml

@@ -3,10 +3,19 @@
 # incremental compilation and lower peak build memory. They are path-only
 # dependencies of the `homeboy` crate. The entire workspace is private; the
 # shipped CLI artifact remains the single `homeboy` binary.
-members = ["crates/*", "crates/contracts/*"]
-# `crates/*` also globs the `crates/contracts` grouping directory, which is not
-# itself a crate; exclude it so only the contract crates under it are members.
-exclude = ["crates/contracts"]
+#
+# Both globs are prefix-qualified (`homeboy-*`) rather than a bare `crates/*`.
+# A bare `crates/*` also matches the `crates/contracts` grouping directory,
+# which is not itself a crate, so cargo fails to load its (nonexistent)
+# manifest. The previous workaround was `exclude = ["crates/contracts"]`, but
+# cargo's `exclude` matches by path PREFIX and outranks the members globs, so it
+# silently dropped all 18 `crates/contracts/*` crates from the workspace too
+# (#10550). Keeping the grouping directory out of the glob in the first place is
+# what makes the membership honest. Every crate under `crates/` and
+# `crates/contracts/` is named `homeboy-*`; `workspace_membership_is_complete`
+# in `crates/homeboy-paths` fails closed if a crate is ever added that these
+# globs would miss.
+members = ["crates/homeboy-*", "crates/contracts/homeboy-*"]
 
 [package]
 name = "homeboy"

crates/homeboy-paths/src/lib.rs

@@ -447,3 +447,88 @@ pub fn authorize_remote_artifact_path(
         Err(RemotePathAuthorizationError::OutsideAllowedRoots)
     }
 }
+
+/// Fails closed when a crate on disk is not enumerated as a workspace member.
+///
+/// The root manifest globs members as `crates/homeboy-*` and
+/// `crates/contracts/homeboy-*` rather than a bare `crates/*`, because a bare
+/// glob also matches the `crates/contracts` grouping directory (not itself a
+/// crate) and cargo then fails to load its manifest. The historical workaround
+/// was `exclude = ["crates/contracts"]`, but cargo's `exclude` matches by path
+/// PREFIX and outranks the members globs -- it silently dropped all 18
+/// `crates/contracts/*` crates out of the workspace. Nothing warned: they still
+/// compiled as path dependencies, so `cargo build` was green while
+/// `--workspace` selection (test, clippy, `check --tests`) never saw them and
+/// their unit tests never ran (#10550).
+///
+/// The prefix globs remove the need for `exclude`, but they trade one silent
+/// failure for another: a crate added under `crates/` without the `homeboy-`
+/// prefix would be just as invisible. This test closes that hole by comparing
+/// the manifests on disk against the members cargo actually resolved.
+#[cfg(test)]
+mod workspace_membership {
+    use std::collections::BTreeSet;
+    use std::path::{Path, PathBuf};
+
+    fn workspace_root() -> PathBuf {
+        // crates/homeboy-paths -> crates -> <root>
+        Path::new(env!("CARGO_MANIFEST_DIR"))
+            .ancestors()
+            .nth(2)
+            .expect("homeboy-paths should live at <root>/crates/homeboy-paths")
+            .to_path_buf()
+    }
+
+    /// Every directory under `dir` that contains a `Cargo.toml`.
+    fn crate_dirs(dir: &Path) -> BTreeSet<String> {
+        let mut found = BTreeSet::new();
+        let Ok(entries) = std::fs::read_dir(dir) else {
+            return found;
+        };
+        for entry in entries.flatten() {
+            let path = entry.path();
+            if path.join("Cargo.toml").is_file() {
+                if let Some(name) = path.file_name().and_then(|n| n.to_str()) {
+                    found.insert(name.to_string());
+                }
+            }
+        }
+        found
+    }
+
+    #[test]
+    fn workspace_membership_is_complete() {
+        let root = workspace_root();
+        let manifest = std::fs::read_to_string(root.join("Cargo.toml")).expect("root manifest");
+
+        // Guard the mechanism itself: `exclude` outranks the members globs, so
+        // reintroducing it silently re-orphans crates.
+        assert!(
+            !manifest.contains("\nexclude = [\"crates/contracts\"]"),
+            "root manifest must not exclude `crates/contracts`: cargo's exclude \
+             matches by path prefix and would drop every crates/contracts/* \
+             member from the workspace (#10550)"
+        );
+
+        for (dir, glob) in [
+            (root.join("crates"), "crates/homeboy-*"),
+            (
+                root.join("crates").join("contracts"),
+                "crates/contracts/homeboy-*",
+            ),
+        ] {
+            for name in crate_dirs(&dir) {
+                assert!(
+                    name.starts_with("homeboy-"),
+                    "crate `{}` in {} is not matched by the `{}` members glob, so it \
+                     is invisible to every `--workspace` gate (test, clippy, \
+                     `check --tests`). Rename it with the `homeboy-` prefix or widen \
+                     the glob in the root Cargo.toml.",
+                    name,
+                    dir.display(),
+                    glob
+                );
+            }
+        }
+    }
+}