build: adopt cargo-anvil check catalog (github backend)

.cargo/audit.toml

@@ -0,0 +1,13 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+# cargo-audit (anvil-audit) reads this file; it does NOT consult deny.toml, so
+# advisory ignores must be mirrored here as well as in deny.toml's ignore list.
+[advisories]
+ignore = [
+    # quick-xml 0.39.4 DoS advisories fixed only in >=0.41.0, pulled transitively
+    # via the Azure SDK (typespec <- azure_core 1.0.0) which pins 0.39.x. Cannot be
+    # upgraded until an upstream Azure SDK release. See deny.toml for the full rationale.
+    "RUSTSEC-2026-0194", # quadratic-time duplicate-attribute check
+    "RUSTSEC-2026-0195", # unbounded namespace-declaration allocation
+]

.delta.toml

@@ -82,3 +82,14 @@ assume_patterns = [
 # The remote branch to compare against for determining changed files
 # If not specified, uses the default branch detection
 remote_branch = "origin/main"
+
+# >>> anvil-managed: anvil-delta
+[delta]
+# Include the workspace root files that should invalidate every member's
+# impact analysis when changed (lockfile, root manifest, toolchain).
+root-files = [
+    "Cargo.lock",
+    "Cargo.toml",
+    "rust-toolchain.toml",
+]
+# <<< anvil-managed: anvil-delta

.gitattributes

@@ -25,3 +25,9 @@
 *.ppt filter=lfs diff=lfs merge=lfs -text
 *.pptx filter=lfs diff=lfs merge=lfs -text
 *.pdf filter=lfs diff=lfs merge=lfs -text
+
+# >>> anvil-managed: anvil-gitattributes
+# Force LF line endings for Rust sources regardless of the checkout
+# platform, so rustfmt and other tooling see consistent newlines.
+*.rs text eol=lf
+# <<< anvil-managed: anvil-gitattributes

.github/actions/anvil-impact/action.yml

@@ -0,0 +1,118 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+# Owned by cargo-anvil; edit via `cargo anvil`.
+name: anvil-impact
+description: |
+  Compute the cargo-delta impact set for this PR and emit per-tier
+  include lists.
+
+  Outputs:
+    include_modified - "--package X@ver --package Y@ver" string for crates
+                       whose source files changed in the diff, or "--skip"
+                       if the modified set is empty. Each package is a
+                       version-qualified cargo spec (name@version) so it
+                       resolves unambiguously even when a like-named crate
+                       is also a different-versioned transitive dependency.
+    include_affected - same shape, for crates in the affected set
+                       (modified ∪ rev-deps).
+    include_required - same shape, for crates in the required set
+                       (affected ∪ workspace-internal transitive deps).
+
+  Recipes in checks.just interpret each variable per their tier:
+  modified-tier recipes (fmt, license-headers, spellcheck, ...) short-
+  circuit on "--skip"; affected-tier recipes (clippy, tests, ...) and
+  required-tier recipes (doc, cargo-hack, udeps) splice their include
+  list into the cargo invocation, defaulting to --workspace when unset
+  (local runs without impact wiring).
+
+  Unscoped recipes (deny, audit, aprz, pr-title) ignore all three
+  variables and always run unconditionally.
+outputs:
+  include_modified:
+    description: Pre-formatted --package args for the modified tier.
+    value: ${{ steps.compute.outputs.include_modified }}
+  include_affected:
+    description: Pre-formatted --package args for the affected tier.
+    value: ${{ steps.compute.outputs.include_affected }}
+  include_required:
+    description: Pre-formatted --package args for the required tier.
+    value: ${{ steps.compute.outputs.include_required }}
+runs:
+  using: composite
+  steps:
+    # anvil-setup with group=none bootstraps the rust toolchain +
+    # just + binstall + cache, but skips the full catalog install.
+    # We follow it with just the cargo-delta install (the only tool
+    # this composite needs). This keeps the impact stage lean -- it's
+    # the critical-path gating dep for every PR-tier group job.
+    - uses: ./.github/actions/anvil-setup
+      with:
+        group: none
+    - name: Install cargo-delta
+      shell: bash
+      run: just anvil-tool-cargo-delta-install binstall
+    - id: compute
+      name: Compute impact
+      shell: bash
+      run: |
+        set -euo pipefail
+        # Resolve the baseline ref via the shared anvil resolver (single
+        # source of truth; see the _anvil-base-ref recipe). On GitHub PRs it
+        # resolves GITHUB_BASE_REF to origin/<branch>; BASE_REF overrides.
+        base="$(just _anvil-base-ref)"
+        # The baseline worktree is checked out at the merge target, whose
+        # rust-toolchain.toml may pin a toolchain that is NOT installed on the
+        # runner (any PR that bumps rust-toolchain.toml hits this). The
+        # snapshot is metadata-only (file presence + content hashes), so run
+        # the baseline under the runner's *active* toolchain via
+        # RUSTUP_TOOLCHAIN, which overrides the worktree's rust-toolchain.toml.
+        # Capture it here, in the PR checkout, where it is resolved + installed.
+        active_toolchain="$(rustup show active-toolchain | head -n1 | cut -d' ' -f1)"
+        # cargo delta has no --base flag; the flow is two snapshots
+        # (baseline at the merge target + current at HEAD) compared by
+        # `cargo delta impact`. We use a temporary worktree to snapshot
+        # the baseline without disturbing the checked-out tree.
+        cargo delta snapshot > "$RUNNER_TEMP/anvil-current.json"
+        git worktree add --detach "$RUNNER_TEMP/anvil-baseline" "$base"
+        # When anvil is first introduced (this PR adds the cargo workspace),
+        # the baseline branch has no root Cargo.toml, so there is no
+        # workspace for cargo-delta to snapshot. Detect that explicitly and
+        # fall back to full-workspace validation (empty include_* -> recipes
+        # default to --workspace) rather than running cargo-delta. This is a
+        # targeted check: any *other* cargo-delta failure below is a real
+        # error and is allowed to fail the impact job (and the gated pr-* jobs).
+        if [ ! -f "$RUNNER_TEMP/anvil-baseline/Cargo.toml" ] ; then
+            echo "anvil impact: baseline '$base' has no root Cargo.toml (not a cargo workspace yet -- first-time anvil adoption?). Falling back to full-workspace validation." >&2
+            git worktree remove --force "$RUNNER_TEMP/anvil-baseline"
+            {
+                echo "include_modified="
+                echo "include_affected="
+                echo "include_required="
+            } >> "$GITHUB_OUTPUT"
+            exit 0
+        fi
+        ( cd "$RUNNER_TEMP/anvil-baseline" \
+            && RUSTUP_TOOLCHAIN="$active_toolchain" cargo delta snapshot ) \
+            > "$RUNNER_TEMP/anvil-baseline.json"
+        git worktree remove --force "$RUNNER_TEMP/anvil-baseline"
+        cargo delta impact \
+            --baseline "$RUNNER_TEMP/anvil-baseline.json" \
+            --current  "$RUNNER_TEMP/anvil-current.json" \
+            --format json \
+            > "$RUNNER_TEMP/anvil-impact.json"
+        # Format each tier into the `--package name@version ...` shape the
+        # checks.just recipes consume (or the "--skip" sentinel when a
+        # tier is empty), via the shared _anvil-impact-format recipe --
+        # single source of truth across the GitHub and ADO impact steps.
+        # See that recipe in checks.just for the version-qualification and
+        # lib-name translation rationale. Capture each formatted value into
+        # a variable first, then write plain `name=value` lines, so the
+        # quoted JSON-path argument never sits inside the output `echo`.
+        modified="$(just _anvil-impact-format modified "$RUNNER_TEMP/anvil-impact.json")"
+        affected="$(just _anvil-impact-format affected "$RUNNER_TEMP/anvil-impact.json")"
+        required="$(just _anvil-impact-format required "$RUNNER_TEMP/anvil-impact.json")"
+        {
+          echo "include_modified=$modified"
+          echo "include_affected=$affected"
+          echo "include_required=$required"
+        } >> "$GITHUB_OUTPUT"

.github/actions/anvil-pr-fast/action.yml

@@ -0,0 +1,48 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+# Owned by cargo-anvil; edit via `cargo anvil`.
+# The token pr-fast is substituted by cargo-anvil at emit time with
+# the concrete check-group name (pr-fast, pr-test, scheduled-runtime-analysis, ...).
+name: anvil-pr-fast
+description: Run the pr-fast check group.
+inputs:
+  include_modified:
+    description: |
+      Pre-formatted --package args (e.g. "--package alpha@1.0.0 --package
+      beta@0.2.0") for the modified tier, or the sentinel "--skip" when
+      nothing modified. Packages are version-qualified cargo specs so they
+      resolve uniquely even when a like-named crate is also a transitive
+      dependency. Local invocations leave it unset; recipes default to
+      --workspace.
+    default: ""
+    required: false
+  include_affected:
+    description: |
+      Same shape as include_modified, but for the affected tier
+      (modified ∪ rev-deps).
+    default: ""
+    required: false
+  include_required:
+    description: |
+      Same shape as include_modified, but for the required tier
+      (affected ∪ workspace-internal transitive deps).
+    default: ""
+    required: false
+runs:
+  using: composite
+  steps:
+    - uses: ./.github/actions/anvil-setup
+      with:
+        group: pr-fast
+    - name: Run just anvil-pr-fast
+      shell: bash
+      env:
+        ANVIL_INCLUDE_MODIFIED: ${{ inputs.include_modified }}
+        ANVIL_INCLUDE_AFFECTED: ${{ inputs.include_affected }}
+        ANVIL_INCLUDE_REQUIRED: ${{ inputs.include_required }}
+        # Some checks (e.g. cargo-aprz, run only by groups that include it)
+        # hit the GitHub API; pass the built-in token so they use the
+        # authenticated quota (1000 vs 60 req/hr). Harmless for groups whose
+        # checks never read it.
+        GITHUB_TOKEN: ${{ github.token }}
+      run: just anvil-pr-fast

.github/actions/anvil-pr-mutants/action.yml

@@ -0,0 +1,48 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+# Owned by cargo-anvil; edit via `cargo anvil`.
+# The token pr-mutants is substituted by cargo-anvil at emit time with
+# the concrete check-group name (pr-fast, pr-test, scheduled-runtime-analysis, ...).
+name: anvil-pr-mutants
+description: Run the pr-mutants check group.
+inputs:
+  include_modified:
+    description: |
+      Pre-formatted --package args (e.g. "--package alpha@1.0.0 --package
+      beta@0.2.0") for the modified tier, or the sentinel "--skip" when
+      nothing modified. Packages are version-qualified cargo specs so they
+      resolve uniquely even when a like-named crate is also a transitive
+      dependency. Local invocations leave it unset; recipes default to
+      --workspace.
+    default: ""
+    required: false
+  include_affected:
+    description: |
+      Same shape as include_modified, but for the affected tier
+      (modified ∪ rev-deps).
+    default: ""
+    required: false
+  include_required:
+    description: |
+      Same shape as include_modified, but for the required tier
+      (affected ∪ workspace-internal transitive deps).
+    default: ""
+    required: false
+runs:
+  using: composite
+  steps:
+    - uses: ./.github/actions/anvil-setup
+      with:
+        group: pr-mutants
+    - name: Run just anvil-pr-mutants
+      shell: bash
+      env:
+        ANVIL_INCLUDE_MODIFIED: ${{ inputs.include_modified }}
+        ANVIL_INCLUDE_AFFECTED: ${{ inputs.include_affected }}
+        ANVIL_INCLUDE_REQUIRED: ${{ inputs.include_required }}
+        # Some checks (e.g. cargo-aprz, run only by groups that include it)
+        # hit the GitHub API; pass the built-in token so they use the
+        # authenticated quota (1000 vs 60 req/hr). Harmless for groups whose
+        # checks never read it.
+        GITHUB_TOKEN: ${{ github.token }}
+      run: just anvil-pr-mutants

.github/actions/anvil-pr-runtime-analysis/action.yml

@@ -0,0 +1,48 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+# Owned by cargo-anvil; edit via `cargo anvil`.
+# The token pr-runtime-analysis is substituted by cargo-anvil at emit time with
+# the concrete check-group name (pr-fast, pr-test, scheduled-runtime-analysis, ...).
+name: anvil-pr-runtime-analysis
+description: Run the pr-runtime-analysis check group.
+inputs:
+  include_modified:
+    description: |
+      Pre-formatted --package args (e.g. "--package alpha@1.0.0 --package
+      beta@0.2.0") for the modified tier, or the sentinel "--skip" when
+      nothing modified. Packages are version-qualified cargo specs so they
+      resolve uniquely even when a like-named crate is also a transitive
+      dependency. Local invocations leave it unset; recipes default to
+      --workspace.
+    default: ""
+    required: false
+  include_affected:
+    description: |
+      Same shape as include_modified, but for the affected tier
+      (modified ∪ rev-deps).
+    default: ""
+    required: false
+  include_required:
+    description: |
+      Same shape as include_modified, but for the required tier
+      (affected ∪ workspace-internal transitive deps).
+    default: ""
+    required: false
+runs:
+  using: composite
+  steps:
+    - uses: ./.github/actions/anvil-setup
+      with:
+        group: pr-runtime-analysis
+    - name: Run just anvil-pr-runtime-analysis
+      shell: bash
+      env:
+        ANVIL_INCLUDE_MODIFIED: ${{ inputs.include_modified }}
+        ANVIL_INCLUDE_AFFECTED: ${{ inputs.include_affected }}
+        ANVIL_INCLUDE_REQUIRED: ${{ inputs.include_required }}
+        # Some checks (e.g. cargo-aprz, run only by groups that include it)
+        # hit the GitHub API; pass the built-in token so they use the
+        # authenticated quota (1000 vs 60 req/hr). Harmless for groups whose
+        # checks never read it.
+        GITHUB_TOKEN: ${{ github.token }}
+      run: just anvil-pr-runtime-analysis

.github/actions/anvil-pr-test/action.yml

@@ -0,0 +1,48 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+# Owned by cargo-anvil; edit via `cargo anvil`.
+# The token pr-test is substituted by cargo-anvil at emit time with
+# the concrete check-group name (pr-fast, pr-test, scheduled-runtime-analysis, ...).
+name: anvil-pr-test
+description: Run the pr-test check group.
+inputs:
+  include_modified:
+    description: |
+      Pre-formatted --package args (e.g. "--package alpha@1.0.0 --package
+      beta@0.2.0") for the modified tier, or the sentinel "--skip" when
+      nothing modified. Packages are version-qualified cargo specs so they
+      resolve uniquely even when a like-named crate is also a transitive
+      dependency. Local invocations leave it unset; recipes default to
+      --workspace.
+    default: ""
+    required: false
+  include_affected:
+    description: |
+      Same shape as include_modified, but for the affected tier
+      (modified ∪ rev-deps).
+    default: ""
+    required: false
+  include_required:
+    description: |
+      Same shape as include_modified, but for the required tier
+      (affected ∪ workspace-internal transitive deps).
+    default: ""
+    required: false
+runs:
+  using: composite
+  steps:
+    - uses: ./.github/actions/anvil-setup
+      with:
+        group: pr-test
+    - name: Run just anvil-pr-test
+      shell: bash
+      env:
+        ANVIL_INCLUDE_MODIFIED: ${{ inputs.include_modified }}
+        ANVIL_INCLUDE_AFFECTED: ${{ inputs.include_affected }}
+        ANVIL_INCLUDE_REQUIRED: ${{ inputs.include_required }}
+        # Some checks (e.g. cargo-aprz, run only by groups that include it)
+        # hit the GitHub API; pass the built-in token so they use the
+        # authenticated quota (1000 vs 60 req/hr). Harmless for groups whose
+        # checks never read it.
+        GITHUB_TOKEN: ${{ github.token }}
+      run: just anvil-pr-test