feat(hash): three-tier identity + Tier-0 cache + on-demand canonical hash (closes #151 #155, advances #157) #107
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| build: | |
| name: just ci (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: clippy, rustfmt | |
| - uses: Swatinem/rust-cache@v2 | |
| # WHY: `just ci` runs `cargo deny check`, `typos`, and | |
| # `cargo nextest run`. All three are external binaries — none ship | |
| # with the Rust toolchain. Using taiki-e/install-action fetches | |
| # prebuilt binaries (seconds) rather than `cargo install` (minutes), | |
| # which matters on the 3-OS matrix. Nextest swap landed in commit | |
| # adopting `cargo nextest run` workspace-wide (closes #121). | |
| # | |
| # WHY split Windows from Linux/macOS: taiki-e/install-action's | |
| # PowerShell wrapper aborts on windows-latest when the runner image | |
| # leaks BASH_FUNC_* env vars (Shellshock mitigation correctly | |
| # rejects them; their 10-iter retry doesn't catch it; manual reruns | |
| # don't help — see issue #137 for full analysis + reproduction). | |
| # cargo-binstall fetches the same prebuilt release binaries without | |
| # going through bash, sidestepping the env leak entirely. | |
| - name: Install just (Linux/macOS) | |
| if: runner.os != 'Windows' | |
| uses: taiki-e/install-action@just | |
| - name: Install cargo-deny (Linux/macOS) | |
| if: runner.os != 'Windows' | |
| uses: taiki-e/install-action@cargo-deny | |
| - name: Install typos (Linux/macOS) | |
| if: runner.os != 'Windows' | |
| uses: taiki-e/install-action@typos | |
| - name: Install cargo-nextest (Linux/macOS) | |
| if: runner.os != 'Windows' | |
| uses: taiki-e/install-action@cargo-nextest | |
| # WHY cargo-binstall on Windows only — workaround for #137. binstall | |
| # is a prebuilt-binary fetcher; doesn't invoke bash so the windows- | |
| # latest BASH_FUNC_* leak doesn't apply. Self-install is one zip | |
| # extract; per-tool install is ~5s. If the runner image fix lands | |
| # upstream, revert this step + drop the `if: runner.os != 'Windows'` | |
| # gates above and verify 5+ consecutive Windows runs stay green. | |
| - name: Install just/cargo-deny/typos/cargo-nextest (Windows via cargo-binstall — workaround #137) | |
| if: runner.os == 'Windows' | |
| shell: pwsh | |
| run: | | |
| Invoke-WebRequest -Uri "https://github.com/cargo-bins/cargo-binstall/releases/latest/download/cargo-binstall-x86_64-pc-windows-msvc.zip" -OutFile binstall.zip | |
| Expand-Archive binstall.zip -DestinationPath "$env:USERPROFILE\.cargo\bin" -Force | |
| # WHY --force (added 2026-04-25): without it, when Swatinem | |
| # rust-cache partial-restores `~/.cargo/bin` containing a | |
| # previously-installed just.exe (or its binstall manifest), | |
| # cargo-binstall logs "already installed" and SKIPS the install | |
| # — INCLUDING the bash-PATH side effect that fresh installs | |
| # perform. Subsequent bash steps then fail with | |
| # `just: command not found` even though the binary is on disk. | |
| # --force re-runs the install path unconditionally. Cost: | |
| # ~5s extra per Windows job. Reproduced ci.yml run 24929261378 | |
| # + 24929533151 (commits 0889fbb, 846c596). | |
| cargo binstall --no-confirm --locked --force just cargo-deny typos-cli cargo-nextest | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: '22.12' | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: latest | |
| # WHY: Tauri v2 (crates/desktop) requires GTK3 + WebKit2GTK on | |
| # Linux. Without these, cargo build/clippy/test on the workspace | |
| # fails because tauri-build links against native libs. | |
| - name: Install Tauri Linux deps | |
| if: runner.os == 'Linux' | |
| run: | | |
| sudo apt-get update -q | |
| sudo apt-get install -yq \ | |
| libgtk-3-dev \ | |
| libwebkit2gtk-4.1-dev \ | |
| libappindicator3-dev \ | |
| librsvg2-dev \ | |
| patchelf | |
| - name: Run just ci | |
| shell: bash | |
| run: just ci | |
| bindings-drift: | |
| name: bindings.ts drift check | |
| runs-on: ubuntu-latest | |
| needs: build | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| - uses: taiki-e/install-action@just | |
| # WHY: same Tauri Linux deps as the matrix job's Linux branch — | |
| # tauri-build links against GTK3 + WebKit2GTK on Linux. | |
| - name: Install Tauri Linux deps | |
| run: | | |
| sudo apt-get update -q | |
| sudo apt-get install -yq \ | |
| libgtk-3-dev \ | |
| libwebkit2gtk-4.1-dev \ | |
| libappindicator3-dev \ | |
| librsvg2-dev \ | |
| patchelf | |
| # WHY: regenerate bindings.ts via the specta-export feature and | |
| # fail the job if `git diff` shows the committed copy is stale. | |
| # Catches every Rust-side change to a #[tauri::command] signature, | |
| # a specta-derived type, or a CoreError variant that wasn't paired | |
| # with a bindings.ts commit. | |
| - name: Bindings drift check | |
| run: just bindings |