arch-audit v0.6.x — checkpoint: Batches A→E landed (61 commits)

.config/nextest.toml

@@ -0,0 +1,12 @@
+# cargo-nextest configuration
+# https://nexte.st/docs/configuration/
+
+[profile.default]
+# Flag a test as "slow" after 40s and terminate after two slow periods
+# (80s total per test). Rationale: the slowest clean test in any crate
+# is ~14s (fts proptest in perima-db). Past 40s is a sign of lock
+# contention or deadlock, not legitimate compute. nextest 0.9.133 lacks
+# a CLI `--slow-timeout` flag, but honors this config key — keeps
+# `timeout NNN cargo nextest ...` wrappers from killing the whole suite
+# on a single hang.
+slow-timeout = { period = "40s", terminate-after = 2 }

.github/workflows/ci.yml

@@ -29,12 +29,17 @@ jobs:
 
       - uses: taiki-e/install-action@just
 
-      # WHY: `just ci` runs `cargo deny check` and `typos`. Both are
-      # external binaries — neither ships with the Rust toolchain. Using
-      # taiki-e/install-action fetches prebuilt binaries (seconds) rather
-      # than `cargo install` (minutes), which matters on the 3-OS matrix.
+      # WHY: `just ci` runs `cargo deny check`, `typos`, and
+      # `cargo nextest run`. All three are external binaries — none ship
+      # with the Rust toolchain. Using taiki-e/install-action fetches
+      # prebuilt binaries (seconds) rather than `cargo install` (minutes),
+      # which matters on the 3-OS matrix. Nextest swap landed in commit
+      # adopting `cargo nextest run` workspace-wide (closes #121) — the
+      # SQLite lock-order inversion that `cargo test` reproduces ~20% is
+      # documented in CLAUDE.md + GH #131.
       - uses: taiki-e/install-action@cargo-deny
       - uses: taiki-e/install-action@typos
+      - uses: taiki-e/install-action@cargo-nextest
 
       - uses: actions/setup-node@v4
         with:
@@ -61,3 +66,36 @@ jobs:
       - name: Run just ci
         shell: bash
         run: just ci
+
+  bindings-drift:
+    name: bindings.ts drift check
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: Swatinem/rust-cache@v2
+
+      - uses: taiki-e/install-action@just
+
+      # WHY: same Tauri Linux deps as the matrix job's Linux branch —
+      # tauri-build links against GTK3 + WebKit2GTK on Linux.
+      - name: Install Tauri Linux deps
+        run: |
+          sudo apt-get update -q
+          sudo apt-get install -yq \
+            libgtk-3-dev \
+            libwebkit2gtk-4.1-dev \
+            libappindicator3-dev \
+            librsvg2-dev \
+            patchelf
+
+      # WHY: regenerate bindings.ts via the specta-export feature and
+      # fail the job if `git diff` shows the committed copy is stale.
+      # Catches every Rust-side change to a #[tauri::command] signature,
+      # a specta-derived type, or a CoreError variant that wasn't paired
+      # with a bindings.ts commit.
+      - name: Bindings drift check
+        run: just bindings