Skip to content

ci: migrate to the shared fleet workflow - #9

Merged
h4x0r merged 1 commit into
mainfrom
ci/migrate-to-fleet-workflow
Aug 20, 2026
Merged

ci: migrate to the shared fleet workflow#9
h4x0r merged 1 commit into
mainfrom
ci/migrate-to-fleet-workflow

Conversation

@h4x0r

@h4x0r h4x0r commented Aug 20, 2026

Copy link
Copy Markdown
Contributor

Replaces eleven hand-rolled jobs with the shared workflow and publishes ci / All checks. docs.yml and release-plz.yml untouched.

Nothing is left beside the gate. Every job this repo ran is now a job inside the reusable workflow — which matters, because a sibling of the uses: call publishes its own context that branch protection does not require: it reddens a PR and blocks nothing.

was now
fmt, clippy, test, msrv, deny, vet, secrets, docs shared equivalents
coverage coverage-gate: strict + coverage-metric: both
package package-check — now a gated job in the shared workflow
fuzz-check fuzz-build
geiger deleted — see below

Coverage: the strongest posture in the fleet

Strict on lines AND functions, where 47 consumers gate on lines alone. That is this crate's actual invariant — every monomorphized instance exercised, not merely every line touched by some instantiation. Line coverage cannot see a generic reader instantiated for a type nobody calls: llvm-cov emits one FN record per instantiation but one DA record per source line.

Measured at 100% on both, and verified by running the shared gate's own script against this repo's lcov rather than assuming it.

The coverage-metric input exists because of this crate. Before it, migrating here meant silently dropping the function half of the gate.

geiger is not carried over

It was cargo geiger 2>&1 || true under continue-on-error: true — unable to fail twice over. The real control is the shared Unsafe lint audit, which asserts every member effectively forbids or denies unsafe_code — the part the compiler cannot tell you — and it is inside the gate.

The gitleaks install goes too: it queried releases/latest, which rate-limits on shared runners and leaves the version empty. The shared job pins 8.30.1.

Pre-flight

Reading each command's own exit code rather than a pipeline's: fmt · clippy -D warnings · tests · deny · vet · cargo +1.75 test all clean, and the packaging check confirms README.md and LICENSE both reach the published crate.

Replaces eleven hand-rolled jobs with the shared workflow and publishes
`ci / All checks`, so branch protection has one stable context to require.
`docs.yml` and `release-plz.yml` are untouched.

Nothing is left beside the gate. Every job this repo ran is now a job INSIDE
the reusable workflow, which matters because a sibling of the `uses:` call
publishes its own context that branch protection does not require -- it reddens
a PR and blocks nothing.

  fmt clippy test msrv deny vet secrets docs   -> shared equivalents
  coverage                                     -> coverage-gate: strict,
                                                  coverage-metric: both
  package                                      -> package-check, now a gated
                                                  job in the shared workflow
  fuzz-check                                   -> fuzz-build
  geiger                                       -> DELETED, see below

COVERAGE is the strongest posture in the fleet: STRICT on lines AND functions,
where 47 consumers gate on lines alone. That is this crate's actual invariant --
every monomorphized instance exercised, not merely every line touched by some
instantiation. Line coverage cannot see a generic reader instantiated for a type
nobody calls, because llvm-cov emits one FN record per instantiation but one DA
record per source line. Measured at 100% on both, and verified by running the
shared gate's own script against this repo's lcov rather than assuming.

The `coverage-metric` input exists because of this crate; before it, migrating
here meant silently dropping the function half of the gate.

GEIGER is not carried over. It was `cargo geiger 2>&1 || true` under
`continue-on-error: true` -- unable to fail twice over. The real control is the
shared `Unsafe lint audit`, which asserts every member EFFECTIVELY forbids or
denies unsafe_code; that is the part the compiler cannot tell you, and it is
inside the gate.

The gitleaks install also goes away with the local jobs. It queried
`releases/latest`, which rate-limits on shared runners and leaves the version
empty; the shared job pins 8.30.1.

Pre-flighted locally, reading each command's own exit code rather than a
pipeline's: fmt, clippy -D warnings, tests, deny, vet, and `cargo +1.75 test`
all clean, and the packaging check confirms README.md and LICENSE both reach the
published crate.
@h4x0r
h4x0r merged commit 8e5f9d7 into main Aug 20, 2026
19 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant