ci: migrate to the shared fleet workflow - #9
Merged
Conversation
Replaces eleven hand-rolled jobs with the shared workflow and publishes
`ci / All checks`, so branch protection has one stable context to require.
`docs.yml` and `release-plz.yml` are untouched.
Nothing is left beside the gate. Every job this repo ran is now a job INSIDE
the reusable workflow, which matters because a sibling of the `uses:` call
publishes its own context that branch protection does not require -- it reddens
a PR and blocks nothing.
fmt clippy test msrv deny vet secrets docs -> shared equivalents
coverage -> coverage-gate: strict,
coverage-metric: both
package -> package-check, now a gated
job in the shared workflow
fuzz-check -> fuzz-build
geiger -> DELETED, see below
COVERAGE is the strongest posture in the fleet: STRICT on lines AND functions,
where 47 consumers gate on lines alone. That is this crate's actual invariant --
every monomorphized instance exercised, not merely every line touched by some
instantiation. Line coverage cannot see a generic reader instantiated for a type
nobody calls, because llvm-cov emits one FN record per instantiation but one DA
record per source line. Measured at 100% on both, and verified by running the
shared gate's own script against this repo's lcov rather than assuming.
The `coverage-metric` input exists because of this crate; before it, migrating
here meant silently dropping the function half of the gate.
GEIGER is not carried over. It was `cargo geiger 2>&1 || true` under
`continue-on-error: true` -- unable to fail twice over. The real control is the
shared `Unsafe lint audit`, which asserts every member EFFECTIVELY forbids or
denies unsafe_code; that is the part the compiler cannot tell you, and it is
inside the gate.
The gitleaks install also goes away with the local jobs. It queried
`releases/latest`, which rate-limits on shared runners and leaves the version
empty; the shared job pins 8.30.1.
Pre-flighted locally, reading each command's own exit code rather than a
pipeline's: fmt, clippy -D warnings, tests, deny, vet, and `cargo +1.75 test`
all clean, and the packaging check confirms README.md and LICENSE both reach the
published crate.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces eleven hand-rolled jobs with the shared workflow and publishes
ci / All checks.docs.ymlandrelease-plz.ymluntouched.Nothing is left beside the gate. Every job this repo ran is now a job inside the reusable workflow — which matters, because a sibling of the
uses:call publishes its own context that branch protection does not require: it reddens a PR and blocks nothing.coveragecoverage-gate: strict+coverage-metric: bothpackagepackage-check— now a gated job in the shared workflowfuzz-checkfuzz-buildgeigerCoverage: the strongest posture in the fleet
Strict on lines AND functions, where 47 consumers gate on lines alone. That is this crate's actual invariant — every monomorphized instance exercised, not merely every line touched by some instantiation. Line coverage cannot see a generic reader instantiated for a type nobody calls: llvm-cov emits one
FNrecord per instantiation but oneDArecord per source line.Measured at 100% on both, and verified by running the shared gate's own script against this repo's lcov rather than assuming it.
The
coverage-metricinput exists because of this crate. Before it, migrating here meant silently dropping the function half of the gate.geiger is not carried over
It was
cargo geiger 2>&1 || trueundercontinue-on-error: true— unable to fail twice over. The real control is the shared Unsafe lint audit, which asserts every member effectively forbids or deniesunsafe_code— the part the compiler cannot tell you — and it is inside the gate.The gitleaks install goes too: it queried
releases/latest, which rate-limits on shared runners and leaves the version empty. The shared job pins 8.30.1.Pre-flight
Reading each command's own exit code rather than a pipeline's: fmt · clippy
-D warnings· tests · deny · vet ·cargo +1.75 testall clean, and the packaging check confirms README.md and LICENSE both reach the published crate.