Verify the merged PR3 revision against its frozen base

.github/justfile

@@ -6,6 +6,7 @@ set fallback
 # Lint GitHub Actions workflows.
 check:
     python3 {{ source_directory() }}/scripts/install-formula.test.py
+    bun test {{ source_directory() }}/scripts/rust-cache.test.ts
     {{ source_directory() }}/scripts/release.test.sh
     @if command -v nfpm >/dev/null 2>&1 && command -v envsubst >/dev/null 2>&1 && command -v dpkg-deb >/dev/null 2>&1 && command -v rpm >/dev/null 2>&1; then python3 {{ source_directory() }}/../rs/scripts/package-rename.test.py; fi
     @if command -v actionlint >/dev/null 2>&1; then actionlint; fi

.github/scripts/rust-cache.test.ts

@@ -0,0 +1,65 @@
+import { describe, expect, test } from "bun:test";
+import path from "node:path";
+
+type Mapping = { [key: string]: unknown };
+
+const workflows = [
+	{ file: "interop.yml", job: "interop" },
+	{ file: "nightly.yml", job: "nightly" },
+];
+
+const github = path.resolve(import.meta.dir, "..");
+
+function mapping(value: unknown, label: string): Mapping {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) {
+		throw new TypeError(`${label} is not a YAML mapping`);
+	}
+
+	return { ...value };
+}
+
+function sequence(value: unknown, label: string): unknown[] {
+	if (!Array.isArray(value)) throw new TypeError(`${label} is not a YAML sequence`);
+	return value;
+}
+
+async function yaml(file: string): Promise<Mapping> {
+	return mapping(Bun.YAML.parse(await Bun.file(file).text()), file);
+}
+
+describe("Rust cache boundary", () => {
+	for (const workflow of workflows) {
+		test(`${workflow.file} uses the flake-keyed local cache action`, async () => {
+			const file = path.join(github, "workflows", workflow.file);
+			const document = await yaml(file);
+			const jobs = mapping(document.jobs, `${file}: jobs`);
+			const job = mapping(jobs[workflow.job], `${file}: jobs.${workflow.job}`);
+			const steps = sequence(job.steps, `${file}: jobs.${workflow.job}.steps`).map((step, index) =>
+				mapping(step, `${file}: jobs.${workflow.job}.steps[${index}]`),
+			);
+			const cache = steps.find((step) => step.name === "Rust cache" || step.name === "Rust Cache");
+
+			expect(
+				steps.some((step) => typeof step.uses === "string" && step.uses.startsWith("Swatinem/rust-cache@")),
+			).toBeFalse();
+			expect(cache?.uses).toBe("./.github/actions/rust-cache");
+		});
+	}
+
+	test("cache and restore keys bind the runner and pinned Nix toolchain", async () => {
+		const file = path.join(github, "actions/rust-cache/action.yml");
+		const document = await yaml(file);
+		const runs = mapping(document.runs, `${file}: runs`);
+		const steps = sequence(runs.steps, `${file}: runs.steps`).map((step, index) =>
+			mapping(step, `${file}: runs.steps[${index}]`),
+		);
+		const cache = steps.find(
+			(step) => typeof step.uses === "string" && step.uses.startsWith("jdx/mr-boxington-action@"),
+		);
+		const inputs = mapping(cache?.with, `${file}: cache inputs`);
+		const prefix = `\${{ runner.os }}-\${{ runner.arch }}-mbx-target-\${{ inputs.scope }}-\${{ hashFiles('flake.nix', 'flake.lock', 'rust-toolchain.toml') }}-`;
+
+		expect(inputs["restore-keys"]).toBe(prefix);
+		expect(typeof inputs["cache-key"] === "string" && inputs["cache-key"].startsWith(prefix)).toBeTrue();
+	});
+});

.github/workflows/audio-quality.yml

@@ -8,9 +8,9 @@ name: Audio quality
 # playout engine on a simulated clock: seconds, no browser, and the same numbers
 # on every run, so its budgets are exact and a breach is always the change under
 # review. The Chromium matrix is half an hour of real-time playback whose every
-# number moves with the runner's load, which is why nightly.yml owns it; the
-# `workflow_dispatch` button runs the same job for a branch that wants its
-# answer before tomorrow.
+# number moves with the runner's load, which is why nightly.yml calls it rather
+# than a pull request; the `workflow_dispatch` button runs it for a branch that
+# wants its answer before tomorrow.
 #
 # The filter is the code the replay lane runs, the player (js/watch) and the
 # estimator it replays through (js/hang), plus the harness with its budgets and
@@ -31,10 +31,14 @@ on:
       - "rs/moq-audio/**"
       - "test/audio-quality/**"
       - ".github/workflows/audio-quality.yml"
+  workflow_call:
   workflow_dispatch:
 
+# A called workflow sees its caller's workflow and event, so the nightly run
+# (scheduled or dispatched) and this workflow's own dispatch never share a
+# group, while a repeat of the same kind still supersedes the last.
 concurrency:
-  group: audio-quality-${{ github.ref }}
+  group: audio-quality-${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
@@ -88,13 +92,13 @@ jobs:
           retention-days: 7
           if-no-files-found: ignore
 
-  # The nightly job, on demand: the replay lane, then the Chromium matrix over
-  # the seeded UDP shaper, graded against `test/audio-quality/budgets.json`.
-  # Keep the two in step.
+  # The replay lane, then the Chromium matrix over the seeded UDP shaper, graded
+  # against `test/audio-quality/budgets.json`. A called workflow sees its
+  # caller's event, so this runs for the nightly schedule too.
   matrix:
     name: Audio quality
-    if: github.event_name == 'workflow_dispatch'
-    # x64 for Playwright's Chromium, as in nightly.yml.
+    if: github.event_name != 'pull_request'
+    # x64 for Playwright's Chromium, as interop.yml and wasm.yml run theirs.
     runs-on: ubuntu-latest
     # Two dozen rows at a minute each is about half an hour on its own, and the
     # relay, the CLI, and the shaper build from source ahead of them.
@@ -143,6 +147,11 @@ jobs:
         run: nix develop --command just test audio-quality --enforce
         shell: bash -leo pipefail {0}
 
+      - name: Shared audio ring quality
+        if: ${{ !cancelled() }}
+        run: nix develop --command just test audio-quality --profiles fixed-250 --rings isolated --offload false --enforce
+        shell: bash -leo pipefail {0}
+
       # The run directory is the whole diagnosis: each process's log, the
       # shaper's counters, the raw ndjson, the per-row summaries, and a
       # Playwright trace of any page that failed. The harness keeps it on a

.github/workflows/interop.yml

@@ -70,9 +70,7 @@ jobs:
       # Reuse ~/.cargo + ./target across nightly runs so only changed crates
       # recompile (the relay, cli, moq-ffi, and libmoq all build from source).
       - name: Rust cache
-        uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
-        with:
-          cache-on-failure: true
+        uses: ./.github/actions/rust-cache
 
       # Playwright's Chromium isn't in the nix devShell. Install it plus its apt
       # runtime libs (`--with-deps` needs the host package manager) so the

.github/workflows/nightly.yml

@@ -66,10 +66,8 @@ jobs:
         with:
           determinate: false
 
-      - name: Rust Cache
-        uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
-        with:
-          cache-on-failure: true
+      - name: Rust cache
+        uses: ./.github/actions/rust-cache
 
       # Runs even if the audit fails: a fresh advisory shouldn't hide a
       # compile break in the feature permutations.
@@ -86,10 +84,42 @@ jobs:
           nix develop --command bun install --frozen-lockfile
           nix develop --command bun js/net/bench/broadcasts.ts
 
+      # Timing sweeps for the audio worklet's render quantum and the page's worker reports. They
+      # print tables and assert nothing about time; the unit tests hold the counts.
+      - name: JS audio benchmarks
+        if: ${{ !cancelled() }}
+        run: |
+          nix develop --command bun js/watch/src/audio/stretch.bench.ts
+          nix develop --command bun js/watch/src/audio/worker/remote.bench.ts
+
       - name: Audit
         if: ${{ !cancelled() }}
         run: nix develop --command just rs audit
 
+      - name: Shaper forwarding benchmark
+        if: ${{ !cancelled() }}
+        run: >-
+          nix develop --command cargo bench --locked -p moq-shaper --bench forward --
+          --warm-up-time 1 --measurement-time 2 --sample-size 10
+
+      - name: Resumed track delivery benchmark
+        if: ${{ !cancelled() }}
+        run: >-
+          nix develop --command cargo bench --locked -p moq-net --bench resume --
+          --warm-up-time 1 --measurement-time 2 --sample-size 10 --noplot
+
+      - name: Track fanout benchmark
+        if: ${{ !cancelled() }}
+        run: >-
+          nix develop --command cargo bench --locked -p moq-net --bench track --
+          track_fanout_group --warm-up-time 1 --measurement-time 2 --sample-size 10 --noplot
+
+      - name: Audio playout benchmark
+        if: ${{ !cancelled() }}
+        run: >-
+          nix develop --command cargo bench --locked -p moq-audio --bench playout --
+          --warm-up-time 1 --measurement-time 2 --sample-size 30 --noplot
+
       # The OBS plugin and libmoq's C fixtures are the only things that link
       # libmoq.a from outside cargo, so a stale `rs/libmoq/native-libs/*.txt`
       # breaks them and nothing else. obs.yml lists the inputs that can do that,
@@ -153,75 +183,9 @@ jobs:
 
   # Plays the matrix in headless Chromium over the seeded UDP shaper and grades
   # what the listener would have heard against `test/audio-quality/budgets.json`.
-  #
-  # `ubuntu-latest` rather than the arm runner the jobs above use: this is the
-  # third lane in the repository to launch Playwright's Chromium, and interop.yml
-  # and wasm.yml both run theirs on x86 for that reason.
-  #
-  # audio-quality.yml runs this same job on demand. Keep the two in step.
   audio-quality:
     name: Audio quality
-    runs-on: ubuntu-latest
-    # Two dozen rows at a minute each is about half an hour on its own, and the
-    # relay, the CLI, and the shaper build from source ahead of them.
-    timeout-minutes: 90
-
-    env:
-      # Somewhere `upload-artifact` can reach. The harness's default is under
-      # $TMPDIR, which is outside the workspace.
-      MOQ_TEST_RUNS: ${{ github.workspace }}/test-runs
-
-    steps:
-      - name: Free disk space
-        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # main
-        with:
-          tool-cache: false
-
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - uses: DeterminateSystems/nix-installer-action@1d87d45818068401a10cf16bdc5f00b24994a83f # main
-        with:
-          determinate: false
-
-      - name: Rust cache
-        uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
-        with:
-          cache-on-failure: true
-
-      # Playwright's Chromium isn't in the nix devShell. Install it plus its apt
-      # runtime libs (`--with-deps` needs the host package manager); run.sh's own
-      # `playwright install` then no-ops.
-      - name: Playwright Chromium
-        run: nix develop --command bash -c "bun install --frozen-lockfile && bunx playwright install --with-deps chromium"
-        shell: bash -leo pipefail {0}
-
-      # Seconds, and no browser or relay involved, so it runs ahead of the matrix
-      # and a regression in the ring or the estimator is reported without waiting
-      # half an hour for the rows that need Chromium.
-      - name: Audio quality (replay)
-        run: nix develop --command just test audio-quality --runtime replay --enforce
-        shell: bash -leo pipefail {0}
-
-      - name: Audio quality
-        run: nix develop --command just test audio-quality --enforce
-        shell: bash -leo pipefail {0}
-
-      # The run directory is the whole diagnosis: each process's log, the
-      # shaper's counters, the raw ndjson, the per-row summaries, and a
-      # Playwright trace of any page that failed. The harness keeps it on a
-      # failure without being asked. Short retention because it is large and
-      # only useful while the failure is fresh.
-      - name: Keep the failing run
-        if: ${{ failure() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: audio-quality-run
-          path: test-runs/
-          retention-days: 7
-          if-no-files-found: ignore
+    uses: ./.github/workflows/audio-quality.yml
 
   # Every tag-driven release workflow, run against main with publishing skipped:
   # the workflows gate their publish jobs on `github.ref_type == 'tag'`, and no