rust.yml

name: rust

on:
  pull_request:
  push:
    branches:
      - main

jobs:
  rust:
    name: rust
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@v2
      - run: cargo fmt --all -- --check
      - run: cargo clippy --all-targets -- -D warnings
      - run: cargo build --locked
      - run: cargo test --locked

  # NA-0686 ADDENDUM (D-1325, OBS-C first half). THE SPLIT.
  #
  # ⚠ WHY A SEPARATE CONTEXT AT ALL. Until now the literal scan reported under
  # the name `public-safety`, so an operator-infrastructure literal and a leaked
  # private key FAILED AS THE SAME WORD. At the branch-protection layer the two
  # causes were indistinguishable: a reviewer saw "public-safety failed" and
  # could not tell whether a secret had escaped or a hostname had, without
  # opening the log. That is the same defect class as ENG-0082 (401 and 403
  # collapsing to one marker), one layer out. Distinct causes get distinct words.
  #
  # The job name, the step names and their order are byte-consistent with
  # `qsl-protocol`'s `infra-literal-scan.yml`, so all four repositories report
  # this gate under one name and old lane records keep reading true.
  infra-literal-scan:
    name: infra-literal-scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      # The scan's refusal to report a pass over an empty input -- "NOTHING
      # EXAMINED", exit 2 -- is correct behaviour that nothing proved until
      # NA-0686 guarded it. The selftest runs FIRST so a broken instrument fails
      # before it can report clean.
      - name: infra-literal scan SELFTEST (the gate's own controls)
        run: python3 scripts/ci/infra_literal_scan_selftest.py
      - name: infra-literal scan (Tier 1, whole tracked tree)
        run: python3 scripts/ci/infra_literal_scan.py --mode tree
      - name: infra-literal scan (Tier 2b, added lines)
        if: github.event_name == 'pull_request'
        run: |
          git fetch --no-tags --depth=1 origin "${{ github.base_ref }}"
          python3 scripts/ci/infra_literal_scan.py --mode diff --base "origin/${{ github.base_ref }}"

  # NA-0686 ADDENDUM (D-1325). ⚠ THE PREVIOUS NOTE HERE WAS STALE AND SAID THE
  # OPPOSITE OF THE TRUTH. It read "ADVISORY UNTIL BRANCH PROTECTION CHANGES ...
  # this repository requires exactly one status context, `rust`". Measured
  # 2026-07-29 against live branch protection: this repository requires THREE --
  # `advisories`, `public-safety` and `rust` -- so both jobs below have been
  # BLOCKING for some time. A comment that understates a gate is worse than none,
  # because it invites someone to merge past a red they were told was advisory.
  #
  # ⚠ WHAT IS ACTUALLY ADVISORY IS THE NEW `infra-literal-scan` CONTEXT ABOVE:
  # it runs and reports on every PR, but it is NOT in the required set yet, and
  # this lane did not put it there -- branch protection is operator-only.
  #
  # ⚠ AND THE SCAN IS DELIBERATELY STILL RUN HERE TOO, WHICH IS NOT AN OVERSIGHT.
  # `public-safety` is a REQUIRED context whose entire content is this scan, so
  # moving the steps out would leave a required context that never reports --
  # and a required context that never reports BLOCKS EVERY PULL REQUEST
  # INDEFINITELY (the NA-0653 failure). Duplicating a scan that examines a few
  # dozen files for one transition is cheap; stranding a repository is not.
  #
  # THE SEQUENCE, so the follow-up is not guesswork:
  #   1. this PR merges; `infra-literal-scan` reports on `main` at least once;
  #   2. the OPERATOR adds `infra-literal-scan` to the required set and removes
  #      `public-safety` from it;
  #   3. a later lane deletes this now-redundant job.
  # Step 2 is deliberately not automated and not this lane's to make.
  public-safety:
    name: public-safety
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      # Pattern provenance: adapted 2026-07-25 from the operator-side
      # publication scanner; scripts/ci/infra_literal_scan.py is now the source
      # of truth. The name values in it are salted digests -- the plaintext list
      # is operator-held, along with how to regenerate them.
      #
      # The spine's existing public-safety gate scans for private keys and cloud
      # tokens only. It has never carried an address, path or host pattern, which
      # is exactly why it ran green on the PRs that published a private LAN
      # address. This job is that missing pattern set.
      # NA-0686 / D-1325 (ENG-0089). The gate now has a gate. The scan's refusal
      # to report a pass over an empty input -- "NOTHING EXAMINED", exit 2 -- was
      # correct behaviour that NOTHING PROVED, which is how a CI gate silently
      # becomes a no-op when a base ref is not fetched. This step runs first so
      # that a broken instrument fails before it can report clean.
      - name: infra-literal scan SELFTEST (the gate's own controls)
        run: python3 scripts/ci/infra_literal_scan_selftest.py
      - name: infra-literal scan (Tier 1, whole tracked tree)
        run: python3 scripts/ci/infra_literal_scan.py --mode tree
      - name: infra-literal scan (Tier 2b, added lines)
        if: github.event_name == 'pull_request'
        run: |
          git fetch --no-tags --depth=1 origin "${{ github.base_ref }}"
          python3 scripts/ci/infra_literal_scan.py --mode diff --base "origin/${{ github.base_ref }}"

  advisories:
    name: advisories
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: install cargo-audit (locked, pinned)
        run: cargo install --locked cargo-audit --version 0.22.0
      # --deny warnings with NO waiver file: this repository's dependency graph
      # is clean today. If that changes, the fix is a named-ID waiver in
      # .cargo/audit.toml -- never dropping --deny warnings, which would accept
      # every future unmaintained or unsound crate silently.
      - name: cargo audit
        run: cargo audit --deny warnings