From b3309e29f8cc8f5eaf684c05dad92a61a87153ca Mon Sep 17 00:00:00 2001 From: Bryan Van Deusen Date: Tue, 18 Aug 2026 11:18:54 -0400 Subject: [PATCH] ci: the Rust lane was only ever checking one crate of three MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Clippy, Test and fmt steps ran with `working-directory: desktop/src-tauri`, so cargo scoped them to the desktop PACKAGE. That was right while the desktop was the only Rust in the repo. Extracting the core (M12 step 1) made it wrong and nothing said so: * the core's 89 tests have not run in CI since that extraction. They used to, as part of the desktop crate, and moving the files out of that directory quietly took them out of the lane. * `android/ffi` was never compiled at all. I claimed the previous commit was verified by this lane; it wasn't. Run 3928 went green without the word "uniffi" appearing anywhere in its log. Both crates still COMPILE, because the desktop depends on the core — which is precisely why the hole was invisible. A green run kept meaning less than it looked like it meant, and the tell was there to be read: the test output listed `thoughtsync_desktop_lib` and nothing else. Now run from the repo root with `--workspace` / `--all`. The lockfile gate keeps its place on the first cargo invocation. ci-requirements gains the rule and the reason, plus a note to check a new member actually appears in the `cargo test` output rather than trusting the green. Also corrects the lockfile procedure there to `cargo fetch` rather than `cargo generate-lockfile`: both update the lockfile, but generate re-resolves from scratch and bumps unrelated crates, turning a two-line manifest edit into an unreviewable diff. fetch resolves minimally. Co-Authored-By: Claude Opus 5 (1M context) --- .forgejo/workflows/desktop.yml | 19 +++++++++++++------ ci-requirements.md | 24 ++++++++++++++++++++---- 2 files changed, 33 insertions(+), 10 deletions(-) diff --git a/.forgejo/workflows/desktop.yml b/.forgejo/workflows/desktop.yml index d43b869..ff5cd1f 100644 --- a/.forgejo/workflows/desktop.yml +++ b/.forgejo/workflows/desktop.yml @@ -77,13 +77,21 @@ jobs: # of silently re-resolving. Everything after it in this job then compiles the # exact versions recorded in the lockfile, so the flag isn't repeated on the # bundle build (issue 2102). + # + # Run from the REPO ROOT with --workspace, not from desktop/src-tauri. + # + # These three steps used to run inside the desktop crate, which was right when + # it was the only Rust in the repo. After the core was extracted (M12 step 1) + # it silently stopped being right: cargo scoped to the desktop PACKAGE, so the + # core's 89 tests stopped running and nothing lints the Android uniffi shim at + # all. Both crates are dependencies of the desktop, so they still COMPILED — + # which is exactly why the gap was invisible, and why a green run kept meaning + # less than it looked like it meant. - name: Clippy - run: cargo clippy --locked --all-targets -- -D warnings - working-directory: desktop/src-tauri + run: cargo clippy --locked --workspace --all-targets -- -D warnings - name: Test - run: cargo test --locked - working-directory: desktop/src-tauri + run: cargo test --locked --workspace # Deliberately AFTER clippy + test, not before. # @@ -94,8 +102,7 @@ jobs: # means every push reports its real problems too. Still before the ~20-40 min # bundle build, so a fmt failure doesn't burn that. - name: Rust format check - run: cargo fmt --check - working-directory: desktop/src-tauri + run: cargo fmt --all --check # Frontend already built above; skip the beforeBuildCommand rebuild. # diff --git a/ci-requirements.md b/ci-requirements.md index a0e4e6b..317a07e 100644 --- a/ci-requirements.md +++ b/ci-requirements.md @@ -85,9 +85,17 @@ backend/frontend push. `container.image`; `runs-on: python-ci` is only a scheduling label. - **Steps:** build the shared frontend (embedded by `generate_context!`) → `cargo tauri icon app-icon.png` (platform icon set from the committed 1024px - source) → `cargo fmt --check` → `cargo clippy -D warnings` → `cargo test` → - `cargo tauri build` (produces `.deb` + `.AppImage`) → de-bundle the AppImage's - graphics libs → verify the `.deb` → repackage for pacman. + source) → `cargo clippy --workspace -D warnings` → `cargo test --workspace` → + `cargo fmt --all --check` → `cargo tauri build` (produces `.deb` + `.AppImage`) + → de-bundle the AppImage's graphics libs → verify the `.deb` → repackage for + pacman. +- **The three analyzer steps run from the REPO ROOT with `--workspace`**, not + from `desktop/src-tauri`. Scoping them to the desktop package was correct while + it was the only Rust here; after the core was extracted it silently stopped + being — the core's 89 tests stopped running, and a fourth crate would not be + linted at all. The dependency crates still COMPILE either way, which is exactly + why the gap is invisible from a green run. If you add a workspace member, check + that it appears in the `cargo test` output before believing the lane covers it. - **`APPIMAGE_EXTRACT_AND_RUN=1`** is set: AppImage tooling FUSE-mounts by default and CI containers have no `/dev/fuse`. - **Packaging tools used from the image** (none installed at job time, rule 5): @@ -223,9 +231,17 @@ above, and resolution is neither a test run nor a build: ``` docker run --rm --user "$(id -u):$(id -g)" -e CARGO_HOME=/tmp/cargo \ -v "$PWD:/w" -w /w \ - git.fabledsword.com/bvandeusen/ci-tauri:1.97 cargo generate-lockfile + git.fabledsword.com/bvandeusen/ci-tauri:1.97 cargo fetch ``` +**`cargo fetch`, not `cargo generate-lockfile`.** Both update the lockfile, but +generate-lockfile re-resolves the whole graph from scratch and will happily bump +crates that have nothing to do with your change — turning a two-line manifest +edit into a few-hundred-line lockfile diff nobody can review. `cargo fetch` +performs the minimal resolution: existing pins are preserved, only the new +entries are added. Verify it stayed additive before committing (`git diff +Cargo.lock | grep '^-'` should show nothing but re-ordered dependency lists). + Resolving inside the CI image rather than against some other cargo is what keeps the lockfile format and the picked versions identical to what CI would have chosen. Commit the result in the same change as the `Cargo.toml` edit — a