1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
name: mutants
# This repository is public. Only a successful push validation on main may
# execute the expensive full sweep on the homelab runner. The job-level event
# check is load-bearing: a skipped pull-request validation can still conclude
# successfully, including for a fork branch named `main`.
on:
workflow_run:
workflows:
types:
branches:
permissions:
contents: read
concurrency:
group: mutants-${{ github.ref }}
cancel-in-progress: true
env:
CARGO_TERM_COLOR: always
jobs:
# A full sweep catches coverage weakened by test-only changes outside the
# production diff. The pre-commit hook remains staged for fast local feedback;
# this main-only lane is the comprehensive backstop.
mutants:
if: github.event.workflow_run.event == 'push' && github.event.workflow_run.conclusion == 'success'
runs-on:
# Mutation has its own bounded runner. Validation and release retain the
# drep-linux owner on homelab-1, so a full sweep cannot occupy their only
# runner or compete with production workloads.
timeout-minutes: 180
steps:
# Keeping target/ makes the mutation-host run take minutes instead of
# hours. Everything else must still be an exact checkout: unexpected
# ignored or untracked state fails closed rather than influencing a sweep.
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
clean: false
persist-credentials: false
ref: ${{ github.event.workflow_run.head_sha }}
- name: Verify persistent workspace hygiene
shell: bash
run: |
set -euo pipefail
unexpected="$(
git status --porcelain=v1 --untracked-files=all --ignored=matching |
grep -Ev '^!! target/$' || true
)"
if [ -n "$unexpected" ]; then
echo "unexpected persistent runner state:" >&2
echo "$unexpected" >&2
exit 1
fi
- uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
with:
toolchain: stable
- uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf # v2.87.2
with:
tool: cargo-mutants@27.1.0
# scripts/mutants-run.sh owns the verdict, including the distinction
# between a detected timeout and a genuinely missed mutant.
- run: ./scripts/mutants-run.sh