forjar 1.32.0

Rust-native Infrastructure as Code — bare-metal first, BLAKE3 state, provenance tracing
Documentation
# FJ-2607: Infrastructure mutation testing
# Runs mutation tests to verify detection coverage
name: mutation
on:
  push:
    branches: [main]
    paths:
      - "src/**"
      - "mutants.toml"
      - ".cargo/config.toml"
      - ".github/workflows/mutation.yml"
  pull_request:
    paths:
      - "src/**"
      - "mutants.toml"
  workflow_dispatch:

concurrency:
  group: mutation-${{ github.ref }}
  cancel-in-progress: true

jobs:
  mutation:
    # forjar#598 -- PINNED TO BARE METAL (interim, named coupling). This job
    # runs UNFILTERED lib tests, which include nas_archive's
    # the_environment_can_exercise_the_safety_property -- a test that FAILS
    # rather than skips when rsync is absent (#289). rsync is absent from the
    # yoga-build* containers that `[self-hosted, clean-room, X64]` also
    # matches, so without `intel` this job is a per-run lottery. `intel` is a
    # hostname standing in for a capability; remove it with the others when a
    # capability label exists or yoga's images converge (paiml/infra#813).
    runs-on: [self-hosted, clean-room, X64, intel]
    # infra#430: sixteen clean-room runners share one ~/.cargo, and an hourly
    # reaper deletes registry/src entries by mtime -- under a live build, which
    # makes rustc read a source file that has just vanished:
    #   couldn't read .../registry/src/.../<crate>/src/<file>.rs: No such file
    #   error: could not parse/generate dep info at: .../deps/<crate>.d
    # MEASURED on this branch: msrv and coverage both died that way the first
    # time PMAT-547 moved them off GitHub-hosted runners, where each job had a
    # private ~/.cargo by construction. A registry private to this runner takes
    # the job off the shared surface. The path is outside the workspace, so it
    # survives the checkout clean and is a cache rather than a cold download.
    # The host-side fix is paiml/infra's.
    env:
      CARGO_HOME: ${{ github.workspace }}/../cargo-home-${{ github.job }}
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2

      - name: Install cargo-mutants
        run: |
          # forjar#566: a stale `rustup override set 1.89.0`, left in this
          # runner's workspace by the MSRV job before that job stopped writing
          # one, outranks rust-toolchain.toml; cargo-mutants 27.1.0 needs 1.91
          # and failed to build under it. Clear it so the pin applies.
          rustup override unset
          rustc --version
          cargo install cargo-mutants

      - name: Run mutation tests
        continue-on-error: true
        run: cargo mutants --timeout 120

      - name: Upload mutation report
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: mutation-results
          path: mutants.out/
          retention-days: 14
          if-no-files-found: ignore