forjar 1.4.1

Rust-native Infrastructure as Code — bare-metal first, BLAKE3 state, provenance tracing
Documentation
# FJ-2607: Infrastructure mutation testing
# Runs mutation tests to verify detection coverage
name: mutation
on:
  push:
    branches: [main]
    paths:
      - "src/**"
      - "mutants.toml"
      - ".cargo/config.toml"
      - ".github/workflows/mutation.yml"
  pull_request:
    paths:
      - "src/**"
      - "mutants.toml"
  workflow_dispatch:

concurrency:
  group: mutation-${{ github.ref }}
  cancel-in-progress: true

jobs:
  mutation:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v4

      - name: Checkout provable-contracts (path dep)
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
        with:
          repository: paiml/provable-contracts
          path: provable-contracts

      - name: Symlink provable-contracts for Cargo path deps
        run: ln -sf "$GITHUB_WORKSPACE/provable-contracts" "$GITHUB_WORKSPACE/../provable-contracts"

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2

      - name: Generate contract assertions — pv codegen
        run: |
          if ! command -v pv >/dev/null 2>&1; then
            cargo install provable-contracts-cli --locked || true
          fi
          PV=$(command -v pv 2>/dev/null || true)
          if [ -z "$PV" ]; then
            echo "::warning::pv not found — skipping contract generation"
          else
            PC_CONTRACTS="$GITHUB_WORKSPACE/../provable-contracts/contracts"
            if [ -f src/lib.rs ] && grep -q 'mod generated_contracts' src/lib.rs && [ ! -f src/generated_contracts.rs ]; then
              if [ -d "$PC_CONTRACTS" ]; then
                "$PV" codegen "$PC_CONTRACTS" -o src/generated_contracts.rs || true
              elif [ -d contracts ]; then
                "$PV" codegen contracts/ -o src/generated_contracts.rs || true
              fi
            fi
          fi

      - name: Install cargo-mutants
        run: cargo install cargo-mutants

      - name: Run mutation tests
        continue-on-error: true
        run: cargo mutants --timeout 120

      - name: Upload mutation report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: mutation-results
          path: mutants.out/
          retention-days: 14
          if-no-files-found: ignore