1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
name: CI
# Runs on every push to any branch and every pull request. This is the
# fast-feedback gate that catches regressions BEFORE a release tag, unlike
# publish.yml which only fires on `v*` tags.
on:
push:
branches:
pull_request:
# Cancel superseded runs on the same ref so force-pushes don't queue up.
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
# ── Lint: strict fmt gate + clippy advisory ──────────────────────────────
# fmt is a hard gate (rustfmt is deterministic and the whole tree is now
# fmt-clean). clippy runs as advisory (exit code ignored) so the 14
# remaining style lints don't block merges while they're being cleaned up;
# the warnings are still surfaced in the run log.
lint:
name: fmt + clippy
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
with:
components: rustfmt, clippy
- name: cargo fmt --check (strict)
run: cargo fmt --check
- name: cargo clippy (advisory — warnings do not fail the job)
run: cargo clippy --all-targets --all-features --no-deps
continue-on-error: true
# ── Supply-chain: vulnerability + license gate (cargo-deny) ──────────────
# Fails on any NEW RustSec advisory (vulnerability/unsound). Four known
# unmaintained-dep advisories are explicitly ignored in deny.toml with
# tracked reasons (bincode 1.x, and three via the optional jieba-rs). A new
# advisory with no ignore entry blocks the build until reviewed.
supply-chain:
name: cargo-deny (advisories + licenses)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
- name: Install cargo-deny
run: cargo install cargo-deny --locked
- name: cargo deny check
run: cargo deny check advisories licenses sources
# ── Unit tests (HARD gate, fast): library in-crate tests only ────────────
# `cargo test --lib` compiles a SINGLE binary (the lib's inline tests, 428
# of them) and runs in seconds — a fast, deterministic gate that catches
# the vast majority of regressions. Runs on both ubuntu and macOS so
# platform-specific compile/runtime issues surface here, not in the slow
# integration matrix.
unit-test:
name: unit (${{ matrix.os }})
strategy:
fail-fast: false
matrix:
os:
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
- uses: Swatinem/rust-cache@v2
with:
workspaces: ". -> target"
- name: cargo test --lib
env:
CI: "1"
run: cargo test --lib --all-features
# ── Integration tests (ADVISORY): the full tests/ matrix ─────────────────
# `cargo test --workspace` compiles 64 test binaries (~40min cold) and runs
# them. This is too slow to be the primary gate, and some integration tests
# have hardware-dependent thresholds or Linux-specific timing races that
# don't reproduce locally. Kept as advisory (continue-on-error) so failures
# are surfaced in the log for investigation without blocking merges. The
# hard correctness gate is the unit-test job above.
integration-test:
name: integration (${{ matrix.os }})
strategy:
fail-fast: false
matrix:
os:
runs-on: ${{ matrix.os }}
timeout-minutes: 30
continue-on-error: true
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
- uses: Swatinem/rust-cache@v2
with:
workspaces: ". -> target"
- name: cargo test (workspace, hardware-threshold tests skipped)
env:
CI: "1"
# Debug build. Skip list excludes two categories of tests that can't
# reliably pass on shared runners:
# 1. Resource/IO-bound (RSS memory, disk usage) — thresholds depend on
# the runner's hardware; flap on shared runners.
# 2. Performance/latency thresholds (µs/op, latency bounds) — assert
# hardware-speed assumptions shared runners can't meet. Tracked in
# BENCHMARK.md instead.
run: |
cargo test --workspace --all-features -- \
--test-threads=1 \
--skip bench_ --skip stress_ --skip perf_ \
--skip test_memory_linear \
--skip test_memory_leak \
--skip test_memory_does_not_grow_unbounded \
--skip test_disk_usage \
--skip test_no_bloat \
--skip test_perf_ \
--skip test_scan_latency_bounded \
--skip test_insert_latency_bounded \
--skip test_aggregate_latency_bounded \
--skip test_distinct_latency_bounded \
--skip test_where_latency_bounded \
--skip test_pk_select_latency_stable \
--skip test_latency_growth_sublinear \
--skip test_scalability_latency \
--skip test_scalability_memory \
--skip test_durability_large_dataset_checkpoint_recovery \
--skip test_performance_guarantees
# ── Cross-compile: aarch64-unknown-linux-gnu (build only) ────────────────
# Verifies the crate compiles for the primary edge/robotics target. We only
# build (no test run) since we don't have aarch64-linux hardware in the
# matrix; catching link/compile errors here is the main value.
cross-aarch64:
name: cross-compile aarch64-linux
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
with:
targets: aarch64-unknown-linux-gnu
- uses: Swatinem/rust-cache@v2
with:
workspaces: ". -> target"
key: aarch64
- name: Install aarch64 cross linker
run: |
sudo apt-get update
sudo apt-get install -y gcc-aarch64-linux-gnu
- name: cargo build (aarch64, default features)
env:
CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
# Default features include jemalloc + tokenizer + rayon; verify they
# all cross-compile. We deliberately do NOT set target-cpu here (it is
# no longer in .cargo/config.toml).
run: cargo build --release --target aarch64-unknown-linux-gnu
- name: cargo build (aarch64, edge profile — no tokenizer/rayon)
env:
CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
run: cargo build --release --target aarch64-unknown-linux-gnu --no-default-features --features jemalloc