zc2 0.0.29

P2P compute broker with credit-based billing, WAL, and broker mesh support
name: Build

on:
  push:
    branches:
      - master
      - main
      - 'release/**'
    paths-ignore:
      - "**.md"
      - "docs/**"
  pull_request:
    paths-ignore:
      - "**.md"
      - "docs/**"

# Cancel in-flight Build for the same branch when a new push lands.
# Feature-branch pushes self-cancel; master / main / release pushes
# don't (they must finish what they start because tagging + deploy
# chains off a successful run).
concurrency:
  group: build-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ !startsWith(github.ref, 'refs/heads/master') && !startsWith(github.ref, 'refs/heads/main') && !startsWith(github.ref, 'refs/heads/release/') }}

jobs:
  build:
    # Self-hosted ARC runner pool (`cpu` scale set, autoscales 1..8 on the
    # 20-core gha-runner-cpu node via actions-runner-controller). The earlier
    # single-online-host bottleneck that pushed this to ubuntu-latest is gone:
    # the scale set spins up an ephemeral dind runner per queued job.
    runs-on: cpu
    timeout-minutes: 10
    env:
      HOME: /home/runner
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

      # zakuro-client is a git dep on the private zakuro-ai/zakuro-drive repo.
      # Auth is a read-only deploy key on zakuro-drive (DRIVE_DEPLOY_KEY holds
      # the private half): rewrite the dep URL to SSH and point git at the key.
      # cargo shells out to the git CLI (.cargo/config.toml: git-fetch-with-cli).
      - name: Git auth for private zakuro-drive dependency (read-only deploy key)
        shell: bash
        run: |
          mkdir -p ~/.ssh && chmod 700 ~/.ssh
          printf '%s\n' "${{ secrets.DRIVE_DEPLOY_KEY }}" > ~/.ssh/zakuro_drive_deploy
          chmod 600 ~/.ssh/zakuro_drive_deploy
          ssh-keyscan github.com >> ~/.ssh/known_hosts 2>/dev/null
          git config --global core.sshCommand "ssh -i ~/.ssh/zakuro_drive_deploy -o IdentitiesOnly=yes"
          git config --global url."ssh://git@github.com/zakuro-ai/".insteadOf "https://github.com/zakuro-ai/"

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable
        with:
          toolchain: "stable"
          components: rustfmt,clippy

      # Only master saves the cache. PRs restore it and never spend ~80 s
      # uploading one of their own after a miss.
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32  # v2
        with:
          # v1: a fresh cache for the dev-profile build. The v0 caches hold
          # release artifacts this job no longer builds; restoring one took
          # ~2 min and then the dev profile compiled from scratch anyway.
          prefix-key: v1-rust
          save-if: ${{ github.ref == 'refs/heads/master' }}

      - name: cargo fmt --check
        run: cargo fmt --check

      # Scoped to zc2 on purpose: this is the guard that the publishable,
      # private-dep-free crate compiles on its own. The workspace build below
      # covers zc-hooks. See #104.
      - name: cargo clippy (zc2 only — OSS build guard)
        run: cargo clippy -p zc2 -- -D warnings

      # Prebuilt binary, from the same pinned action as security.yml's tools.
      - name: Install cargo-nextest
        uses: taiki-e/install-action@9e1e5806d4a4822de933115878265be9aaa786d9  # v2
        with:
          tool: cargo-nextest

      # The whole workspace: zc2 plus the zc-hooks sidecar, which owns the
      # private zakuro-client git dep (the runner has deploy-key access).
      # Dev profile, not --release: the suite runs in the same ~31 s either
      # way (it waits on sockets and timeouts, not the CPU), and the test
      # binary builds without optimizing the whole crate. Release binaries are
      # built by release.yml on tags and by the Docker workflow on master.
      # nextest gives each test its own process and retries flakes; see
      # .config/nextest.toml.
      - name: cargo nextest (workspace)
        run: cargo nextest run --workspace --profile ci

      - name: Cleanup git SSH config (runner hygiene)
        if: always()
        run: |
          # Remove the SSH deploy-key config so subsequent jobs on the same
          # ARC runner (e.g. sakura-internal CI) are not affected by this
          # job's private-repo URL rewrite.
          git config --global --remove-section 'url.ssh://git@github.com/zakuro-ai/' 2>/dev/null || true
          git config --global --unset-all 'core.sshCommand' 2>/dev/null || true