From b0c398333efca12383b2f83f50cfb2606f647266 Mon Sep 17 00:00:00 2001 From: M3gA-Mind Date: Thu, 20 Aug 2026 16:40:38 +0530 Subject: [PATCH] fix(ci): run the Rust lanes when any vendored crate moves A submodule pointer bump currently skips every openhuman Rust lane while the aggregate gate still reports success. Reproduced on the tip of main: 92bab8df "bump tinycortex" - the only change is the vendor/tinycortex pointer CI Lite run 32358998415: success TinyCortex Memory Tests success PR CI Gate skipped Rust Quality (fmt, clippy) skipped Rust Core Coverage (cargo-llvm-cov) skipped Rust Feature-Gate Smoke (gates off) skipped Rust Tauri Coverage (cargo-llvm-cov) So the current tip of main has never been compiled by CI, and main is what gets promoted to release. Cause: the `rust-core` and `rust-core-full` filters enumerated exactly two vendored paths - `vendor/motosan-ai-oauth/**` and `vendor/tinychannels` - out of ten submodules, and `rust-tauri` named none at all. The `tinycortex` filter that did match feeds only TinyCortex's own test lane, which is why that ran while nothing compiled openhuman against the new pin. Every vendored crate is force-resolved by path through `[patch.crates-io]`, in BOTH cargo worlds, so any pointer bump changes what the core and the shell compile against. This is the same defect the release Docker job had: a hand-maintained submodule list that went stale three times before fe5bcb22 (#5596) replaced it with `--init --recursive`. Enumerating the ten paths here would fail the same way on the eleventh, so this matches on `vendor/**` and `.gitmodules` instead. `rust-core-full` gets them too: a dependency-graph change invalidates per-module test scoping exactly as a Cargo.lock change does, so a bump should run the full suite rather than a scoped subset. Cost: a vendored bump now runs the full Rust lanes rather than nothing. That is the point - eight of the ten crates could previously move with zero verification. Refs #5595 --- .github/workflows/ci-lite.yml | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci-lite.yml b/.github/workflows/ci-lite.yml index dd737809e7..9955126487 100644 --- a/.github/workflows/ci-lite.yml +++ b/.github/workflows/ci-lite.yml @@ -154,8 +154,16 @@ jobs: - 'scripts/check-linux-tls-dependencies.sh' - 'scripts/test-rust-e2e.sh' - 'scripts/test-rust-with-mock.sh' - - 'vendor/motosan-ai-oauth/**' - - 'vendor/tinychannels' + # Every vendored crate, not an enumeration. `[patch.crates-io]` + # force-resolves all ten submodules by path, so ANY pointer bump + # changes what this crate compiles against. The previous list + # named two of them, so a bump to the other eight ran no openhuman + # Rust lane at all while PR CI Gate still reported success. + # Enumerating here failed the same way the release Docker + # submodule list did three times before #5596 replaced it with + # `--init --recursive`. Do not go back to a list. + - '.gitmodules' + - 'vendor/**' # Changes here invalidate per-module test scoping → full suite. rust-core-full: - '.github/workflows/ci-lite.yml' @@ -167,8 +175,11 @@ jobs: - 'rust-toolchain.toml' - 'scripts/ci-cancel-aware.sh' - 'scripts/check-linux-tls-dependencies.sh' - - 'vendor/motosan-ai-oauth/**' - - 'vendor/tinychannels' + # A vendored-crate bump invalidates per-module test scoping for the + # same reason a Cargo.lock change does: it moves the dependency + # graph under every module. Full suite, not scoped. + - '.gitmodules' + - 'vendor/**' rust-core-src: - 'src/**' - 'tests/**' @@ -185,6 +196,11 @@ jobs: - 'rust-toolchain.toml' - 'app/src-tauri/**' - 'scripts/ci-cancel-aware.sh' + # The shell is a second Cargo world with its own duplicate + # `[patch.crates-io]` table pointing at the same submodules, so it + # is affected by a bump exactly as the core is. It named none. + - '.gitmodules' + - 'vendor/**' # Shared mock backend + script self-tests. The mock backend every # E2E suite depends on had zero PR-lane coverage before this (its # own socket-auth tests never ran in CI) — arm the scripts