Continuous integration

Note

Project policy: draft. This page is the only home of Shiin’s CI rules.

Workflows

Workflow	When it runs	What it does
`ci.yml`	Pull requests and pushes to `main`	Formatting, lints, and tests on each platform tier; release latency measurements on Linux and macOS; isolated engine WebAssembly check; the minimum supported Rust version; `cargo deny`; and a check that every action is pinned by commit
`docs.yml`	Pull requests, pushes to `main`, and manual dispatch	Documentation checks, stale-specification warnings, intent measurements, dependency checks, and book publication from `main`
`robustness.yml`	Pull requests and pushes to `main`	Native key-store lifecycle checks on Linux, macOS, and Windows; bounded parser fuzzing and pure wire-type tests under Miri on a dated nightly
`release.yml`	Pull requests and a version tag	Builds and qualifies five Unix targets, generates SBOMs and dependency metadata, attests archives, and publishes tagged releases; generated by dist and repaired by `cargo xtask release-ci-fix`
`sbom.yml`	Manual dispatch	Produces an additional JSON CycloneDX diagnostic as a build artifact
`link-health.yml`	Weekly and manual dispatch	Checks public links with bounded concurrency and updates one bot-owned issue when links fail

Tests run on Tier 1 platforms as a blocking check, and on Tier 2 without blocking; see platform support.

The docs workflow has read-only contents permission and does not persist checkout credentials.

release.yml is generated by dist generate and repaired by the repository’s Rust automation:

$ dist generate
$ cargo xtask release-ci-fix
$ cargo xtask release-ci-fix --check

The ci.yml pin and generated-template checks fail if regeneration leaves a tag reference or omits the expected archive/SBOM qualification.

Third-party actions are pinned by commit SHA, with the release tag in a comment.

Nightly jobs use a dated nightly named in the workflow, updated by pull request.