ci: record Cargo-Rail planning evidence

.config/rail.toml

@@ -1,5 +1,5 @@
 [plan.work.ci]
-paths = [".config/rail.toml", ".github/**", ".taplo.toml", "Makefile"]
+paths = [".config/rail.toml", ".github/**"]
 scope = "repository"
 
 [plan.work.ruby]
@@ -24,3 +24,7 @@ paths = [
     "typecheck_negative/**",
 ]
 scope = "repository"
+
+[plan.work.taplo]
+paths = [".taplo.toml"]
+scope = "repository"

.github/workflows/general.yaml

@@ -10,30 +10,78 @@ env:
   CARGO_TERM_COLOR: always
   CARGO_INCREMENTAL: 0
   CARGO_PROFILE_TEST_DEBUG: 0
-  RUSTFLAGS: -C target-cpu=x86-64-v3 -C link-arg=-fuse-ld=mold
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 permissions:
   contents: read
 jobs:
   plan:
     name: Plan
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       required-work: ${{ steps.rail.outputs.required-work }}
     steps:
       - uses: actions/checkout@v7
         with:
-          fetch-depth: 0
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Restore planning evidence
+        if: github.event_name == 'push' || github.event_name == 'pull_request'
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: target/planning-evidence
+          key: cargo-rail-evidence-${{ runner.os }}-${{ runner.arch }}-${{ github.event.pull_request.base.sha || github.event.before }}
+      # The planner rejects a missing evidence directory but accepts an empty one after a cache miss.
+      - name: Create the evidence directory
+        run: mkdir -p target/planning-evidence
       - id: rail
         uses: loadingalias/cargo-rail-action@409962f05d90a78aae995ef6b1c8466010c0a460 # v10.1.1
         with:
-          since: ${{ github.event_name == 'push' && github.event.before || '' }}
+          evidence: target/planning-evidence
+
+  # A separate job records evidence on every push, because the routed jobs can skip.
+  evidence:
+    name: Planning evidence
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.4'
+      - name: Install build dependencies
+        if: runner.os == 'Linux'
+        uses: awalsh128/cache-apt-pkgs-action@latest
+        with:
+          packages: cmake libcurl4-openssl-dev protobuf-compiler
+          version: 1.0
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - uses: loadingalias/cargo-rail-action/setup@409962f05d90a78aae995ef6b1c8466010c0a460 # v10.1.1
+      # Do not record Clippy evidence: Cargo-Rail 0.30.1 marks it incomplete when the clippy::cargo lints run cargo metadata.
+      # Cargo-Rail has no complete evidence for cargo.clippy and cargo.doc. The Clippy and Documentation jobs route on cargo.build, whose evidence covers the same compiler inputs.
+      - name: Record build evidence
+        run: >
+          cargo rail plan evidence --work cargo.build
+          --output target/planning-evidence/cargo.build.json
+          -- build --locked --workspace --all-features
+      - name: Save planning evidence
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: target/planning-evidence
+          key: cargo-rail-evidence-${{ runner.os }}-${{ runner.arch }}-${{ github.sha }}
 
   test:
     name: Tests
     needs: plan
     if: >-
-      contains(fromJSON(needs.plan.outputs.required-work), 'cargo.test') ||
+      contains(fromJSON(needs.plan.outputs.required-work), 'cargo.build') ||
       contains(fromJSON(needs.plan.outputs.required-work), 'ruby') ||
       contains(fromJSON(needs.plan.outputs.required-work), 'ci')
     runs-on: ubuntu-latest
@@ -80,8 +128,6 @@ jobs:
         uses: dtolnay/rust-toolchain@stable
       - name: Set up mold
         uses: rui314/setup-mold@10ca16bf91dc22e05ebdc935cad9c75ea248f621 # v1
-        with:
-          make-default: false
       - name: Cache Rust dependencies
         uses: Swatinem/rust-cache@v2
       - name: Install build dependencies
@@ -123,17 +169,15 @@ jobs:
     needs: plan
     if: >-
       contains(fromJSON(needs.plan.outputs.required-work), 'cargo.fmt') ||
+      contains(fromJSON(needs.plan.outputs.required-work), 'taplo') ||
       contains(fromJSON(needs.plan.outputs.required-work), 'cargo.build') ||
-      contains(fromJSON(needs.plan.outputs.required-work), 'cargo.test') ||
       contains(fromJSON(needs.plan.outputs.required-work), 'ruby') ||
       contains(fromJSON(needs.plan.outputs.required-work), 'ci')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
       - name: Set up mold
         uses: rui314/setup-mold@10ca16bf91dc22e05ebdc935cad9c75ea248f621 # v1
-        with:
-          make-default: false
       - uses: dtolnay/rust-toolchain@nightly
         with:
           components: rustfmt
@@ -160,7 +204,6 @@ jobs:
     if: >-
       contains(fromJSON(needs.plan.outputs.required-work), 'dependency-policy') ||
       contains(fromJSON(needs.plan.outputs.required-work), 'cargo.build') ||
-      contains(fromJSON(needs.plan.outputs.required-work), 'cargo.test') ||
       contains(fromJSON(needs.plan.outputs.required-work), 'ci')
     runs-on: ubuntu-latest
     steps:
@@ -169,8 +212,6 @@ jobs:
       - uses: dtolnay/rust-toolchain@nightly
       - name: Set up mold
         uses: rui314/setup-mold@10ca16bf91dc22e05ebdc935cad9c75ea248f621 # v1
-        with:
-          make-default: false
       - uses: Swatinem/rust-cache@v2
       - name: Install udeps from crates.io
         uses: baptiste0928/cargo-install@v3
@@ -190,16 +231,13 @@ jobs:
     name: Documentation
     needs: plan
     if: >-
-      contains(fromJSON(needs.plan.outputs.required-work), 'cargo.doc') ||
       contains(fromJSON(needs.plan.outputs.required-work), 'cargo.build') ||
       contains(fromJSON(needs.plan.outputs.required-work), 'ci')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
       - name: Set up mold
         uses: rui314/setup-mold@10ca16bf91dc22e05ebdc935cad9c75ea248f621 # v1
-        with:
-          make-default: false
 
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2

.github/workflows/quality.yaml

@@ -20,24 +20,35 @@ jobs:
   plan:
     name: Plan
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       required-work: ${{ steps.rail.outputs.required-work }}
     steps:
       - uses: actions/checkout@v7
         with:
-          fetch-depth: 0
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Restore planning evidence
+        if: github.event_name == 'push' || github.event_name == 'pull_request'
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: target/planning-evidence
+          key: cargo-rail-evidence-${{ runner.os }}-${{ runner.arch }}-${{ github.event.pull_request.base.sha || github.event.before }}
+      # The planner rejects a missing evidence directory but accepts an empty one after a cache miss.
+      - name: Create the evidence directory
+        run: mkdir -p target/planning-evidence
       - id: rail
         uses: loadingalias/cargo-rail-action@409962f05d90a78aae995ef6b1c8466010c0a460 # v10.1.1
         with:
-          since: ${{ github.event_name == 'push' && github.event.before || '' }}
+          all: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
+          evidence: target/planning-evidence
 
   clippy:
     name: Clippy
     needs: plan
     if: >-
-      github.event_name == 'schedule' ||
-      github.event_name == 'workflow_dispatch' ||
-      contains(fromJSON(needs.plan.outputs.required-work), 'cargo.clippy') ||
+      contains(fromJSON(needs.plan.outputs.required-work), 'cargo.build') ||
       contains(fromJSON(needs.plan.outputs.required-work), 'ci')
     runs-on: ubuntu-latest
     steps:

ext/prosody/Cargo.toml

@@ -6,6 +6,7 @@ publish = false
 version = "0.1.0"
 
 [lib]
+# cdylib only: the extension has no Rust doctests; the RSpec suite covers it.
 crate-type = ["cdylib"]
 
 [dependencies]

ext/prosody/src/tracing_util.rs

@@ -32,14 +32,6 @@ use std::collections::HashMap;
 /// - OpenTelemetry module is not available in Ruby
 /// - Context extraction or propagation fails
 /// - Ruby-to-Rust type conversion fails
-///
-/// # Example
-///
-/// ```rust
-/// let context = extract_opentelemetry_context(ruby, &propagator)?;
-/// let span = info_span!("operation");
-/// span.set_parent(context);
-/// ```
 pub fn extract_opentelemetry_context(
     ruby: &Ruby,
     propagator: &TextMapCompositePropagator,

ext/prosody/src/util.rs

@@ -29,13 +29,6 @@ use tracing::{error, warn};
 ///
 /// This macro requires a `ruby: &Ruby` parameter to enforce that it can only
 /// be used within a Ruby thread context, ensuring thread safety.
-///
-/// # Examples
-///
-/// ```
-/// let method_name = id!(ruby, "to_s");
-/// // Use method_name with Ruby function calls
-/// ```
 #[macro_export]
 macro_rules! id {
     ($ruby:expr, $str:expr) => {{
@@ -256,13 +249,6 @@ impl ForkGuard {
 ///
 /// `Some(EnterGuard)` if we entered a new runtime (hold the guard), or `None`
 /// if already in a runtime context.
-///
-/// # Examples
-///
-/// ```rust
-/// let _guard = ensure_runtime_context(ruby);
-/// // Safe to perform async operations
-/// ```
 pub fn ensure_runtime_context(ruby: &Ruby) -> Option<EnterGuard<'static>> {
     let guard = Handle::try_current().is_err().then(|| RUNTIME.enter());