Integration: website wave 1 + 0.10.1 CI/automation slices

.gitattributes

@@ -28,6 +28,9 @@ crates/*/assets/**/*.json text eol=lf
 crates/*/assets/**/*.md text eol=lf
 crates/*/locales/*.json text eol=lf
 workflows/*.js text eol=lf
+# Executable documentation: the Fleet tutorial's JSON fence is parsed by the
+# task-spec contract test, so its bytes must agree on Windows and Unix.
+docs/FLEET_WORKFLOW_TUTORIAL.md text eol=lf
 # The dsh bundle scene is include_str!() into the generated client.js and
 # hashed for stale detection; CRLF would change both across platforms.
 crates/tui/src/integrations/dsh/*.js text eol=lf

.github/codeql/codeql-config.yml

@@ -0,0 +1,33 @@
+# CodeQL configuration for code scanning.
+#
+# Test code is out of scope for security alerts: it runs only in CI, talks to
+# in-process loopback servers, and routinely prints fixture secrets in
+# assertion messages to prove they are redacted elsewhere. Those paths are
+# excluded here so alerts point at product code.
+#
+# Inline `#[cfg(test)] mod tests` blocks inside product files cannot be
+# excluded by path; alerts there are dismissed as "used in tests".
+#
+# This file takes effect only with CodeQL advanced setup:
+# .github/workflows/codeql.yml passes it to `github/codeql-action/init`.
+# Default setup ignores it, so the repository's code scanning setting must be
+# switched from Default to Advanced for either to apply.
+name: codewhale-codeql
+
+paths-ignore:
+  # Rust integration tests and split-out unit test modules.
+  - "**/tests/**"
+  - "**/tests.rs"
+  - "**/*_tests.rs"
+  - "**/test_support.rs"
+  - "**/*_test_support.rs"
+  # JavaScript / TypeScript test suites.
+  - "**/test/**"
+  - "**/__tests__/**"
+  - "**/*.test.js"
+  - "**/*.test.mjs"
+  - "**/*.test.ts"
+  - "**/*.test.tsx"
+  - "**/*.spec.js"
+  - "**/*.spec.ts"
+  - "**/*.spec.tsx"

.github/scripts/release-workflows.test.js

@@ -35,6 +35,7 @@ const nightly = read(".github/workflows/nightly.yml");
 const candidate = read(".github/workflows/release-candidate.yml");
 const artifacts = read(".github/workflows/release-artifacts.yml");
 const release = read(".github/workflows/release.yml");
+const parityWorkflow = read(".github/workflows/release-parity.yml");
 const republish = read(".github/workflows/release-republish.yml");
 const releaseDockerfile = read("packaging/docker/Dockerfile.release");
 const cnb = read(".cnb.yml");
@@ -83,15 +84,22 @@ const npmSmokeCases = [
   ["main Ubuntu", "push", true, "ubuntu-latest", true, true, false, false, true],
   ["main macOS", "push", true, "macos-latest", true, true, true, false, false],
   ["main Windows", "push", true, "windows-latest", true, true, true, false, false],
+  ["main cache failure", "push", true, "macos-latest", true, false, true, false, false],
   ["light main", "push", false, "ubuntu-latest", true, true, false, false, false],
   ["schedule", "schedule", true, "ubuntu-latest", true, true, false, false, false],
 ];
+// The sccache GitHub Actions backend is main-only, mirroring rust-cache's
+// save-if: pull requests never install or enable it (cache bloat, PLAN D).
+const sccacheInstallStep = "mozilla-actions/sccache-action@v0.0.11";
 for (const [label, event, heavy, os, trusted, cache, execute, linuxDeps, cnb] of npmSmokeCases) {
+  const ref = event === "pull_request" ? "refs/pull/1/merge" : "refs/heads/main";
+  const onMain = ref === "refs/heads/main";
+  const installed = execute && onMain;
   const context = {
     needs: { changes: { outputs: { heavy: String(heavy), trusted: String(trusted) } } },
-    github: { event_name: event },
+    github: { event_name: event, ref },
     matrix: { os },
-    steps: { sccache: { outcome: cache ? "success" : "failure" } },
+    steps: { sccache: { outcome: installed ? (cache ? "success" : "failure") : "skipped" } },
   };
   const jobGuard = npmSmokeJob.match(/^    if: (.+)$/m)?.[1];
   assert.ok(jobGuard, "the wrapper job must retain its event guard");
@@ -104,7 +112,8 @@ for (const [label, event, heavy, os, trusted, cache, execute, linuxDeps, cnb] of
     if (name === "Skip npm wrapper smoke for light change") expected = !heavy;
     else if (name === "Install Linux system dependencies") expected = linuxDeps;
     else if (name === "Linux smoke location") expected = cnb;
-    else if (name === "Enable sccache" || name === "sccache stats") expected = execute && cache;
+    else if (name === sccacheInstallStep) expected = installed;
+    else if (name === "Enable sccache" || name === "sccache stats") expected = installed && cache;
     assert.equal(
       Boolean(jobEnabled && vm.runInNewContext(guard, context)),
       expected,
@@ -366,8 +375,22 @@ for (const block of rustCacheBlocks) {
   assert.doesNotMatch(block, /github\.(event|ref|sha)|inputs\./);
 }
 
-const parity = release.match(/\n  parity:\n([\s\S]*?)\n  artifacts:\n/);
-assert.ok(parity, "public release must retain a parity job");
+// One parity gate, called by the release candidate and the public release,
+// and the release refuses a tag without a green RC receipt for its exact SHA.
+const parity = parityWorkflow.match(/\n  parity:\n([\s\S]*)$/);
+assert.ok(parity, "release-parity.yml must define the parity job");
+assert.match(parityWorkflow, /^on:\n  workflow_call:\n/m, "parity must be a reusable workflow");
+for (const [name, source] of [["release.yml", release], ["release-candidate.yml", candidate]]) {
+  const caller = source.match(/\n  parity:\n([\s\S]*?)\n\n/);
+  assert.ok(caller, `${name} must run the parity job`);
+  assert.match(caller[1], /name: Parity\n/, `${name}: the RC receipt check matches the "Parity" job name`);
+  assert.match(caller[1], /uses: \.\/\.github\/workflows\/release-parity\.yml/, `${name} must call the shared parity gate`);
+}
+assert.match(
+  namedStep(release, "Require a green release-candidate receipt for this exact SHA"),
+  /require-rc-receipt\.sh "\$\{GITHUB_REPOSITORY\}" "\$\{SHA\}"/,
+);
+assert.match(release, /^  resolve:\n(?:.*\n)*?      actions: read\n/m, "resolve needs actions: read for the RC receipt");
 assert.doesNotMatch(
   parity[1],
   /ref: \$\{\{ needs\.resolve\.outputs\.sha \}\}/,
@@ -500,11 +523,17 @@ assert.doesNotMatch(
 
 // Cover every test invocation, including named parity and narrow crate gates.
 // These launchers protect production dependencies as well as cfg(test) code.
-// `release` is 4 rather than 3: parity runs the workspace under nextest for the
-// same one-process-per-test isolation CI's lanes use, and keeps a separate
-// doctest invocation because nextest does not run doctests.
+// `release parity` is 4 rather than 3: parity runs the workspace under nextest
+// for the same one-process-per-test isolation CI's lanes use, and keeps a
+// separate doctest invocation because nextest does not run doctests. release.yml
+// itself runs none: its parity job calls release-parity.yml.
 let hermeticInvocations = 0;
-for (const [label, workflow, expected] of [["CI", ci, 5], ["release", release, 4], ["CNB", cnb, 3]]) {
+for (const [label, workflow, expected] of [
+  ["CI", ci, 5],
+  ["release", release, 0],
+  ["release parity", parityWorkflow, 4],
+  ["CNB", cnb, 3],
+]) {
   const commands = workflow.split("\n").filter((line) =>
     !line.trimStart().startsWith("#") && /\bcargo (?:test|nextest run)\b/.test(line),
   );
@@ -659,6 +688,7 @@ for (const [name, source] of [
   ["release-candidate.yml", candidate],
   ["release-artifacts.yml", artifacts],
   ["release.yml", release],
+  ["release-parity.yml", parityWorkflow],
   ["release-republish.yml", republish],
   ["ci.yml", ci],
   ["nightly.yml", nightly],
@@ -701,7 +731,7 @@ assert.equal(jobTimeout(nightly, "build"), 90);
 assert.equal(jobTimeout(release, "resolve"), 10);
 // The v0.9.12 tag push finished every parity step and was then cancelled at
 // 20 minutes inside rust-cache's post-run save; 45 keeps that margin.
-assert.equal(jobTimeout(release, "parity"), 45);
+assert.equal(jobTimeout(parityWorkflow, "parity"), 45);
 
 console.log(
   "Workflow contracts OK: 6-target/12-asset single-runtime nightly and exact-head 7-target/34-asset release candidate.",

.github/workflows/approve-contributor.yml

@@ -35,24 +35,27 @@ jobs:
             ]);
             const scope = scopeByCommand.get(command);
 
-            if (!scope) return;
-            if (!privileged.has(comment.author_association)) return;
-            if (scope === 'pr' && !issue.pull_request) {
-              await github.rest.issues.createComment({
+            // Answer the maintainer's command with a reaction, never a comment
+            // (founder, 2026-09-22). The run log carries the detail, and the
+            // allowlist PR body links back here, so the thread still shows it.
+            async function react(content, message) {
+              core.notice(message);
+              await github.rest.reactions.createForIssueComment({
                 owner,
                 repo,
-                issue_number: issue.number,
-                body: '`/lgtm` grants PR access and must be used on a pull request. Use `/lgtmi` to grant issue access.',
+                comment_id: comment.id,
+                content,
               });
+            }
+
+            if (!scope) return;
+            if (!privileged.has(comment.author_association)) return;
+            if (scope === 'pr' && !issue.pull_request) {
+              await react('confused', '`/lgtm` grants PR access and must be used on a pull request. Use `/lgtmi` to grant issue access.');
               return;
             }
             if (scope === 'issue' && issue.pull_request) {
-              await github.rest.issues.createComment({
-                owner,
-                repo,
-                issue_number: issue.number,
-                body: '`/lgtmi` grants issue access and must be used on an issue. Use `/lgtm` to grant PR access.',
-              });
+              await react('confused', '`/lgtmi` grants issue access and must be used on an issue. Use `/lgtm` to grant PR access.');
               return;
             }
 
@@ -116,12 +119,7 @@ jobs:
 
             const existing = parseAllowlist(content);
             if (existing.has(entry) || existing.has(`all:${normalizedLogin}`)) {
-              await github.rest.issues.createComment({
-                owner,
-                repo,
-                issue_number: issue.number,
-                body: `@${targetLogin} is already approved for ${scope} contributions in \`${path}\`.`,
-              });
+              await react('eyes', `@${targetLogin} is already approved for ${scope} contributions in \`${path}\`.`);
               return;
             }
 
@@ -145,12 +143,7 @@ jobs:
             });
 
             if (pendingPr) {
-              await github.rest.issues.createComment({
-                owner,
-                repo,
-                issue_number: issue.number,
-                body: `@${targetLogin} already has a pending allowlist update PR for ${scope} contributions: ${pendingPr.html_url}`,
-              });
+              await react('eyes', `@${targetLogin} already has a pending allowlist update PR for ${scope} contributions: ${pendingPr.html_url}`);
               return;
             }
 
@@ -210,9 +203,4 @@ jobs:
               ].join('\n'),
             });
 
-            await github.rest.issues.createComment({
-              owner,
-              repo,
-              issue_number: issue.number,
-              body: `Created allowlist update PR: ${pr.html_url}`,
-            });
+            await react('rocket', `Created allowlist update PR: ${pr.html_url}`);

.github/workflows/cache-janitor.yml

@@ -0,0 +1,82 @@
+name: Cache janitor
+
+# The Actions cache held 11,099,951,127 bytes across 2,896 entries, past the
+# repo's 10 GiB cap, so GitHub evicted live main entries first. A cache is
+# readable only from its own ref and the default branch: once a PR closes or
+# a release finishes, its refs/pull/N or refs/tags/vX entries are dead weight.
+# This deletes them. Branch caches (main included) are never touched; see
+# scripts/release/prune-actions-caches.sh.
+on:
+  # pull_request_target so fork PRs get a token that can delete caches. It
+  # never checks out or runs PR code: the checkout below is the base branch.
+  pull_request_target:
+    types: [closed]
+  workflow_run:
+    workflows: [Release]
+    types: [completed]
+  schedule:
+    - cron: '17 4 * * *'
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: List what the sweep would delete without deleting it
+        required: false
+        default: true
+        type: boolean
+
+permissions:
+  contents: read
+
+concurrency:
+  group: cache-janitor-${{ github.event_name }}-${{ github.event.pull_request.number || github.event.workflow_run.id || 'sweep' }}
+  cancel-in-progress: false
+
+jobs:
+  prune:
+    name: Prune dead caches
+    if: github.event_name != 'workflow_run' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push')
+    timeout-minutes: 15
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: write
+      # Read PR state for the sweep.
+      pull-requests: read
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          # Base-branch script only. Never the PR head.
+          ref: ${{ github.event.repository.default_branch }}
+          persist-credentials: false
+      - name: Prune
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          EVENT_NAME: ${{ github.event_name }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          RUN_HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
+          DRY_RUN: ${{ inputs.dry_run }}
+        run: |
+          set -euo pipefail
+          script=scripts/release/prune-actions-caches.sh
+          case "${EVENT_NAME}" in
+            pull_request_target)
+              "${script}" --ref "refs/pull/${PR_NUMBER}/merge" --ref "refs/pull/${PR_NUMBER}/head"
+              ;;
+            workflow_run)
+              # A tag-push Release run reports the tag as head_branch. The
+              # script refuses anything that is not a refs/tags/<tag> ref.
+              "${script}" --ref "refs/tags/${RUN_HEAD_BRANCH}"
+              ;;
+            workflow_dispatch)
+              if [[ "${DRY_RUN}" == "true" ]]; then
+                "${script}" --dry-run --sweep
+              else
+                "${script}" --sweep
+              fi
+              ;;
+            *)
+              "${script}" --sweep
+              ;;
+          esac