Merge pull request #4835 from rtk-ai/develop

Next Release

Author: aeppling

.github/workflows/CICD.md

@@ -22,9 +22,9 @@ Trigger: pull_request to develop or master
            ▼       ▼              ▼               ▼        ▼
      ┌──────────┐ ┌──────────┐ ┌───────────┐ ┌─────────┐ ┌──────────┐
      │ test     │ │ security │ │ semgrep   │ │benchmark│ │ doc      │
-     │ ubuntu   │ │ cargo    │ │ AST-aware │ │ >=80%   │ │ review   │
-     │ windows  │ │ audit    │ │ diff-only │ │ savings │ │ ai agent │
-     │ macos    │ │ patterns │ │           │ │         │ │          │
+     │ ubuntu   │ │ cargo    │ │ AST-aware │ │ no empty│ │ review   │
+     │ windows  │ │ audit    │ │ diff-only │ │ or grown│ │ ai agent │
+     │ macos    │ │ patterns │ │           │ │ output  │ │          │
      └────┬─────┘ └────┬─────┘ └─────┬─────┘ └────┬────┘ └────┬─────┘
           │            │             │             │            │
           └────────────┴─────────┬───┴─────────────┴────────────┘
@@ -34,6 +34,7 @@ Trigger: pull_request to develop or master
                       │  to merge          │
                       └────────────────────┘
 
+     + release (build, after clippy: must also pass to merge)
      + DCO check (independent, develop PRs only)
      + Dependabot (weekly: Cargo deps + GitHub Actions)
 ```

.github/workflows/cd.yml

@@ -107,7 +107,7 @@ jobs:
       release_created: ${{ steps.release.outputs.release_created }}
       tag_name: ${{ steps.release.outputs.tag_name }}
     steps:
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: app-token
         with:
           client-id: ${{ secrets.APP_CLIENT_ID }}
@@ -137,7 +137,7 @@ jobs:
     if: ${{ needs.release-please.outputs.release_created == 'true' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: app-token
         with:
           client-id: ${{ secrets.APP_CLIENT_ID }}

.github/workflows/ci.yml

@@ -31,7 +31,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: &rust_toolchain dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           components: rustfmt
       - run: cargo fmt --all -- --check
@@ -42,7 +42,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: *rust_toolchain
         with:
           components: clippy
       - uses: Swatinem/rust-cache@v2
@@ -58,7 +58,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: *rust_toolchain
       - uses: Swatinem/rust-cache@v2
       - run: cargo doc --no-deps
 
@@ -74,7 +74,7 @@ jobs:
     needs: clippy
     steps:
       - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: *rust_toolchain
         with:
           components: clippy, rustfmt
       - uses: Swatinem/rust-cache@v2
@@ -92,7 +92,7 @@ jobs:
     needs: clippy
     steps:
       - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: *rust_toolchain
         with:
           components: clippy
       - uses: Swatinem/rust-cache@v2
@@ -134,7 +134,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: *rust_toolchain
         with:
           targets: ${{ matrix.target }}
       - uses: Swatinem/rust-cache@v2
@@ -161,7 +161,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: *rust_toolchain
 
       - uses: Swatinem/rust-cache@v2
 
@@ -296,12 +296,13 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: *rust_toolchain
 
       - uses: Swatinem/rust-cache@v2
 
+      # Only output tokens are measured, so a release build would only add time.
       - name: Build rtk
-        run: cargo build --release
+        run: cargo build
 
       - name: Install system tools
         run: sudo apt-get install -y tree ripgrep
@@ -314,11 +315,30 @@ jobs:
         with:
           go-version: "stable"
 
-      - name: Install Go tools
-        run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
+      - name: Install golangci-lint
+        uses: golangci/golangci-lint-action@v9
+        with:
+          install-only: true
+          skip-cache: true
 
       - name: Run benchmark
         run: ./scripts/benchmark.sh
+        env:
+          RTK_BIN: target/debug/rtk
+
+  # The one PR job building the shipped profile: LTO problems only show at this link.
+  release:
+    name: release (build)
+    needs: clippy
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: *rust_toolchain
+
+      - uses: Swatinem/rust-cache@v2
+
+      - run: cargo build --release
 
   # ─── AI Doc Review: develop PRs only ───
 

.github/workflows/next-release.yml

@@ -12,7 +12,7 @@ jobs:
     if: github.event.pull_request.merged == true
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510
         id: app-token
         with:
           client-id: ${{ secrets.APP_CLIENT_ID }}

.github/workflows/pr-target-check.yml

@@ -13,7 +13,7 @@ jobs:
       github.event.pull_request.base.ref == 'master' &&
       github.event.pull_request.head.ref != 'develop'
     steps:
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: app-token
         with:
           client-id: ${{ secrets.APP_CLIENT_ID }}