CI on OxygenFlow: fmt, clippy, test and build on every push (#2) ad258dc8cf5e

# The CI profile (oxygen#139): every test runs, and a JUnit report is

# written to target/nextest/ci/junit.xml for the hub's test report

# (the job's `junit` artifact).

[profile.ci]

fail-fast = false

[profile.ci.junit]

path = "junit.xml"

// Spectra's own pipeline (OxygenFlow, docs in the oxygenflow repository), in

// the shape of Oxygen's. Every push to a bookmark on OxygenHub runs it in

// Firecracker microVMs on Earth; the jobs appear as checks on the change.

schema-version 1

// The OxygenFlow build image: Rust with rustfmt and clippy, nextest and

// llvm-cov, and the crates of oxygen, oxygenhub and oxygenflow vendored

// (oxygenflow/images/rust). Spectra keeps to those crates

// (`make deps-check`), so the same image builds it with no network.

sandbox "rust" {

    runtime "microvm"

    rootfs "cas://blob/836461b613019f62399a960c61a25c482eb74e30054ff2cd44d5594c3305872b"

    memory-limit "8GiB"

    cpu-limit 4

    // Tests serve and connect on 127.0.0.1 and a Unix socket; nothing

    // leaves the guest.

    network "loopback"

    // CI builds are thrown away: no incremental state and no debug info,

    // so less to compile, link and write (as in oxygen's pipeline).

    env {

        CARGO_INCREMENTAL "0"

        CARGO_PROFILE_DEV_DEBUG "0"

        CARGO_PROFILE_TEST_DEBUG "0"

        CARGO_PROFILE_RELEASE_DEBUG "0"

    }

}

sandbox "rust-small" {

    runtime "microvm"

    rootfs "cas://blob/836461b613019f62399a960c61a25c482eb74e30054ff2cd44d5594c3305872b"

    memory-limit "1GiB"

    cpu-limit 1

    network "isolated"

}

// Spectra's own packages only: `--all` would reach the pinned Oxygen in

// deps/, which has its own formatting (as in oxygenhub).

job "fmt" {

    sandbox "rust-small"

    exec "cargo" "fmt" "-p" "spectra" "-p" "spectra-core" "-p" "spectra-mcp" "-p" "spectra-api" "-p" "radar" "--check"

}

job "clippy" {

    sandbox "rust"

    depends-on "fmt"

    mount {

        source "ephemeral://disk"

        target "/src/target"

        size "16GiB"

        // Kept from this job's last passing run (oxygenflow#28): cargo

        // builds only what changed since.

        cache "target"

        key "Cargo.lock"

    }

    // One build identity for every CI state, so the cached target stays

    // fresh from one push to the next (oxygenflow#52).

    env {

        SPECTRA_BUILD "ci"

    }

    exec "cargo" "clippy" "--workspace" "--all-targets" "--locked" "--" "-D" "warnings"

}

// The tests, run under cargo-nextest and cargo-llvm-cov: a test report

// (JUnit, kept whether or not they pass) for the hub's Tests tab and line

// coverage (LCOV) for its Coverage tab, from one run.

job "test" {

    sandbox "rust"

    depends-on "fmt"

    mount {

        source "ephemeral://disk"

        target "/src/target"

        size "16GiB"

        cache "target"

        key "Cargo.lock"

    }

    env {

        SPECTRA_BUILD "ci"

    }

    exec "cargo" "llvm-cov" "nextest" "--workspace" "--locked" "--profile" "ci" "--lcov" "--output-path" "/src/target/lcov.info"

    output {

        artifact "junit" {

            path "/src/target/nextest/ci/junit.xml"

            when "always"

        }

        artifact "coverage" {

            path "/src/target/lcov.info"

        }

    }

}

job "build" {

    sandbox "rust"

    depends-on "fmt"

    mount {

        source "ephemeral://disk"

        target "/src/target"

        size "16GiB"

        cache "target"

        key "Cargo.lock"

    }

    exec "cargo" "build" "--release" "--locked"

    // The binary, kept as a blob of this repository and named by the

    // job's signed receipt; the run page links it.

    output {

        artifact "spectra" {

            path "/src/target/release/spectra"

        }

    }

}

- **Added: CI on OxygenFlow (#2).** `.flow/pipeline.kdl` in the shape of Oxygen's: fmt, clippy, test (nextest under llvm-cov, with JUnit and coverage for the hub) and build, in the vendored image with no network.