chore(tooling): thin justfiles and CI that calls them

.github/actions/just/action.yml

@@ -0,0 +1,11 @@
+name: Install just
+description: Install the pinned just for jobs outside the nix dev shell, which already provides it.
+
+runs:
+  using: composite
+  steps:
+    # A checksum-verified prebuilt, so it costs seconds rather than a
+    # `cargo install`. Keep the version in step with nixpkgs' just in flake.lock.
+    - uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29 # v2.87.21
+      with:
+        tool: just@1.58.0

.github/justfile

@@ -1,13 +1,40 @@
-set fallback
+set working-directory := '..'
 
-# actionlint is skipped when absent locally; the root `_tools` preflight makes
-# it a hard requirement under MOQ_STRICT, so CI can't skip it.
-
-# Lint GitHub Actions workflows.
+# Lint GitHub Actions workflows, their alert coverage, and that every step runs a recipe.
 check:
-    python3 {{ source_directory() }}/scripts/install-formula.test.py
-    {{ source_directory() }}/scripts/release.test.sh
-    @if command -v nfpm >/dev/null 2>&1 && command -v envsubst >/dev/null 2>&1 && command -v dpkg-deb >/dev/null 2>&1 && command -v rpm >/dev/null 2>&1; then python3 {{ source_directory() }}/../rs/scripts/package-rename.test.py; fi
-    @if command -v actionlint >/dev/null 2>&1; then actionlint; fi
-    {{ source_directory() }}/scripts/alert.sh check-coverage
-    @if command -v rustc >/dev/null 2>&1; then {{ source_directory() }}/scripts/package-binary.test.sh; fi
+    actionlint
+    sh/gh/alert.sh check-coverage
+    bun sh/gh/check-runs.ts
+
+# Tests of the release tooling itself; nightly, not on every pull request.
+test:
+    python3 sh/gh/install-formula.test.py
+    sh/gh/release.test.sh
+    python3 sh/rs/package-rename.test.py
+    sh/go/publish-wrapper.test.sh
+    bash .claude/hooks/direnv.test.sh
+
+# Release workflow helpers, e.g. `just gh release parse-version moq-cli`.
+[positional-arguments]
+release *args:
+    sh/gh/release.sh "$@"
+
+# Post a failed run to Discord, or check that alert.yml covers every workflow.
+[positional-arguments]
+alert *args:
+    sh/gh/alert.sh "$@"
+
+# Render a Homebrew formula template for a release.
+[positional-arguments]
+formula *args:
+    sh/gh/render-formula.sh "$@"
+
+# Copy a rendered formula into a Homebrew tap checkout, migrating renamed formulae.
+[positional-arguments]
+install-formula *args:
+    python3 sh/gh/install-formula.py "$@"
+
+# Trigger the apt-repo and rpm-repo workflows for a release tag.
+[positional-arguments]
+trigger-repo-publish *args:
+    sh/gh/trigger-repo-publish.sh "$@"

.github/workflows/alert.yml

@@ -81,6 +81,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Post to Discord
         env:
           DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
@@ -91,4 +93,4 @@ jobs:
           RUN_REF: ${{ github.event.workflow_run.head_branch }}
           RUN_TITLE: ${{ github.event.workflow_run.display_title }}
           RUN_ACTOR: ${{ github.event.workflow_run.triggering_actor.login }}
-        run: .github/scripts/alert.sh discord
+        run: just gh alert discord

.github/workflows/android.yml

@@ -50,7 +50,6 @@ concurrency:
 
 env:
   CARGO_NDK_VERSION: 4.1.2
-  JUST_VERSION: 1.52.0
 
 jobs:
   android:
@@ -74,15 +73,10 @@ jobs:
 
       # No Rust cache: this workflow only runs on pull requests, which may not
       # save one, so it would have nothing to restore.
+      - uses: ./.github/actions/just
+
       - name: Install cargo-ndk
         run: cargo install --locked "cargo-ndk@$CARGO_NDK_VERSION"
 
-      # A checksummed release binary, where `cargo install` would spend ~2 minutes
-      # building just from source.
-      - name: Install just
-        uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29 # v2.87.21
-        with:
-          tool: just@${{ env.JUST_VERSION }}
-
       - name: Check
         run: just rs android

.github/workflows/apt-repo.yml

@@ -34,6 +34,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Set up packaging tools
         uses: ./.github/actions/setup-packaging
 
@@ -53,10 +55,9 @@ jobs:
       - name: Publish to R2
         shell: bash
         env:
-          ARTIFACTS_DIR: artifacts
           R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
           R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
           R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
           SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
           SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
-        run: ./infra/apt/publish.sh
+        run: just infra apt publish "$GITHUB_WORKSPACE/artifacts"

.github/workflows/check.yml

@@ -39,19 +39,7 @@ jobs:
           # Full history so `just ci check` can diff against origin/$GITHUB_BASE_REF.
           fetch-depth: 0
 
-      # Quests, agent config, and root Markdown compile nothing, so a diff of only
-      # those skips the disk cleanup and Rust cache that exist for the build.
-      - name: Scope
-        id: scope
-        run: |
-          base=$(git merge-base "origin/$GITHUB_BASE_REF" HEAD)
-          files=$(git diff --name-only "$base")
-          if grep -qvE '^(quest/|\.claude/|[^/]+\.md$)' <<< "$files"; then
-            echo build=true >> "$GITHUB_OUTPUT"
-          fi
-
       - name: Free disk space
-        if: steps.scope.outputs.build
         uses: jlumbroso/free-disk-space@ceedf095f4ec1a097402bc6bd80831f2e1a6fde6 # main
         with:
           tool-cache: false
@@ -75,20 +63,19 @@ jobs:
       # scope such an entry to the PR's own branch anyway, where no later PR
       # could read it while it ate the repository's 10 GB budget.
       - name: Rust cache
-        if: steps.scope.outputs.build
         uses: ./.github/actions/rust-cache
 
       # The same recipe a developer runs locally. It diffs against
       # origin/$GITHUB_BASE_REF and touches only the packages this PR changed
-      # plus their dependents, so a one-crate PR compiles one crate.
+      # plus their dependents, so a one-crate PR compiles one crate and a
+      # quest-only PR runs only the lints. sh/dispatch.sh's impact map is the one
+      # place that decides; the setup above always runs rather than keep a second
+      # path map here.
       #
       # MOQ_STRICT turns every "tool missing, skipping" guard into an error.
       # Locally an absent formatter means less gets checked; here it would mean
       # a green run that checked nothing, which is the failure mode worth
       # spending a preflight on.
-      - name: Test direnv hook
-        run: bash .claude/hooks/direnv.test.sh
-
       - name: Check
         run: nix develop --command just ci check
         env:
@@ -108,26 +95,12 @@ jobs:
           # Full history so `just ci test` can diff against origin/$GITHUB_BASE_REF.
           fetch-depth: 0
 
-      # Same scope as the `check` job. No test covers those files either, so the
-      # job skips everything and reports green instead of spending a minute of
-      # setup to run nothing.
-      - name: Scope
-        id: scope
-        run: |
-          base=$(git merge-base "origin/$GITHUB_BASE_REF" HEAD)
-          files=$(git diff --name-only "$base")
-          if grep -qvE '^(quest/|\.claude/|[^/]+\.md$)' <<< "$files"; then
-            echo build=true >> "$GITHUB_OUTPUT"
-          fi
-
       - name: Free disk space
-        if: steps.scope.outputs.build
         uses: jlumbroso/free-disk-space@ceedf095f4ec1a097402bc6bd80831f2e1a6fde6 # main
         with:
           tool-cache: false
 
-      - if: steps.scope.outputs.build
-        uses: DeterminateSystems/nix-installer-action@1d87d45818068401a10cf16bdc5f00b24994a83f # main
+      - uses: DeterminateSystems/nix-installer-action@1d87d45818068401a10cf16bdc5f00b24994a83f # main
         with:
           determinate: false
           # Trust the flake's cachix substituter. `nixConfig` in flake.nix is
@@ -142,13 +115,11 @@ jobs:
 
       # Restore only, same as the `check` job above.
       - name: Rust cache
-        if: steps.scope.outputs.build
         uses: ./.github/actions/rust-cache
 
       # NEXTEST_PROFILE picks up the longer hang timeout in .config/nextest.toml;
       # without it a runner under load could trip the local one.
       - name: Test
-        if: steps.scope.outputs.build
         run: nix develop --command just ci test
         env:
           MOQ_STRICT: 1

.github/workflows/docker.yml

@@ -39,6 +39,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - id: parse
         env:
           CRATE: ${{ inputs.package }}
@@ -58,7 +60,7 @@ jobs:
             *) package="$crate" ;;
           esac
           echo "package=${package}" >> "$GITHUB_OUTPUT"
-          .github/scripts/release.sh parse-version "$crate"
+          just gh release parse-version "$crate"
 
   build:
     name: Build ${{ matrix.platform }}

.github/workflows/interop.yml

@@ -24,7 +24,7 @@ on:
       - "test/justfile"
       - "package.json"
       # The Go client builds against the modules this script stages.
-      - "go/scripts/**"
+      - "sh/go/**"
       - ".github/workflows/interop.yml"
 
 concurrency: