[kixelated]

Each nightly workflow now also runs on pull requests that touch its inputs, running only its cheapest useful subset. admin/structure and the unstable rustfmt check move into just ci. This finishes quest/m2/confidence/nightlies-on-prs.md and deletes it.

Changes

• just ci: a new structure module runs admin/structure when rind/src or the script changes. check:rs also runs cargo fmt --check with .rustfmt.unstable.toml through rustfmt-unstable, a flake wrapper around nightly-2025-02-14's rustfmt, the version lints.yml pinned. just fix applies it too.
• lints.yml: drops the two jobs that moved to just ci. aarch64 clippy runs on PRs that touch Rust sources, manifests, or the flake.
• ctgrind.yml: on PRs that touch rind/src, **/tests/ctgrind.rs, admin/ctgrind{,.supp}, the lock, or the flake, it runs only the x86_64 --release row of build. That row runs every suite, adapters included, and would have caught moq-dev/rind#482 and moq-dev/rind#459.
• build.yml: a changes job uses sh/changed.sh to decide which jobs a PR runs. armv7 runs on rind/src/low/arm/ or sh/armv7.sh (moq-dev/rind#458), portable on rind/src/low/portable/ or sh/portable.sh, and the Dart jobs (all six rows plus Android and iOS) on rind-dart/ (moq-dev/rind#462). The other jobs run only at night.
• mutants.yml: a PR that touches *.rs mutates its own diff against pull_request.base.sha (moq-dev/rind#455).
• timing.yml: a PR that touches rind-timing/, admin/timing, or the flake runs a smoke job, admin/timing dudect --list in .#timing. It checks that the shell and the build work (moq-dev/rind#483). The full timing run stays weekly.
• x86-cpu.yml: runs on PRs that touch rind/src. It is a single job, so there is no matrix to trim.
• fuzz.yml: PRs that touch fuzz/ or sh/fuzz-*.sh only build the targets. Fuzzing and replay need the nightly corpus.
• miri.yml (added in moq-dev/rind#569): runs on PRs that touch the portable backend or sh/miri.sh.
• CONTRIBUTING.md describes the PR runs and says they are advisory. A path-filtered workflow cannot be a required check.

Public API and wire impact: none.

Choices made without asking

• ctgrind-debug.yml stays weekly only. The PR's ctgrind row already covers the same tests in release.
• On PRs, fuzz builds the targets for all three architectures, not only x86_64. A job-level if cannot read the matrix, and each build is short and runs in parallel.
• asan and coverage stayed green in the audit and get no PR trigger.
• I gave the build.yml armv7 and portable jobs filters on their own backend directories, as the quest asked. A change in shared mid/high code does not trigger them, and the nightly still covers it.

Checks

• Merged main after moq-dev/rind#513; just check passes (structure, both fmt checks, clippy, nextest, dart, quest, gh, shell, nix).
• The new PR triggers ran: armv7 (zeroing cipher), the Dart rows (1 test), and ctgrind's x86_64 --release row (a definite leak under valgrind) fail. The same jobs fail on main's nightlies (build, ctgrind), so these are pre-existing failures the PR runs now surface, not regressions here. They are advisory checks.
• Those failures on main are now tracked by quest/m0/ctgrind-nightly.md (the ctgrind cause was the guard_pages harness, not a leak) and quest/m0/build-nightly.md (including portable's heap_scratch::detects_a_leak_in_key_generation, left to that quest).
• Merged main again at 6c73b15 after the merge queue hit a conflict; just check passes.

Caused by

No single PR. The nightlies have only ever run after merge.

Models

Size: S
Implementer: Claude Code, Opus 5.5, low effort

🤖 Generated with Claude Code

(Written by Opus 5.5 with low)

Review

Rewritten by quest review after each round.

• Reviewer: Codex, gpt-6.1-sol, medium effort
• Session: 01a1c7db-2d40-7012-a964-50465f29e6cf, round 2
• Head: afdfd70
• Base: origin/main at 916a43b
• Score: 10/10, Both previously reported CI scoping defects are fixed, and the incremental changes introduce no new findings.
• Findings: none
• The last round's findings, at 93c62a5:
  • Fixed: medium, .github/workflows/build.yml:12: Exclude the Windows job from unrelated pull-request runs; .github/workflows/build.yml now guards i686-windows with `if: github.event_name != 'pull_request'`, preventing unrelated PRs from running its suites.
  • Fixed: medium, sh/dispatch.sh:201: Select the formatter check when its unstable configuration changes; sh/dispatch.sh now matches .rustfmt.unstable.toml in the rs scope, and sh/select.sh selects the workspace for that configuration change, ensuring the unstable formatter check runs.
• Skipped re-review of 0e26368, a hand-resolved merge of main: its diff differs from the reviewed head's only by dropping the PR-skip if: on the wasm job main deleted (wasm now builds in just ci), re-wrapping the mutants.yml header comment around main's new SDE sentence, and dropping a quest README link main's list removal made obsolete.

[pullfrog]

Your OpenCode Go account is out of credit. Top it up, then re-trigger Pullfrog.

OpenCode Go's response

provider error: Insufficient balance. Top up at https://opencode.ai/console/wrk_01M28N93AE612R8VKHHW47PJER/billing?credits=1. (402)

Top up OpenCode Go →

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using glm-5.3}

[coderabbitai]

Pre-merge checks: 2

Failed checks: 2 inconclusive

Check name	Status	Explanation	Resolution
Title check		This assessment has not completed. The check will be retried on the next pre-merge check run.
Description check		This assessment has not completed. The check will be retried on the next pre-merge check run.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[moq-bot]

quest land watch: the merge queue removed this pull request at afdfd70 because it conflicts with main (merge_conflict).

The land fixer works on it in the background, and the watcher re-enqueues it at the back of the queue once it is fixed or judged flaky, or hands it back here with what it needs.

(written by quest land watch)

[moq-bot]

codex, gpt-6.1-sol, medium effort land fixer note:

The queue log reports:

CONFLICT (content): Merge conflict in .github/workflows/build.yml
CONFLICT (content): Merge conflict in .github/workflows/mutants.yml
Automatic merge failed; fix conflicts and then commit the result.

Merged base into this PR in dc4ac8009667fd3c49046d560303d9d9ad36ccaf. The resolution keeps the PR's selective pull-request jobs, preserves the base's move of WebAssembly checks into the main gate, and combines the mutation-testing comments. It edits the two protected workflow paths above and needs maintainer review.

Workflow linting, action pins, shell linting, Nix formatting, both Rust formatting checks, workspace Clippy, 888 tests, wipe tests, documentation tests, layer checks, supported-Rust-version checks, cross-target linting, and the variable-time scan passed. The complete gate was invoked as nix develop --command just ci base.

nix develop --command just portable reproduced the optional PR CI failure shown at supplied log lines 1296–1308:

note: test did not panic as expected at rind/tests/heap_scratch.rs:67:4
error: recipe portable failed on line 46 with exit code 101

The failed test is rind detects_a_leak_in_key_generation. Its debug run passes, but its portable release run fails. Adjusting the planted allocation or the test expectation would change test behavior, so it is left for review. No tests were disabled. This additional failure does not establish that the PR introduced it.

The complete gate reached Dart, then failed in test/hook_test.dart: builds from source for the host, listing its sources with TimeoutException after 0:00:30.000000: Test timed out after 30 seconds. Dart formatting and analysis passed. No timeout was changed.

Additional diagnostics: nix develop .#hol-light --command admin/prove bytes exited 141 without output. nix develop .#prove --command admin/prove lean is still extracting proofs. VALGRIND_BUG_494162=1 RIND_TEST_ARM_CRYPTO_EXT=1 RIND_TEST_ARM_SHA3=0 nix develop .#ctgrind --command admin/ctgrind --release reported uninitialised-value branches in the ABI harness, then automatically began its origin-tracking rerun. These additional diagnostics do not change the handback decision.

(written by codex, gpt-6.1-sol, medium effort)

[moq-bot]

codex, gpt-6.1-sol, medium effort land fixer: nix develop --command just portable failed: note: test did not panic as expected at rind/tests/heap_scratch.rs:67:4; fixing the release-mode leak-detection self-test needs a behavior decision.. Recommendation: Review and apply conflict-resolution commit dc4ac8009667fd3c49046d560303d9d9ad36ccaf, which edits protected .github/workflows/build.yml and .github/workflows/mutants.yml; repair the heap-scratch self-

The merge queue removed https://github.com/moq-dev/rind/pull/575 at afdfd70e361b104fab61d647804396dbbed883f3: it conflicts with main at 5a10403666a7d9596bc457c36ecabdce22d162da, even with the quest merge driver.

Auto-merging .github/workflows/build.yml
CONFLICT (content): Merge conflict in .github/workflows/build.yml
Auto-merging .github/workflows/mutants.yml
CONFLICT (content): Merge conflict in .github/workflows/mutants.yml
Auto-merging CONTRIBUTING.md
Auto-merging flake.nix
Auto-merging quest/m2/confidence/README.md
Auto-merging sh/dispatch.sh
Automatic merge failed; fix conflicts and then commit the result.

(written by codex, gpt-6.1-sol, medium effort)