ci: skip redundant diffr release builds and empty MIME tests

.github/workflows/diffr-release.yml

@@ -40,6 +40,8 @@ jobs:
       PYTHON: ${{ startsWith(matrix.os, 'windows') && 'python' || 'python3' }}
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version: 1.3.14
@@ -64,6 +66,14 @@ jobs:
           name: ${{ matrix.target }}
           path: diffr/dist/*.tar.gz
           if-no-files-found: error
+      - name: Upload Cargo build timings
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: diffr-release-timings-${{ matrix.target }}
+          path: diffr/target/cargo-timings
+          if-no-files-found: warn
+          retention-days: 7
 
   prepare:
     needs: build
@@ -73,8 +83,11 @@ jobs:
         working-directory: diffr
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
+          pattern: '{aarch64,x86_64}-*'
           path: diffr/dist
           merge-multiple: true
       - name: Generate checksums and Homebrew formula
@@ -104,6 +117,8 @@ jobs:
       HOMEBREW_NO_AUTO_UPDATE: '1'
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: release
@@ -152,19 +167,43 @@ jobs:
   approve:
     name: Approve diffr release
     if: github.event_name == 'push' && github.ref_type == 'tag'
-    needs: packaging
+    needs: [packaging, verify_crates]
     environment: review-release-approval
     runs-on: ubuntu-latest
     permissions: {}
     steps:
       - run: echo "Diffr release approved"
 
+  verify_crates:
+    name: Verify Cargo packages
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    defaults:
+      run:
+        shell: bash
+        working-directory: diffr
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@1.99.0
+      - name: Verify crates without publishing
+        run: cargo publish --locked --dry-run -p diffr-grammars -p diffr-core -p diffr-cli
+      - name: Record verified package checksums
+        run: |
+          sha256sum target/package/diffr-{grammars,core,cli}-*.crate > "$RUNNER_TEMP/diffr-crates.sha256"
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: diffr-crate-checksums
+          path: ${{ runner.temp }}/diffr-crates.sha256
+          retention-days: 7
+          if-no-files-found: error
+
   crates:
-    name: Verify and publish Cargo packages
-    needs: [packaging, approve]
-    # Manual runs validate packages without entering the publishing approval gate.
+    name: Publish Cargo packages
+    needs: [packaging, verify_crates, approve]
     if: >-
-      always() && needs.packaging.result == 'success' &&
+      always() && needs.packaging.result == 'success' && needs.verify_crates.result == 'success' &&
       (needs.approve.result == 'success' ||
        (github.event_name == 'workflow_dispatch' && needs.approve.result == 'skipped'))
     runs-on: ubuntu-22.04
@@ -175,9 +214,17 @@ jobs:
         working-directory: diffr
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@1.99.0
-      - name: Verify crates without publishing
-        run: cargo publish --locked --dry-run -p diffr-grammars -p diffr-core -p diffr-cli
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: diffr-crate-checksums
+          path: ${{ runner.temp }}
+      - name: Recreate and match verified packages without rebuilding
+        run: |
+          cargo publish --locked --dry-run --no-verify -p diffr-grammars -p diffr-core -p diffr-cli
+          sha256sum --check "$RUNNER_TEMP/diffr-crates.sha256"
       - name: Publish crates in dependency order
         if: github.event_name == 'push' && github.ref_type == 'tag'
         env:
@@ -194,7 +241,7 @@ jobs:
               "https://crates.io/api/v1/crates/$crate/$version")
             case "$status" in
               200) echo "$crate@$version is already published" ;;
-              404) cargo publish --locked -p "$crate" ;;
+              404) cargo publish --locked --no-verify -p "$crate" ;;
               *) echo "Could not check $crate@$version: HTTP $status" >&2; exit 1 ;;
             esac
           done
@@ -220,9 +267,10 @@ jobs:
           gh release edit "$RELEASE_TAG" --draft=false --latest=false
 
   npm:
-    needs: [packaging, crates, publish]
+    needs: [packaging, verify_crates, crates, publish]
     if: >-
-      always() && needs.packaging.result == 'success' && needs.crates.result == 'success' &&
+      always() && needs.packaging.result == 'success' && needs.verify_crates.result == 'success' &&
+      needs.crates.result == 'success' &&
       (needs.publish.result == 'success' || github.event_name == 'workflow_dispatch')
     defaults:
       run:
@@ -233,6 +281,8 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:

.github/workflows/diffr-test.yml

@@ -173,27 +173,6 @@ jobs:
       # The target matrix above exercises the embedded components.
       - run: cargo xtask test-plugins
 
-  test_mime_db:
-    name: Test with MIME database
-    runs-on: ubuntu-22.04
-    defaults:
-      run:
-        working-directory: diffr
-    steps:
-      # v4.2.2
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-        with:
-          persist-credentials: false
-      - uses: dtolnay/rust-toolchain@1.99.0
-        with:
-          targets: wasm32-wasip2
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-        with:
-          workspaces: diffr -> target
-          cache-workspace-crates: true
-      # This runs tests that rely on the MIME database being present.
-      - run: cargo test -- --ignored
-
   test_linux_latest_stable:
     name: Test Linux (latest stable Rust)
     if: github.event_name != 'pull_request'

diffr/xtask/src/main.rs

@@ -71,7 +71,7 @@ fn install(root: &Path, with_cli: bool) -> Result<()> {
         run(
             cargo()
                 .current_dir(root)
-                .args(["install", "--path", ".", "--locked", "--root"])
+                .args(["install", "--path", ".", "--locked", "--timings", "--root"])
                 .arg(&destination),
             "Installing diffr",
         )?;