ci.yml

name: CI

on:
  pull_request:
  # Required contexts must also report on the merge queue's temporary branch
  # (docs/dev/branch-protection.md, Merge queue).
  merge_group:
    types: [checks_requested]
  push:
    branches:
      - main
    tags:
      - "v*"
  workflow_dispatch:

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  # Keep main runs alive: their suite result is the post-merge detection
  # channel, and a cancelled job never reaches rust-cache's post-step save.
  # Superseded PR runs are safe to cancel.
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  # The one failpoint feature list `lint` and `test` both compile.
  FAILPOINT_FEATURES: omnigraph-engine/failpoints,omnigraph-cluster/failpoints

jobs:
  # One output per set of jobs: `run_full_ci` (engine input: every job),
  # `run_gqt` (also cases-only), `run_deployment` (also deployment-only);
  # classes in docs/dev/ci.md, pinned by scripts/check-change-classes.py.
  classify_changes:
    name: Classify Changes
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
    outputs:
      run_full_ci: ${{ steps.filter.outputs.run_full_ci }}
      run_gqt: ${{ steps.filter.outputs.run_gqt }}
      run_deployment: ${{ steps.filter.outputs.run_deployment }}
    steps:
      - name: Checkout source
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
        with:
          fetch-depth: 0

      - name: Classify changed paths
        id: filter
        env:
          BEFORE_SHA: ${{ github.event.before }}
          EVENT_NAME: ${{ github.event_name }}
          MERGE_GROUP_BASE_SHA: ${{ github.event.merge_group.base_sha }}
          MERGE_GROUP_HEAD_SHA: ${{ github.event.merge_group.head_sha }}
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          REF_TYPE: ${{ github.ref_type }}
        run: |
          set -euo pipefail

          # No diff to classify (dispatch, tag, unknown base, empty diff):
          # every job runs.
          run_everything() {
            printf 'run_full_ci=true\nrun_gqt=true\nrun_deployment=true\n' >> "$GITHUB_OUTPUT"
            exit 0
          }

          if [[ "$EVENT_NAME" == "workflow_dispatch" || "$REF_TYPE" == "tag" ]]; then
            run_everything
          fi

          if [[ "$EVENT_NAME" == "pull_request" ]]; then
            base="$PR_BASE_SHA"
            head="$PR_HEAD_SHA"
          elif [[ "$EVENT_NAME" == "merge_group" ]]; then
            base="$MERGE_GROUP_BASE_SHA"
            head="$MERGE_GROUP_HEAD_SHA"
          else
            base="$BEFORE_SHA"
            head="$GITHUB_SHA"
            if [[ "$base" == "0000000000000000000000000000000000000000" ]]; then
              base="$(git rev-parse "${head}^" 2>/dev/null || true)"
            fi
          fi

          if [[ -z "${base:-}" ]]; then
            run_everything
          fi

          # Merge base (a branch behind main must not inherit its newer files),
          # no rename collapsing (a source file moved into docs keeps its
          # deletion), no path quoting (a non-ASCII name reaches the arms raw).
          mapfile -t changed < <(git -c core.quotePath=false diff --name-only --no-renames --merge-base "$base" "$head")
          if [[ "${#changed[@]}" -eq 0 ]]; then
            run_everything
          fi

          run_full_ci=false
          run_gqt=false
          run_deployment=false
          for path in "${changed[@]}"; do
            case "$path" in
              docs/user/queries/catalogue.md) run_full_ci=true ;;
              docs/*.md|docs/*.mdx|docs/*.rst|docs/*.adoc|changelog.d/*.md|changelog.d/release.json) ;;
              README.md|AGENTS.md|CLAUDE.md|CHANGELOG.md|CONTRIBUTING.md|CODE_OF_CONDUCT.md) ;;
              LICENSE|LICENSE.md) ;;
              crates/omnigraph-gqt/cases/*.gqt) run_gqt=true ;;
              Dockerfile|.dockerignore|docker/*|deploy/*) run_deployment=true ;;
              *)
                run_full_ci=true
                ;;
            esac
          done

          if [[ "$run_full_ci" == "true" ]]; then
            run_gqt=true
            run_deployment=true
          fi

          printf 'Changed files:\n'
          printf '  %s\n' "${changed[@]}"
          printf 'run_full_ci=%s\nrun_gqt=%s\nrun_deployment=%s\n' \
            "$run_full_ci" "$run_gqt" "$run_deployment" | tee -a "$GITHUB_OUTPUT"

  check_agents_md:
    name: Check AGENTS.md Links
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - name: Checkout source
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
        with:
          # Release-note selection needs the configured previous release and
          # pinned migration source; the marker check still uses HEAD^1.
          fetch-depth: 0

      # Diff-scoped belt over check-docs.py's Markdown scan: flags only
      # conflict-marker lines this pull request ADDS, in any file type, via
      # git's own --check detector (which also respects conflict-marker-size
      # and catches a lone `=======` on added lines). Markers already on the
      # base branch never fail someone else's PR. Runs before the
      # documentation checks so hits are annotated inline even when the
      # Markdown scan would fail the job first.
      - name: Verify the PR adds no merge-conflict markers
        if: github.event_name == 'pull_request'
        run: |
          set -euo pipefail
          # `git diff --check` exits non-zero on findings, so the pipeline
          # needs the `|| true`; grep narrows to markers (drops whitespace
          # complaints). Output shape: path:line: leftover conflict marker
          hits=$(git diff --check HEAD^1 HEAD | grep 'leftover conflict marker' || true)
          if [ -n "$hits" ]; then
            printf '%s\n' "$hits" | while IFS=: read -r file line rest; do
              printf '::error file=%s,line=%s::Committed merge-conflict marker\n' "$file" "$line"
            done
            count=$(printf '%s\n' "$hits" | wc -l | tr -d ' ')
            echo "::error::this pull request adds $count merge-conflict marker line(s)"
            exit 1
          fi

      - name: Install pinned documentation parser
        run: |
          python3 -m venv "$RUNNER_TEMP/docs-venv"
          "$RUNNER_TEMP/docs-venv/bin/python" -m pip install --disable-pip-version-check -r scripts/requirements-docs.txt
          echo "$RUNNER_TEMP/docs-venv/bin" >> "$GITHUB_PATH"

      - name: Verify AGENTS.md ↔ docs/ cross-links
        run: bash scripts/check-agents-md.sh

      - name: Verify documentation structure and RFC registry
        run: python3 scripts/check-docs.py

      - name: Test release-note composition
        run: python3 scripts/test_release_notes.py

      - name: Test edge release decisions and text
        run: python3 scripts/test_edge_release.py

      - name: Render release-note preview
        run: python3 scripts/release_notes.py preview --target HEAD > "$RUNNER_TEMP/release-notes-preview.md"

      # The edge publisher composes its release text from this preview
      # (`scripts/edge_release.py body`), so a renderer change that breaks
      # the composer fails here, in its own pull request.
      - name: Compose edge release text from the preview
        run: |
          set -euo pipefail
          commit=0000000000000000000000000000000000000000
          printf '%s\n' "{\"version\":\"0.0.1-edge+0000000\",\"channel\":\"edge\",\"commit\":\"${commit}\",\"http_contract\":\"0.0\",\"internal_schema\":{\"writes\":1,\"serves\":[1,1]}}" \
            > "$RUNNER_TEMP/edge-version.json"
          python3 scripts/edge_release.py body --repository "$GITHUB_REPOSITORY" --commit "$commit" \
            --build-tag edge-20260101-0000000 --build-version "$RUNNER_TEMP/edge-version.json" \
            --notes "$RUNNER_TEMP/release-notes-preview.md" > /dev/null
          python3 scripts/edge_release.py body --repository "$GITHUB_REPOSITORY" --commit "$commit" \
            --build-tag edge-20260101-0000000 --build-version "$RUNNER_TEMP/edge-version.json" \
            --notes "$RUNNER_TEMP/release-notes-preview.md" --rolling > /dev/null

      - name: Upload release-note preview
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: release-notes-preview
          path: ${{ runner.temp }}/release-notes-preview.md
          if-no-files-found: error
          retention-days: 14

      # Spelling gate: docs/dev/ci.md, "Pull-request gates". typos also reads
      # a sibling typos.toml / _typos.toml, so refuse a second config first.
      - name: Refuse a second typos config
        run: |
          if [ -e typos.toml ] || [ -e _typos.toml ]; then
            echo "::error::every typos exemption lives in .typos.toml; remove typos.toml / _typos.toml"
            exit 1
          fi

      - name: Check spelling
        uses: crate-ci/typos@d43b6c087ac471e2ea7b8af622ff15f05c0c365b # v1.50.1

  workflow_action_pins:
    name: Check Workflow Action Pins
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout source
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1

      - name: Reject mutable external action refs
        run: python3 scripts/check-workflow-action-pins.py

      - name: Enforce release vocabulary gates
        run: python3 scripts/check-release-vocabulary-gates.py

      - name: Check required storage upgrade coverage
        run: python3 scripts/check-storage-upgrade-ci.py --self-test

      - name: Check required contexts report on the merge queue and the gate is wired
        run: python3 scripts/check-merge-group-triggers.py --self-test

      - name: Check the CI Gate verdict
        run: python3 scripts/ci_gate.py --self-test

      - name: Check required test cells exist in the sources
        run: python3 scripts/check-ci-cells.py --self-test

      - name: Assert the classification copies match this workflow
        run: |
          python3 scripts/check-classify-copy.py --self-test
          python3 scripts/check-classify-copy.py

      - name: Replay the classifier and check class reader closure
        run: |
          python3 scripts/check-change-classes.py --self-test
          python3 scripts/check-change-classes.py

  cargo_deny:
    name: Dependency Guard (cargo deny)
    # `deny.toml` is the allowlist for dependency sources, licenses, advisories
    # and version specs. The check reads `Cargo.lock`, the manifests and the
    # RustSec database, builds nothing, and runs on every pull request.
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - name: Checkout source
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1

      # cargo-deny skips a crate with no source: a path copy, a `[patch]`
      # path entry, or a config source replacement is refused here instead.
      - name: Check dependency sources
        run: python3 scripts/check-dependency-sources.py

      # `arguments` replaces the action's default `--all-features`; the
      # `[graph] all-features` line in `deny.toml` is what keeps the AWS
      # SDK crates in scope. `--locked` refuses a rewritable Cargo.lock.
      - name: Check dependency sources, advisories, licenses and bans
        uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
        with:
          command: check
          arguments: --locked

  azure_contract_guards:
    name: Azure Contract Guards
    needs: classify_changes
    # Reads the Dockerfile, the package workflow and the admission crates:
    # engine input or deployment files. Reporting context: not on the merge
    # queue's branch (docs/dev/branch-protection.md).
    if: github.event_name != 'merge_group' && needs.classify_changes.outputs.run_deployment == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout source
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1

      - name: Verify container and package binary sets match
        run: python3 scripts/check-container-binary-contract.py

      - name: Enforce Azure admission dependency direction
        run: python3 scripts/check-azure-admission-boundary.py

  graph_vocabulary_guard:
    name: Graph Vocabulary Guard
    # Keep this exact reporting context while it remains required by branch
    # protection, but do not run the substrate-sized audit on pull requests or
    # on the merge queue's branch (a skipped required job satisfies both). The
    # full audit still runs after merge, on tags, and by manual dispatch.
    if: github.event_name != 'pull_request' && github.event_name != 'merge_group'
    runs-on: ubuntu-latest
    env:
      # Single switch for the vocabulary audit, disabled by decision on
      # 2026-08-28. Set to "true" to re-enable every audit step at once (the
      # public-Rust tooling and all three checks are gated on it). The job
      # still runs its unit tests and reports success either way, so branch
      # protection and the exact-SHA release gates stay wired.
      VOCABULARY_AUDIT_ENABLED: "false"
    # A cold default + relevant all-features rustdoc pass over all nine public
    # library crates is substrate-sized. The first hosted run completed the
    # public-Rust step in 39 minutes, while the larger breaking-contract tree
    # was still compiling when a 45-minute whole-job bound cancelled it. Keep
    # current/base targets isolated for correctness and retain a finite cold-run
    # ceiling; the pinned-tool and build-target caches make warm runs cheaper.
    timeout-minutes: 75
    permissions:
      contents: read
    steps:
      - name: Checkout source and comparison history
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
        with:
          # `check` reads both the inventory and openapi.json from the exact
          # comparison commit. A shallow checkout could turn that proof into a
          # false missing-base failure.
          fetch-depth: 0

      - name: Install pinned toolchain
        run: rustup toolchain install

      - name: Resolve vocabulary comparison base
        id: comparison_base
        env:
          EVENT_NAME: ${{ github.event_name }}
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          PUSH_BEFORE_SHA: ${{ github.event.before }}
          REF_TYPE: ${{ github.ref_type }}
        run: |
          set -euo pipefail

          zero_sha=0000000000000000000000000000000000000000
          if [[ "$EVENT_NAME" == "pull_request" ]]; then
            base="$PR_BASE_SHA"
          elif [[ "$EVENT_NAME" == "push" && "$REF_TYPE" != "tag" && "$PUSH_BEFORE_SHA" != "$zero_sha" ]]; then
            base="$PUSH_BEFORE_SHA"
          else
            # Tag creation commonly reports an all-zero `before`, while a
            # manual run has no event base. Compare both with the checked-out
            # commit's first parent rather than inventing a mutable branch tip.
            base="$(git rev-parse "${GITHUB_SHA}^")"
          fi

          if [[ -z "${base:-}" || "$base" == "$zero_sha" ]]; then
            echo "::error::unable to resolve a vocabulary comparison base"
            exit 1
          fi
          git cat-file -e "${base}^{commit}"
          echo "sha=$base" >> "$GITHUB_OUTPUT"

      - name: Install public-Rust system dependencies
        if: env.VOCABULARY_AUDIT_ENABLED == 'true'
        run: |
          sudo apt-get update
          sudo apt-get install -y protobuf-compiler libprotobuf-dev

      - name: Restore pinned public-Rust tooling
        if: env.VOCABULARY_AUDIT_ENABLED == 'true'
        id: public_rust_tool_cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/.rustup/toolchains/nightly-2026-08-01-x86_64-unknown-linux-gnu
            ~/.rustup/update-hashes/nightly-2026-08-01-x86_64-unknown-linux-gnu
            ${{ runner.temp }}/cargo-public-api
          key: vocabulary-public-api-${{ runner.os }}-${{ runner.arch }}-nightly-2026-08-01-cargo-public-api-0.52.0-v1

      - name: Install exact public-Rust tooling
        if: env.VOCABULARY_AUDIT_ENABLED == 'true'
        id: public_rust_tool
        run: |
          set -euo pipefail

          rustup toolchain install nightly-2026-08-01 --profile minimal
          tool_root="$RUNNER_TEMP/cargo-public-api"
          tool="$tool_root/bin/cargo-public-api"
          if [[ ! -x "$tool" ]] || [[ "$($tool --version)" != "cargo-public-api 0.52.0" ]]; then
            CARGO_INSTALL_ROOT="$tool_root" \
              cargo install cargo-public-api --version 0.52.0 --locked
          fi
          [[ "$($tool --version)" == "cargo-public-api 0.52.0" ]]
          echo "binary=$tool" >> "$GITHUB_OUTPUT"

      - name: Cache public-Rust build data
        if: env.VOCABULARY_AUDIT_ENABLED == 'true'
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          workspaces: |
            . -> target/vocabulary-public-api
          key: vocabulary-public-api-nightly-2026-08-01-v1
          save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Test vocabulary guard
        run: cargo test -p omnigraph-vocabulary-guard --locked

      - name: Check OpenAPI and Rust-string vocabulary
        if: env.VOCABULARY_AUDIT_ENABLED == 'true'
        env:
          BASE_SHA: ${{ steps.comparison_base.outputs.sha }}
        run: |
          set -euo pipefail
          for surface in openapi rust-string; do
            cargo run -p omnigraph-vocabulary-guard --locked -- \
              check --surface "$surface" --base "$BASE_SHA" \
              --inventory tools/omnigraph-vocabulary-guard/graph-vocabulary-inventory.tsv \
              --openapi openapi.json
          done

      - name: Check public-Rust vocabulary
        if: env.VOCABULARY_AUDIT_ENABLED == 'true'
        env:
          BASE_SHA: ${{ steps.comparison_base.outputs.sha }}
          CARGO_PUBLIC_API: ${{ steps.public_rust_tool.outputs.binary }}
        run: |
          tool="${CARGO_PUBLIC_API:-cargo-public-api}"
          cargo run -p omnigraph-vocabulary-guard --locked -- \
            check --surface public-rust --base "$BASE_SHA" \
            --inventory tools/omnigraph-vocabulary-guard/graph-vocabulary-inventory.tsv \
            --cargo-public-api "$tool" \
            --public-api-target-dir target/vocabulary-public-api

  release_tag_after_vocabulary:
    name: Release tag after vocabulary audit
    needs: graph_vocabulary_guard
    if: github.event_name == 'push' && github.ref_type == 'tag' && startsWith(github.ref_name, 'v')
    # The called publisher attests its archives' build provenance.
    permissions:
      actions: read
      contents: write
      id-token: write
      attestations: write
    uses: ./.github/workflows/release.yml
    with:
      tag: ${{ github.ref_name }}
      source_ref: ${{ github.ref }}
      ci_run_id: ${{ format('{0}', github.run_id) }}
    secrets: inherit

  publish_tag_image_after_vocabulary:
    name: Publish tag image after vocabulary audit
    needs: graph_vocabulary_guard
    if: github.event_name == 'push' && github.ref_type == 'tag' && startsWith(github.ref_name, 'v')
    # The called publisher attests the pushed image's build provenance.
    permissions:
      actions: read
      contents: read
      packages: write
      id-token: write
      attestations: write
    uses: ./.github/workflows/publish-image.yml
    with:
      tag: ${{ github.ref_name }}
      source_ref: ${{ github.ref }}
      ci_run_id: ${{ format('{0}', github.run_id) }}
    secrets: inherit

  publish_tag_crates_after_vocabulary:
    name: Publish tag crates after vocabulary audit
    needs: graph_vocabulary_guard
    if: github.event_name == 'push' && github.ref_type == 'tag' && startsWith(github.ref_name, 'v')
    permissions:
      actions: read
      contents: read
    uses: ./.github/workflows/publish-crates.yml
    with:
      tag: ${{ github.ref_name }}
      source_ref: ${{ github.ref }}
      ci_run_id: ${{ format('{0}', github.run_id) }}
    secrets: inherit

  entrypoint_test:
    name: Container Entrypoint
    needs: classify_changes
    # Reporting context: not on the merge queue's branch (docs/dev/branch-protection.md).
    if: github.event_name != 'merge_group' && needs.classify_changes.outputs.run_deployment == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout source
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1

      - name: Verify omnigraph-server entrypoint arg composition
        run: sh docker/entrypoint_test.sh

      - name: Test non-destructive Azure validation mode
        run: sh deploy/azure/validate_test.sh

      - name: Test Azure bootstrap readiness and admission modes
        run: sh deploy/azure/bootstrap-entrypoint_test.sh

      - name: Build Azure bootstrap image from inherited non-root user
        run: sh deploy/azure/bootstrap_image_test.sh

  azure_deployment_validation:
    name: Azure Deployment Validation
    needs: classify_changes
    # Reporting context: not on the merge queue's branch (docs/dev/branch-protection.md).
    if: github.event_name != 'merge_group' && needs.classify_changes.outputs.run_deployment == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - name: Checkout source
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1

      - name: Compile Azure Bicep templates
        # Azure CLI 2.77.0 plus an explicit Bicep version. Both values are
        # immutable inputs; the command performs no Azure login or mutation.
        run: |
          docker run --rm \
            -v "$PWD:/work" \
            -w /work \
            mcr.microsoft.com/azure-cli:2.77.0@sha256:d41153958a61392a4c9db1591e33b533ca8ab8b59529d212d06bb6ec7e9c1f25 \
            sh -eu -c '
              az bicep install --version v0.46.1 >/dev/null
              az bicep build --file deploy/azure/foundation.bicep --stdout >/dev/null
              az bicep build --file deploy/azure/runtime.bicep --stdout >/dev/null
            '

  fmt:
    name: Format (rustfmt)
    needs: classify_changes
    # Own job so a fmt failure cannot mask the clippy result; fmt compiles
    # nothing, so no dep or cache steps.
    if: (github.event_name == 'pull_request' || github.event_name == 'merge_group') && needs.classify_changes.outputs.run_full_ci == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - name: Checkout source
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1

      # No dtolnay/rust-toolchain action (here or in `lint`): it exports
      # RUSTUP_TOOLCHAIN, overriding the toml pin. Bare install reads the
      # toml; explicit because rustup auto-install has changed across releases.
      - name: Install pinned toolchain
        run: rustup toolchain install

      - name: Check formatting
        run: cargo fmt --all --check

  lint:
    name: Lint (clippy)
    needs: classify_changes
    # PR and merge-queue gate. Lints stay `warn` in-tree; only this job denies,
    # so a new toolchain's lints cannot break local builds. Main-push runs
    # exist only to seed the cache (see save-if below).
    if: (github.event_name == 'pull_request' || github.event_name == 'merge_group' || (github.event_name == 'push' && github.ref == 'refs/heads/main')) && needs.classify_changes.outputs.run_full_ci == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 45
    permissions:
      contents: read
    env:
      CARGO_TERM_COLOR: always
      RUSTC_WRAPPER: sccache
      SCCACHE_GHA_ENABLED: "true"
      SCCACHE_GHA_RW_MODE: ${{ github.ref == 'refs/heads/main' && 'READ_WRITE' || 'READ_ONLY' }}
    steps:
      - name: Checkout source
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y protobuf-compiler libprotobuf-dev

      # See the toolchain note in `fmt`. Before the cache step so the cache
      # key sees the pinned rustc.
      - name: Install pinned toolchain
        run: rustup toolchain install

      - name: Cache Rust build data
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          workspaces: |
            . -> target
          key: lint
          # Save only from main: a save from any other ref (a PR branch, a
          # tag) is restorable by no PR and only evicts shared entries. Save
          # even when the job is red: dependency artifacts are valid whatever
          # the verdict, and a red seed run would otherwise leave every PR
          # cold until main is green again.
          save-if: ${{ github.ref == 'refs/heads/main' }}
          cache-on-failure: true

      # sccache fetches unchanged dependency compiles when rust-cache misses
      # (docs/dev/ci.md, Full correctness graphs).
      - name: Run sccache
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9
        with:
          version: "v0.16.0"

      - name: Clippy (default features)
        run: cargo clippy --workspace --all-targets --locked -- -D warnings -W clippy::dbg_macro

      # Feature-gated code is invisible to the default build.
      - name: Clippy (failpoints superset)
        run: |
          cargo clippy --workspace --all-targets --locked \
            --features "$FAILPOINT_FEATURES" \
            -- -D warnings -W clippy::dbg_macro

  test:
    name: Test Workspace
    needs: classify_changes
    # Blocks main through CI Gate (docs/dev/ci.md, Full correctness graphs): fail-fast on
    # pull requests and the merge queue, `--no-fail-fast` on main, tags and
    # dispatch (the run step below; the main run also seeds the cache).
    if: needs.classify_changes.outputs.run_full_ci == 'true'
    runs-on: ubuntu-latest
    # The 2026-07-28 cold diagnostic spent 25m29s on the featureless workspace
    # graph, then another 23m21s compiling the failpoints graph. Build the
    # current tree once with the feature superset instead. The predecessor
    # binary/fence and RustFS shards are independent parallel jobs below, so
    # this job has one current-tree compile and a bounded 60-minute ceiling.
    timeout-minutes: 60
    permissions:
      contents: read
    env:
      CARGO_TERM_COLOR: always
      # Floor for the whole class of debug-build async stack depth, NOT the fix
      # for any one test. Unoptimized builds keep every nested async frame, so
      # a deep engine path (init -> write -> publish -> recovery -> Lance) can
      # approach a default 2 MiB spawned-thread stack. The depth is genuinely
      # environment-sensitive: the same tree overflowed `write_cost` on this
      # Linux runner while macOS stayed under. Individual offenders are still
      # fixed at
      # the source with `Box::pin` (see `helpers::cost::cost_harness`); this
      # keeps CI deterministic across runners while that work continues.
      RUST_MIN_STACK: 16777216
      RUSTC_WRAPPER: sccache
      SCCACHE_GHA_ENABLED: "true"
      SCCACHE_GHA_RW_MODE: ${{ github.ref == 'refs/heads/main' && 'READ_WRITE' || 'READ_ONLY' }}
    steps:
      - name: Checkout source
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y protobuf-compiler libprotobuf-dev

      - name: Install pinned toolchain
        run: rustup toolchain install

      # The run step schedules the test binaries through nextest; the binary
      # version is pinned so the hosted scheduler matches a local run.
      - name: Install cargo-nextest
        uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2.87.27
        with:
          tool: cargo-nextest@0.9.143

      - name: Cache Rust build data
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          workspaces: |
            . -> target
          # Save only from main, red or green (same rule as `lint`).
          save-if: ${{ github.ref == 'refs/heads/main' }}
          cache-on-failure: true

      # sccache fetches unchanged dependency compiles when rust-cache misses
      # (docs/dev/ci.md, Full correctness graphs).
      - name: Run sccache
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9
        with:
          version: "v0.16.0"

      # GQ Logic Tests owns GQT in both build shapes, including its DST runtime;
      # dst.yml owns the DST suite (excluded by name: with the workspace
      # `--cfg tokio_unstable` it no longer compiles empty here).
      # The run step reuses these binaries (same flags, features, and env).
      - name: Compile the workspace and failpoint test graph
        run: |
          cargo test --workspace --exclude omnigraph-gqt --exclude omnigraph-gqt-served --exclude omnigraph-dst --locked --no-run --timings \
            --features "$FAILPOINT_FEATURES"

      - name: Verify catalogue inventories against the built CLI
        run: python3 scripts/check-catalogue-docs.py --binary target/debug/omnigraph

      - name: Install genuine v0.9 release for upgrade regression
        run: |
          set -euo pipefail
          v09_dir="$RUNNER_TEMP/omnigraph-v09"
          # The installer downloads the official archive and verifies its
          # SHA256 before extraction. An exact VERSION never falls back to edge.
          REPO_SLUG=ModernRelay/omnigraph VERSION=v0.9.0 INSTALL_DIR="$v09_dir" \
            bash scripts/install.sh
          test -x "$v09_dir/omnigraph"
          [[ "$("$v09_dir/omnigraph" --version)" == "omnigraph 0.9.0" ]] \
            || { echo "::error::upgrade regression requires the genuine v0.9.0 CLI"; exit 1; }
          echo "OMNIGRAPH_V09_BIN=$v09_dir/omnigraph" >> "$GITHUB_ENV"

      - name: Install genuine v0.10 release for the v6 format fence
        run: |
          set -euo pipefail
          v6_dir="$RUNNER_TEMP/omnigraph-v010"
          # 0.10.0, the last release that writes internal schema v6
          REPO_SLUG=ModernRelay/omnigraph VERSION=v0.10.0 INSTALL_DIR="$v6_dir" \
            bash scripts/install.sh
          test -x "$v6_dir/omnigraph"
          [[ "$("$v6_dir/omnigraph" --version)" == "omnigraph 0.10.0" ]] \
            || { echo "::error::the v6 format fence requires the genuine v0.10.0 CLI"; exit 1; }
          echo "OMNIGRAPH_V6_BIN=$v6_dir/omnigraph" >> "$GITHUB_ENV"

      - name: Run workspace and failpoint tests once
        run: |
          set -euo pipefail
          # A pull request and a merge-queue entry are gates: stop at the
          # first red suite. Main, tag, and dispatch runs are detection
          # channels: --no-fail-fast, so every independent failure is reported.
          no_fail_fast=()
          if [[ "$GITHUB_EVENT_NAME" != "pull_request" && "$GITHUB_EVENT_NAME" != "merge_group" ]]; then
            no_fail_fast+=(--no-fail-fast)
          fi
          # nextest runs every test of every binary through one scheduler, a
          # process per test, so the process-bound journeys overlap instead of
          # draining one binary at a time. The `ci` profile
          # (.config/nextest.toml) writes the JUnit report with captured
          # output; the owner check below reads it in place of a log.
          # Warm the executables built by the preceding debug test build.
          target/debug/omnigraph-bench --version
          target/debug/omnigraph --version
          cargo nextest run --workspace --exclude omnigraph-gqt --exclude omnigraph-gqt-served --exclude omnigraph-dst --locked \
            --profile ci ${no_fail_fast[@]+"${no_fail_fast[@]}"} \
            --features "$FAILPOINT_FEATURES"
          # nextest runs no doctest; `cargo test` did. Keep that owner on the
          # same graph so a future doctest still runs here.
          cargo test --workspace --exclude omnigraph-gqt --exclude omnigraph-gqt-served --exclude omnigraph-dst --locked --doc \
            ${no_fail_fast[@]+"${no_fail_fast[@]}"} \
            --features "$FAILPOINT_FEATURES"
          # The two upgrade journeys and these real CLI/server/proxy journeys
          # must execute in the ordinary workspace gate. A removed, filtered or
          # re-ignored owner is not green, and a journey that skipped its
          # released binary is not green either. The live-apply journey
          # (`cluster_e2e_live_apply_changes_schema_queries_and_adds_graph_without_restart`)
          # waits on the CLI's real 500 ms poll interval for about 30 s, so it
          # is a `nightly:` owner of `tests-slow-nightly.yml` instead. The
          # owners are modules of the CLI's `integration` binary, so nextest
          # reports each as `<module>::<name>`.
          owners=()
          for test_name in \
            crossversion_upgrade::current_v10_refuses_and_rebuilds_genuine_v09_graph_end_to_end \
            crossversion_upgrade::current_v10_refuses_and_rebuilds_genuine_v6_and_v6_refuses_v10 \
            system_remote::remote_server_and_cli_end_to_end_flow \
            system_remote::remote_schema_apply_refuses_additive_change_for_cluster_backed_graph \
            system_remote::remote_schema_apply_refuses_incompatible_change_for_cluster_backed_graph \
            system_remote::remote_schema_apply_refuses_branched_cluster_backed_graph \
            system_remote::remote_read_preserves_projection_order_in_json_and_csv \
            system_remote::remote_branch_create_list_merge_flow \
            system_remote::remote_merge_delivery_loss_never_replays_committed_effect \
            system_remote::remote_blob_write_delivery_loss_never_replays_committed_effect \
            system_remote::remote_merge_statement_delivery_loss_never_replays_committed_effect \
            system_remote::remote_deployment_delivery_loss_preserves_owned_completion \
            system_remote::remote_branch_delete_removes_branch \
            system_remote::remote_export_round_trips_full_branch_graph \
            system_remote::remote_ingest_creates_review_branch_and_keeps_it_readable \
            system_remote::remote_load_round_trips_and_requires_from_for_new_branches \
            system_remote::remote_ingest_reuses_existing_branch_and_merges_updates \
            system_remote::remote_policy_enforces_branch_first_cli_workflow \
            system_remote::graphs_list_against_multi_graph_server \
            system_remote::mutate_if_commit_lost_cas_exits_4_issue_365
          do
            owners+=(--passed "$test_name")
          done
          python3 scripts/check-workspace-test-owners.py target/nextest/ci/junit.xml \
            "${owners[@]}" \
            --output-lacks "crossversion_upgrade::current_v10_refuses_and_rebuilds_genuine_v09_graph_end_to_end=skipping v0.9 upgrade e2e:" \
            --output-has "crossversion_upgrade::current_v10_refuses_and_rebuilds_genuine_v09_graph_end_to_end=v0.9 refusal and export/import rebuild completed" \
            --output-lacks "crossversion_upgrade::current_v10_refuses_and_rebuilds_genuine_v6_and_v6_refuses_v10=skipping immediate-predecessor v6 upgrade test"

      # Kept on every run, red or green: per-test durations and the compile's
      # unit timings are what a change to this job's scheduling is sized from.
      - name: Retain the nextest JUnit report
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: test-workspace-junit
          path: target/nextest/ci/junit.xml
          if-no-files-found: warn
          retention-days: 14
          overwrite: true

      - name: Retain Cargo build timings
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: test-workspace-build-timings
          path: target/cargo-timings/*.html
          if-no-files-found: warn
          retention-days: 14
          overwrite: true



  storage_upgrade_compatibility:
    name: Storage Upgrade Compatibility
    runs-on: ubuntu-latest
    # Three builds use one target directory here: genuine stamp-13 and
    # Lance 11 predecessor CLIs (one package, one bin, no test features),
    # then the current tree's test targets. Their dependency feature sets differ (the
    # test builds enable dev-dependency features such as lance-io's defaults
    # and test-util), so the second build reuses only the dependency artifacts
    # whose features match. The v5 fence measured a cold predecessor CLI at
    # 25m40s.
    timeout-minutes: 120
    permissions:
      contents: read
    env:
      CARGO_TERM_COLOR: always
      RUST_MIN_STACK: 16777216
      # A missing predecessor binary fails the genuine journey instead of
      # skipping it: this context is required on every change.
      OMNIGRAPH_REQUIRE_STORAGE_UPGRADE_TESTS: '1'
      RUSTC_WRAPPER: sccache
      SCCACHE_GHA_ENABLED: "true"
      SCCACHE_GHA_RW_MODE: ${{ github.ref == 'refs/heads/main' && 'READ_WRITE' || 'READ_ONLY' }}
    steps:
      - name: Checkout source
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y protobuf-compiler libprotobuf-dev

      - name: Install pinned toolchain
        run: rustup toolchain install

      - name: Cache Rust build data
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          workspaces: |
            . -> target
          save-if: ${{ github.ref == 'refs/heads/main' }}
          cache-on-failure: true

      # sccache fetches unchanged dependency compiles when rust-cache misses
      # (docs/dev/ci.md, Full correctness graphs).
      - name: Run sccache
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9
        with:
          version: "v0.16.0"

      - name: Check storage compatibility gate configuration
        run: python3 scripts/check-storage-upgrade-ci.py --self-test

      # The genuine predecessors of the release route (`omnigraph upgrade`,
      # storage format 8 or 9 to 14): v0.11.0 writes stamp 9 and converts a
      # v0.10.0 graph to stamp 8. The release assets are trusted exactly as
      # the `test` job's v0.9.0 and v0.10.0 installs trust them: `install.sh`
      # verifies the archive against the `.sha256` published beside it, and
      # no digest is pinned here.
      - name: Install released v0.10.0 and v0.11.0 CLIs
        run: |
          set -euo pipefail
          v6_dir="$RUNNER_TEMP/omnigraph-v010"
          v011_dir="$RUNNER_TEMP/omnigraph-v011"
          # The installer downloads the official archive and verifies its
          # SHA256 before extraction. An exact VERSION never falls back to edge.
          # A failed download leaves nothing behind, so each release gets three
          # attempts before this blocking job fails.
          install_release() {
            for attempt in 1 2 3; do
              REPO_SLUG=ModernRelay/omnigraph VERSION="$1" INSTALL_DIR="$2" \
                bash scripts/install.sh && return 0
              echo "install of $1 failed on attempt $attempt/3; retrying"
              sleep 10
            done
            return 1
          }
          install_release v0.10.0 "$v6_dir"
          test -x "$v6_dir/omnigraph"
          [[ "$("$v6_dir/omnigraph" --version)" == "omnigraph 0.10.0" ]] \
            || { echo "::error::the storage upgrades of a 0.10.0 graph require the genuine v0.10.0 CLI"; exit 1; }
          install_release v0.11.0 "$v011_dir"
          test -x "$v011_dir/omnigraph"
          [[ "$("$v011_dir/omnigraph" --version)" == "omnigraph 0.11.0" ]] \
            || { echo "::error::the release storage upgrade requires the genuine v0.11.0 CLI"; exit 1; }
          echo "OMNIGRAPH_V6_BIN=$v6_dir/omnigraph" >> "$GITHUB_ENV"
          echo "OMNIGRAPH_V011_BIN=$v011_dir/omnigraph" >> "$GITHUB_ENV"

      # The genuine stamp-13 predecessor for the main-build in-place route
      # (`omnigraph upgrade`, storage format 13 to 14). Keep this immutable:
      # HEAD^ is not a stable format reference, and the last main commit that
      # wrote stamp 13 is the source the journey converts.
      - name: Build genuine stamp-13 CLI
        env:
          STAMP_13_SOURCE_COMMIT: c0a4519f38d65dc1356728981983da8b096cfbef
        run: |
          set -euo pipefail
          v13_source="$RUNNER_TEMP/omnigraph-stamp-13"
          v13_bin="$RUNNER_TEMP/omnigraph-stamp-13-bin"
          git fetch --no-tags --depth=1 origin "$STAMP_13_SOURCE_COMMIT"
          git worktree add --detach "$v13_source" "$STAMP_13_SOURCE_COMMIT"
          cargo build --locked \
            --manifest-path "$v13_source/Cargo.toml" \
            --package omnigraph-cli \
            --bin omnigraph \
            --target-dir "$GITHUB_WORKSPACE/target"
          cp "$GITHUB_WORKSPACE/target/debug/omnigraph" "$v13_bin"
          test -x "$v13_bin"
          # Clean path-package artifacts through both workspace manifests while
          # retaining shared registry dependencies: the predecessor and current
          # packages share names and versions, so either manifest alone can
          # miss a stale path identity and link the wrong rlib.
          cargo clean --workspace --locked \
            --manifest-path "$v13_source/Cargo.toml" \
            --target-dir "$GITHUB_WORKSPACE/target"
          cargo clean --workspace --locked \
            --target-dir "$GITHUB_WORKSPACE/target"
          echo "OMNIGRAPH_V13_BIN=$v13_bin" >> "$GITHUB_ENV"

      # Same graph format, genuinely older substrate. A version label alone
      # cannot distinguish this writer from the candidate, so pin its source.
      - name: Build genuine Lance 11 CLI
        env:
          LANCE11_SOURCE_COMMIT: 0a62bb7b2aa5b99b012f413807c216277f7f9596
        run: |
          set -euo pipefail
          lance11_source="$RUNNER_TEMP/omnigraph-lance-11"
          lance11_bin="$RUNNER_TEMP/omnigraph-lance-11-bin"
          git fetch --no-tags --depth=1 origin "$LANCE11_SOURCE_COMMIT"
          git worktree add --detach "$lance11_source" "$LANCE11_SOURCE_COMMIT"
          test "$(git -C "$lance11_source" rev-parse HEAD)" = "$LANCE11_SOURCE_COMMIT"
          # Run inside the predecessor checkout so its workspace configuration applies.
          (cd "$lance11_source" && cargo build --locked \
            --package omnigraph-cli \
            --bin omnigraph \
            --target-dir "$GITHUB_WORKSPACE/target")
          cp "$GITHUB_WORKSPACE/target/debug/omnigraph" "$lance11_bin"
          test -x "$lance11_bin"
          # Remove both path-package identities before linking the candidate tests.
          cargo clean --workspace --locked \
            --manifest-path "$lance11_source/Cargo.toml" \
            --target-dir "$GITHUB_WORKSPACE/target"
          cargo clean --workspace --locked \
            --target-dir "$GITHUB_WORKSPACE/target"
          echo "OMNIGRAPH_LANCE11_BIN=$lance11_bin" >> "$GITHUB_ENV"

      # The owner is the `crossversion_upgrade` module of the CLI's
      # `integration` binary. The exact case names come from the compiled
      # inventory (`-- --list` on the same feature graph, so a valid test the
      # checker's source regex cannot see is still selected), filtered to the
      # module's `storage_upgrade` cases and written to a file first, so a
      # failed generator fails the step instead of becoming an empty filter
      # list; the checker requires every source-derived name in that listing
      # and the log to equal the file. `crossversion_upgrade::` alone would
      # add the module's other journeys.
      - name: Run required storage upgrade crossversion tests
        run: |
          set -euo pipefail
          test_log="$RUNNER_TEMP/storage-upgrade-crossversion.log"
          list_log="$RUNNER_TEMP/storage-upgrade-crossversion-list.log"
          cases_file="$RUNNER_TEMP/storage-upgrade-crossversion-cases.txt"
          cargo test --workspace --exclude omnigraph-gqt --exclude omnigraph-gqt-served --exclude omnigraph-dst --locked --test integration --features "$FAILPOINT_FEATURES" crossversion_upgrade:: -- --list 2>&1 | tee "$list_log"
          python3 scripts/check-storage-upgrade-ci.py --list-cases crossversion --compiled "$list_log" > "$cases_file"
          mapfile -t cases < "$cases_file"
          [ "${#cases[@]}" -gt 0 ] || { echo "::error::the crossversion storage upgrade inventory is empty"; exit 1; }
          cargo test --workspace --exclude omnigraph-gqt --exclude omnigraph-gqt-served --exclude omnigraph-dst --locked --test integration --features "$FAILPOINT_FEATURES" -- --exact --test-threads=1 "${cases[@]}" 2>&1 | tee "$test_log"
          python3 scripts/check-storage-upgrade-ci.py --check-log crossversion "$test_log" --cases "$cases_file"

      - name: Run required storage upgrade engine tests
        run: |
          set -euo pipefail
          test_log="$RUNNER_TEMP/storage-upgrade-engine.log"
          cargo test --workspace --exclude omnigraph-gqt --exclude omnigraph-gqt-served --exclude omnigraph-dst --locked --lib --features "$FAILPOINT_FEATURES" db::upgrade::tests -- --test-threads=1 2>&1 | tee "$test_log"
          python3 scripts/check-storage-upgrade-ci.py --check-log engine "$test_log"

      - name: Run required storage upgrade lance tests
        run: |
          set -euo pipefail
          test_log="$RUNNER_TEMP/storage-upgrade-lance.log"
          cargo test --workspace --exclude omnigraph-gqt --exclude omnigraph-gqt-served --exclude omnigraph-dst --locked --test integration --features "$FAILPOINT_FEATURES" lance_version_columns:: -- --test-threads=1 2>&1 | tee "$test_log"
          python3 scripts/check-storage-upgrade-ci.py --check-log lance "$test_log"

      - name: Run required storage upgrade protocol tests
        run: |
          set -euo pipefail
          test_log="$RUNNER_TEMP/storage-upgrade-protocol.log"
          cargo test --workspace --exclude omnigraph-gqt --exclude omnigraph-gqt-served --exclude omnigraph-dst --locked --test forbidden_apis --features "$FAILPOINT_FEATURES" -- --test-threads=1 2>&1 | tee "$test_log"
          python3 scripts/check-storage-upgrade-ci.py --check-log protocol "$test_log"

  v5_v10_format_fence:
    name: V5 ↔ V10 Format Fence
    needs: classify_changes
    # Pull requests too, as a reporting context: a fence red reports on the
    # pull request instead of first appearing on `main`.
    # Not on the merge queue's branch: the queue merges on the required
    # contexts alone, so a reporting run there would finish after the merge.
    if: github.event_name != 'merge_group' && needs.classify_changes.outputs.run_full_ci == 'true'
    runs-on: ubuntu-latest
    # This job owns the immutable predecessor build in parallel with the
    # current-tree workspace job. The 2026-07-28 cold measurement was 25m40s
    # for the predecessor CLI; exact current-CLI fence compilation reuses the same locked
    # dependency graph and retains bounded headroom here.
    timeout-minutes: 60
    permissions:
      contents: read
    env:
      CARGO_TERM_COLOR: always
      RUST_MIN_STACK: 16777216
      RUSTC_WRAPPER: sccache
      SCCACHE_GHA_ENABLED: "true"
      SCCACHE_GHA_RW_MODE: ${{ github.ref == 'refs/heads/main' && 'READ_WRITE' || 'READ_ONLY' }}
    steps:
      - name: Checkout source
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y protobuf-compiler libprotobuf-dev

      - name: Install pinned toolchain
        run: rustup toolchain install

      - name: Cache cross-version build data
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          workspaces: |
            . -> target
          key: crossversion-v5-v10
          save-if: ${{ github.ref == 'refs/heads/main' }}
          cache-on-failure: true

      # sccache fetches unchanged dependency compiles when rust-cache misses
      # (docs/dev/ci.md, Full correctness graphs).
      - name: Run sccache
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9
        with:
          version: "v0.16.0"

      # CI pins only the immediate predecessor. Older seams remain env-gated
      # and on-demand, per docs/dev/testing.md.
      - name: Build genuine final-v5 CLI
        env:
          # Final v5-writing main commit immediately before RFC-023 activated
          # the exact non-null `id` primary-key contract in v6. Keep this
          # immutable: HEAD^ is not a stable format reference.
          FINAL_INTERNAL_V5_COMMIT: 46b6d9084fb629b88d4ac9e8c546e0a30d213d19
        run: |
          set -euo pipefail
          v5_source="$RUNNER_TEMP/omnigraph-final-v5"
          v5_bin="$RUNNER_TEMP/omnigraph-final-v5-bin"
          git fetch --no-tags --depth=1 origin "$FINAL_INTERNAL_V5_COMMIT"
          git worktree add --detach "$v5_source" "$FINAL_INTERNAL_V5_COMMIT"
          cargo build --locked \
            --manifest-path "$v5_source/Cargo.toml" \
            --package omnigraph-cli \
            --bin omnigraph \
            --target-dir "$GITHUB_WORKSPACE/target"
          cp "$GITHUB_WORKSPACE/target/debug/omnigraph" "$v5_bin"
          test -x "$v5_bin"
          # Clean path-package artifacts through both workspace manifests while
          # retaining shared registry dependencies. The predecessor and current
          # packages have the same names+versions, so either manifest alone can
          # miss a stale path identity and make the fence link the wrong rlib.
          cargo clean --workspace --locked \
            --manifest-path "$v5_source/Cargo.toml" \
            --target-dir "$GITHUB_WORKSPACE/target"
          cargo clean --workspace --locked \
            --target-dir "$GITHUB_WORKSPACE/target"
          echo "OMNIGRAPH_V5_BIN=$v5_bin" >> "$GITHUB_ENV"

      - name: Run exact v5↔v10 refusal and rebuild fence
        run: |
          set -euo pipefail
          test_log="$RUNNER_TEMP/v5-v10-format-fence.log"
          cargo test --locked -p omnigraph-cli --test integration \
            crossversion_upgrade::current_v10_refuses_and_rebuilds_genuine_v5_and_v5_refuses_v10 \
            -- --exact --nocapture 2>&1 | tee "$test_log"
          if grep -Fq "skipping immediate-predecessor v5 upgrade test" "$test_log"; then
            echo "::error::v5↔v10 format fence skipped despite a configured predecessor binary"
            exit 1
          fi
          grep -Eq "test crossversion_upgrade::current_v10_refuses_and_rebuilds_genuine_v5_and_v5_refuses_v10 \.\.\. ok" "$test_log" \
            || { echo "::error::exact v5↔v10 format fence did not execute normally"; exit 1; }
          grep -Eq "test result: ok\. 1 passed; 0 failed" "$test_log" \
            || { echo "::error::v5↔v10 format fence matched the wrong test set"; exit 1; }

  test_aws_feature:
    name: Test omnigraph-server --features aws
    needs: classify_changes
    runs-on: ubuntu-latest
    # Blocks main through CI Gate; its cache saves only from main: a cold main run
    # that outruns the ceiling is cancelled before the save and every PR
    # stays cold (the dst.yml lesson). Sized for a cold dependency graph.
    timeout-minutes: 60
    permissions:
      contents: read
    env:
      CARGO_TERM_COLOR: always
      RUSTC_WRAPPER: sccache
      SCCACHE_GHA_ENABLED: "true"
      SCCACHE_GHA_RW_MODE: ${{ github.ref == 'refs/heads/main' && 'READ_WRITE' || 'READ_ONLY' }}
    steps:
      - name: Skip when no engine input changed
        if: needs.classify_changes.outputs.run_full_ci != 'true'
        run: echo "No engine input changed; skipping aws feature build."

      - name: Checkout source
        if: needs.classify_changes.outputs.run_full_ci == 'true'
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1

      - name: Install system dependencies
        if: needs.classify_changes.outputs.run_full_ci == 'true'
        run: |
          sudo apt-get update
          sudo apt-get install -y protobuf-compiler libprotobuf-dev

      - name: Install pinned toolchain
        if: needs.classify_changes.outputs.run_full_ci == 'true'
        run: rustup toolchain install

      - name: Cache Rust build data
        if: needs.classify_changes.outputs.run_full_ci == 'true'
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          workspaces: |
            . -> target
          key: aws-feature
          # Save only from main, red or green (same rule as `lint`).
          save-if: ${{ github.ref == 'refs/heads/main' }}
          cache-on-failure: true

      # sccache fetches unchanged dependency compiles when rust-cache misses
      # (docs/dev/ci.md, Full correctness graphs).
      - name: Run sccache
        if: needs.classify_changes.outputs.run_full_ci == 'true'
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9
        with:
          version: "v0.16.0"

      - name: Build omnigraph-server with aws feature
        if: needs.classify_changes.outputs.run_full_ci == 'true'
        run: cargo build --locked -p omnigraph-server --features aws

      - name: Test omnigraph-server with aws feature
        if: needs.classify_changes.outputs.run_full_ci == 'true'
        env:
          RUST_MIN_STACK: 16777216
        run: cargo test --locked -p omnigraph-server --features aws

  rustfs_integration:
    name: RustFS S3 Integration (${{ matrix.shard }})
    # Pull requests too, as a reporting context, same reason as the format
    # fence: the configured S3 owners run nowhere else. Independent of the
    # workspace job on purpose: both cold compile graphs start together.
    #
    # Two parallel feature graphs: the default graph compiles every selected
    # engine/server/cluster/CLI test binary in one Cargo invocation, while the
    # failpoints graph stays isolated. Presenting the full default DAG together
    # avoids discovering it as a serial compile/link waterfall. The previous
    # five-shard layout repeated the same ~26-29m cold substrate compile five
    # times and maintained five target caches, pressuring GitHub's repository
    # cache cap. `fail-fast: false` lets both graphs report independently.
    # Not on the merge queue's branch, same reason as the format fence.
    needs: classify_changes
    if: github.event_name != 'merge_group' && needs.classify_changes.outputs.run_full_ci == 'true'
    runs-on: ubuntu-latest
    # Same ceiling as `Test Workspace`: a pull request that bumps the substrate
    # compiles this graph cold too, and a timeout red names no test.
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        shard:
          - default
          - failpoints
    permissions:
      contents: read
    env:
      AWS_ACCESS_KEY_ID: omnigraphci
      AWS_SECRET_ACCESS_KEY: omnigraphci-secret
      AWS_REGION: us-east-1
      AWS_ENDPOINT_URL: http://127.0.0.1:9000
      AWS_ENDPOINT_URL_S3: http://127.0.0.1:9000
      AWS_ALLOW_HTTP: "true"
      AWS_S3_FORCE_PATH_STYLE: "true"
      OMNIGRAPH_S3_TEST_BUCKET: omnigraph-ci
      OMNIGRAPH_S3_TEST_PREFIX: github-actions
      CARGO_TERM_COLOR: always
      RUST_MIN_STACK: 16777216
      RUSTC_WRAPPER: sccache
      SCCACHE_GHA_ENABLED: "true"
      SCCACHE_GHA_RW_MODE: ${{ github.ref == 'refs/heads/main' && 'READ_WRITE' || 'READ_ONLY' }}
    steps:
      - name: Checkout source
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y protobuf-compiler libprotobuf-dev python3-pip

      - name: Install pinned toolchain
        run: rustup toolchain install

      - name: Cache Rust build data
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          # One cache per feature graph avoids both feature thrash and the
          # previous five copies of the shared substrate.
          key: ${{ matrix.shard }}
          workspaces: |
            . -> target
          save-if: ${{ github.ref == 'refs/heads/main' }}
          # A red `main` run still seeds the cache pull requests restore.
          cache-on-failure: true

      # sccache fetches unchanged dependency compiles when rust-cache misses
      # (docs/dev/ci.md, Full correctness graphs).
      - name: Run sccache
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9
        with:
          version: "v0.16.0"

      - name: Start RustFS
        # Pinned to 1.0.0-beta.12 (2026-07-30). beta.8 carried hyper's short
        # header_read_timeout for idle keep-alive connections (rustfs#4360,
        # fixed in beta.10), matching the intermittent "error sending request"
        # PUT failures observed here on pooled connections. The S3 suites
        # (engine `s3_storage` and server `s3`, modules of their `integration`
        # binaries, cluster s3_cluster, engine failpoints
        # s3_) were validated against the beta.12
        # binary locally before this bump. Keep CI pinned to the immutable
        # multi-arch index digest so upgrades are deliberate.
        run: |
          docker rm -f rustfs >/dev/null 2>&1 || true
          docker run -d \
            --name rustfs \
            -p 9000:9000 \
            -p 9001:9001 \
            -e RUSTFS_ACCESS_KEY="${AWS_ACCESS_KEY_ID}" \
            -e RUSTFS_SECRET_KEY="${AWS_SECRET_ACCESS_KEY}" \
            rustfs/rustfs:1.0.0-beta.12@sha256:41fe89380f4120a337790c02af192c3fe7bb55c3edc2e6e9357b487b47c6ab21 \
            /data

      - name: Install AWS CLI
        run: |
          python3 -m pip install --user awscli
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      - name: Create RustFS test bucket
        run: |
          set -euo pipefail
          rustfs_ready=false
          for attempt in $(seq 1 30); do
            if aws --endpoint-url "${AWS_ENDPOINT_URL_S3}" s3api list-buckets >/dev/null 2>&1; then
              rustfs_ready=true
              break
            fi
            echo "RustFS readiness check ${attempt}/30 failed; retrying"
            sleep 2
          done

          if [ "$rustfs_ready" != true ]; then
            echo "::error::RustFS did not become ready after 30 attempts"
            exit 1
          fi

          aws --endpoint-url "${AWS_ENDPOINT_URL_S3}" \
            s3api create-bucket \
            --bucket "${OMNIGRAPH_S3_TEST_BUCKET}"

      # Compile and execute the selected default targets in one Cargo resolve.
      # A superset prebuild followed by narrower commands would still rebuild
      # workspace crates under different feature fingerprints. Both calls
      # select the same four packages, so they share that one resolve.
      #
      # The first call selects modules of the `integration` binaries by
      # libtest substring filter: `s3_storage::`, `cli_cluster_e2e::` and
      # `system_local::` take their whole modules; the server's `s3` module is
      # named test by test because a bare `s3::` also matches the engine's
      # `write_cost_s3::` cost gate, which stays out of this job. A test added
      # to the server's `s3` module must be added to this list. The second
      # call runs the standalone targets unfiltered, as before.
      - name: Run RustFS default integration graph
        if: matrix.shard == 'default'
        run: |
          set -euo pipefail
          test_log="$RUNNER_TEMP/rustfs-default.log"
          : >"$test_log"
          cargo test --locked \
            -p omnigraph-engine \
            -p omnigraph-server \
            -p omnigraph-cluster \
            -p omnigraph-cli \
            --test integration \
            -- --nocapture --test-threads=1 \
            s3_storage:: \
            cli_cluster_e2e:: \
            system_local:: \
            s3::server_opens_s3_graph_directly_and_serves_snapshot_and_read \
            s3::server_opens_azure_graph_directly_and_serves_snapshot_and_read \
            s3::server_boots_cluster_from_bare_storage_uri_and_serves_query \
            s3::server_boots_azure_cluster_from_bare_storage_uri_and_serves_query \
            2>&1 | tee -a "$test_log"
          cargo test --locked \
            -p omnigraph-engine \
            -p omnigraph-server \
            -p omnigraph-cluster \
            -p omnigraph-cli \
            --test lance_surface_guards \
            --test s3_cluster \
            --test bound_storage \
            -- --nocapture --test-threads=1 2>&1 | tee -a "$test_log"

          # Keep the same package feature graph for this admitted-startup unit
          # fixture; selecting only server would rebuild Lance and object_store.
          cargo test --locked \
            -p omnigraph-engine \
            -p omnigraph-server \
            -p omnigraph-cluster \
            -p omnigraph-cli \
            --lib \
            settings::tests::s3_bootstrap_handoff_serves_empty_then_deploys_first_graph \
            -- --exact --nocapture --test-threads=1 2>&1 | tee -a "$test_log"

          if grep -Eiq \
            "SKIP public_physical_ref_token_rejects_s3_same_version_aba|skipping s3 " \
            "$test_log"
          then
            echo "::error::a configured RustFS test emitted its unconfigured skip"
            exit 1
          fi

          for test_name in \
            s3_storage::s3_compatible_graph_lifecycle_works \
            s3_storage::s3_branch_change_merge_flow_works \
            s3_storage::s3_public_load_uses_hidden_run_and_publishes \
            s3_storage::s3_adapter_conditional_writes_contract \
            s3_storage::s3_schema_apply_migrates_live_graph \
            s3_storage::s3_fresh_branch_traversal_reuses_main_graph_index_with_etags \
            public_physical_ref_token_rejects_s3_same_version_aba \
            s3::server_opens_s3_graph_directly_and_serves_snapshot_and_read \
            s3::server_boots_cluster_from_bare_storage_uri_and_serves_query \
            settings::tests::s3_bootstrap_handoff_serves_empty_then_deploys_first_graph \
            s3_cluster_full_lifecycle_import_apply_serve_evolve_delete \
            bound_handle_never_reaches_the_ambient_endpoint \
            cli_cluster_e2e::cluster_e2e_s3_live_apply_without_restart \
            system_local::local_cli_s3_end_to_end_init_load_read_flow
          do
            grep -Eq "test ${test_name} \.\.\. ok" "$test_log" \
              || { echo "::error::required RustFS cell '${test_name}' did not execute normally"; exit 1; }
          done

      # NOTE: the RFC-013 step-3a data-table opener COST gate (write_cost_s3) used
      # to run here. It is a deterministic IO-count gate, not a correctness test —
      # performance/cost contracts belong in a dedicated perf harness on a stable
      # runner + own cadence, not on the every-merge correctness path. Moved out of
      # CI pending that harness; run it on demand with a bucket set:
      #   OMNIGRAPH_S3_TEST_BUCKET=… cargo test -p omnigraph-engine --test integration write_cost_s3::

      - name: Run RustFS detached publication retention
        if: matrix.shard == 'failpoints'
        # Exercise detached write and compaction pins through S3 after a lost
        # publication acknowledgement, then prove another write succeeds, and
        # retry cleanup after a pass stopped in each window of its sweep.
        # Require every owner and reject unconfigured early returns.
        run: |
          set -euo pipefail
          test_log="$RUNNER_TEMP/rustfs-failpoints.log"
          cargo test --locked -p omnigraph-engine --features failpoints \
            --test failpoints s3_ -- --nocapture 2>&1 | tee "$test_log"
          if grep -Eiq 'skipping s3[ _]' "$test_log"; then
            echo "::error::a configured RustFS failpoint test emitted its unconfigured skip"
            exit 1
          fi
          for test_name in \
            s3_write_detached_pin_survives_next_write \
            s3_optimize_detached_pin_survives_next_write \
            s3_collector_retry_converges_after_every_sweep_window
          do
            grep -Fq "test ${test_name} ... ok" "$test_log" \
              || { echo "::error::required RustFS failpoint cell did not pass: $test_name"; exit 1; }
          done

      - name: Dump RustFS diagnostics on failure
        if: failure()
        run: |
          set +e
          echo "::group::docker inspect rustfs"
          # Limit inspection to runtime state: full inspect output includes the
          # container environment and would disclose the test credentials.
          docker inspect --format 'State={{json .State}} Image={{.Image}}' rustfs
          echo "::endgroup::"

          echo "::group::docker logs rustfs"
          docker logs rustfs
          echo "::endgroup::"

          diagnostics_dir=$(mktemp -d "${RUNNER_TEMP}/rustfs-logs.XXXXXX")
          echo "::group::RustFS /logs"
          if docker cp rustfs:/logs "$diagnostics_dir"; then
            find "$diagnostics_dir" -type f -exec sh -c '
              for log_file do
                echo "===== ${log_file} ====="
                tail -n 2000 "$log_file"
              done
            ' sh {} +
          else
            echo "Unable to copy /logs from the RustFS container"
          fi
          echo "::endgroup::"

  azurite_integration:
    name: Azurite Azure Integration
    # Reporting context on pull requests and after merge (docs/dev/ci.md);
    # independent of `test` so a failure reports at its real boundary.
    needs: classify_changes
    if: github.event_name != 'merge_group' && needs.classify_changes.outputs.run_full_ci == 'true'
    runs-on: ubuntu-latest
    # One Lance graph, the one `Test Workspace` builds, compiles on the first
    # cache miss (every cargo call below selects it; docs/dev/ci.md, cache
    # rule); keep the timeout above the RustFS shard envelope.
    timeout-minutes: 90
    permissions:
      contents: read
    env:
      AZURE_STORAGE_USE_EMULATOR: "true"
      AZURE_STORAGE_ACCOUNT_NAME: devstoreaccount1
      AZURITE_BLOB_STORAGE_URL: http://127.0.0.1:10000
      OMNIGRAPH_AZURE_TEST_CONTAINER: omnigraph-tests
      CARGO_TERM_COLOR: always
      RUST_MIN_STACK: 16777216
      RUSTC_WRAPPER: sccache
      SCCACHE_GHA_ENABLED: "true"
      SCCACHE_GHA_RW_MODE: ${{ github.ref == 'refs/heads/main' && 'READ_WRITE' || 'READ_ONLY' }}
    steps:
      - name: Checkout source
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y protobuf-compiler libprotobuf-dev

      - name: Install pinned toolchain
        run: rustup toolchain install

      - name: Cache Azure integration build data
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          workspaces: |
            . -> target
          key: azurite-azure
          save-if: ${{ github.ref == 'refs/heads/main' }}

      # sccache fetches unchanged dependency compiles when rust-cache misses
      # (docs/dev/ci.md, Full correctness graphs).
      - name: Run sccache
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9
        with:
          version: "v0.16.0"

      - name: Start pinned Azurite Blob service
        # Azurite 3.35.0, pinned to the immutable multi-arch index digest.
        run: |
          set -euo pipefail
          docker rm -f azurite >/dev/null 2>&1 || true
          docker run -d \
            --name azurite \
            -p 10000:10000 \
            mcr.microsoft.com/azure-storage/azurite:3.35.0@sha256:647c63a91102a9d8e8000aab803436e1fc85fbb285e7ce830a82ee5d6661cf37 \
            azurite-blob --blobHost 0.0.0.0 --blobPort 10000
          for _ in $(seq 1 60); do
            if curl --silent --show-error \
              "${AZURITE_BLOB_STORAGE_URL}/${AZURE_STORAGE_ACCOUNT_NAME}?comp=list" \
              >/dev/null
            then
              exit 0
            fi
            sleep 1
          done
          echo "::error::Azurite did not become reachable"
          docker logs azurite
          exit 1

      - name: Create Azurite test container
        # This is the public emulator key, never a production credential. The
        # emulator canonicalized resource repeats the account path segment.
        run: |
          python3 - <<'PY'
          import base64
          import datetime
          import email.utils
          import hashlib
          import hmac
          import os
          import urllib.request

          account = os.environ['AZURE_STORAGE_ACCOUNT_NAME']
          container = os.environ['OMNIGRAPH_AZURE_TEST_CONTAINER']
          endpoint = os.environ['AZURITE_BLOB_STORAGE_URL']
          key = base64.b64decode(
              'Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/'
              'K1SZFPTOtr/KBHBeksoGMGw=='
          )
          date = email.utils.format_datetime(
              datetime.datetime.now(datetime.timezone.utc), usegmt=True
          )
          version = '2023-11-03'
          canonical_headers = f'x-ms-date:{date}\nx-ms-version:{version}\n'
          canonical_resource = (
              f'/{account}/{account}/{container}\nrestype:container'
          )
          string_to_sign = (
              'PUT\n\n\n\n\n\n\n\n\n\n\n\n'
              + canonical_headers
              + canonical_resource
          )
          signature = base64.b64encode(
              hmac.new(key, string_to_sign.encode(), hashlib.sha256).digest()
          ).decode()
          request = urllib.request.Request(
              f'{endpoint}/{account}/{container}?restype=container',
              method='PUT',
              headers={
                  'Authorization': f'SharedKey {account}:{signature}',
                  'Content-Length': '0',
                  'x-ms-date': date,
                  'x-ms-version': version,
              },
          )
          with urllib.request.urlopen(request, timeout=10) as response:
              if response.status != 201:
                  raise SystemExit(f'unexpected create-container status: {response.status}')
          PY

      - name: Run exact Azure integration owners
        # Each owner is named once; scripts/check-ci-cells.py reads the names.
        run: |
          set -euo pipefail
          test_log="$RUNNER_TEMP/azurite-azure.log"
          : >"$test_log"

          # Every cargo call selects the same packages, the `Test Workspace`
          # set, so the Lance stack resolves one feature set and compiles
          # once; a per-owner `-p` resolved six graphs, four with the Lance
          # stack, 89 minutes on main (docs/dev/ci.md, cache rule). An owner
          # names only its target: `--lib`, `--test <file>`, or
          # `--test integration` with its `<module>::` prefix.
          selection=(--workspace --exclude omnigraph-gqt --exclude omnigraph-gqt-served --exclude omnigraph-dst --features "$FAILPOINT_FEATURES")
          require_cell() {
            grep -Eq "test (tests::)?${1} \.\.\. ok" "$test_log" \
              || { echo "::error::required Azure cell '${1}' did not execute normally"; exit 1; }
          }
          run_cell() {
            local name="$1"
            shift
            cargo test --locked "${selection[@]}" "$@" "$name" -- --exact --nocapture 2>&1 | tee -a "$test_log"
            require_cell "${name#tests::}"
          }

          run_cell tests::contract_suite_azure_when_configured --lib
          run_cell tests::configured_azurite_enforces_one_lease_owner_and_explicit_break --lib
          cargo test --locked "${selection[@]}" --test supervisor \
            -- --nocapture 2>&1 | tee -a "$test_log"
          for test_name in \
            held_admission_never_launches_child_then_runs_once_after_release \
            held_job_terminated_before_admission_fails_without_launching_child \
            graceful_server_signal_drains_process_group_before_release \
            unexpected_server_exit_strands_lease_until_explicit_break
          do
            require_cell "$test_name"
          done
          # `failpoints` is a test target of the engine and of the cluster
          # crate; the cluster binary runs zero tests for an engine owner's
          # name and require_cell reads the engine's `ok` line.
          run_cell azure_write_detached_pin_survives_next_write --test failpoints
          run_cell azure_optimize_detached_pin_survives_next_write --test failpoints
          run_cell azure_schema_apply_post_commit_failure_leaves_readable_contract --test failpoints
          run_cell azure_collector_retry_converges_after_every_sweep_window --test failpoints
          run_cell azure_cluster_full_lifecycle_import_apply_serve_evolve_delete --test s3_cluster
          run_cell s3::server_opens_azure_graph_directly_and_serves_snapshot_and_read --test integration
          run_cell s3::server_boots_azure_cluster_from_bare_storage_uri_and_serves_query --test integration
          run_cell system_local::local_cli_azure_end_to_end_init_load_read_flow --test integration
          run_cell cli_cluster_e2e::cluster_e2e_azure_live_apply_without_restart --test integration

          if grep -Eiq 'skipping .*azure|skipping .*azurite' "$test_log"; then
            echo "::error::a configured Azure test emitted its unconfigured skip"
            exit 1
          fi

      - name: Verify control and Lance objects share the declared container
        run: |
          python3 - "$RUNNER_TEMP/azurite-inventory.txt" <<'PY'
          import base64
          import datetime
          import email.utils
          import hashlib
          import hmac
          import os
          import pathlib
          import urllib.request
          import xml.etree.ElementTree as ET

          account = os.environ['AZURE_STORAGE_ACCOUNT_NAME']
          container = os.environ['OMNIGRAPH_AZURE_TEST_CONTAINER']
          endpoint = os.environ['AZURITE_BLOB_STORAGE_URL']
          key = base64.b64decode(
              'Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/'
              'K1SZFPTOtr/KBHBeksoGMGw=='
          )
          date = email.utils.format_datetime(
              datetime.datetime.now(datetime.timezone.utc), usegmt=True
          )
          version = '2023-11-03'
          canonical_headers = f'x-ms-date:{date}\nx-ms-version:{version}\n'
          canonical_resource = (
              f'/{account}/{account}/{container}\ncomp:list\nrestype:container'
          )
          string_to_sign = (
              'GET\n\n\n\n\n\n\n\n\n\n\n\n'
              + canonical_headers
              + canonical_resource
          )
          signature = base64.b64encode(
              hmac.new(key, string_to_sign.encode(), hashlib.sha256).digest()
          ).decode()
          request = urllib.request.Request(
              f'{endpoint}/{account}/{container}?comp=list&restype=container',
              headers={
                  'Authorization': f'SharedKey {account}:{signature}',
                  'x-ms-date': date,
                  'x-ms-version': version,
              },
          )
          with urllib.request.urlopen(request, timeout=10) as response:
              inventory = ET.fromstring(response.read())
          if inventory.findtext('NextMarker'):
              raise SystemExit('Azure inventory exceeded one explicit 5,000-object page')
          names = [node.text or '' for node in inventory.findall('.//Name')]
          pathlib.Path(__import__('sys').argv[1]).write_text('\n'.join(names) + '\n')
          if not any('/__cluster/' in name for name in names):
              raise SystemExit('no Azure cluster control object was observed')
          if not any('.lance/' in name or '/_versions/' in name for name in names):
              raise SystemExit('no Azure Lance dataset object was observed')
          if not any(name.startswith('__omnigraph_azure_admission/v1/') for name in names):
              raise SystemExit('no root-derived admission object was observed')
          PY

      - name: Upload Azurite integration evidence
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: azurite-azure-integration-${{ github.run_id }}-${{ github.run_attempt }}
          path: |
            ${{ runner.temp }}/azurite-azure.log
            ${{ runner.temp }}/azurite-inventory.txt
          if-no-files-found: warn
          retention-days: 14

      - name: Dump Azurite logs on failure
        if: failure()
        run: docker logs azurite

  # The one verdict branch protection requires from this workflow: every job
  # that blocks main is in `needs:`, and scripts/ci_gate.py accepts a skip
  # only where the job's own `if:` was false (docs/dev/branch-protection.md).
  ci_gate:
    name: CI Gate
    needs: [classify_changes, check_agents_md, workflow_action_pins, cargo_deny, graph_vocabulary_guard, fmt, lint, test, storage_upgrade_compatibility, test_aws_feature]
    if: always()
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
    steps:
      - name: Checkout source
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1

      - name: Judge the blocking jobs
        shell: bash
        env:
          NEEDS_JSON: ${{ toJSON(needs) }}
          EVENT_NAME: ${{ github.event_name }}
          EVENT_REF: ${{ github.ref }}
          RUN_FULL_CI: ${{ needs.classify_changes.outputs.run_full_ci }}
        run: python3 scripts/ci_gate.py