Establish release CI matrix (#99)

.gitea/workflows/release-matrix.yml

@@ -0,0 +1,122 @@
+name: Release platform and feature matrix
+
+on:
+  push:
+    paths:
+      - ".gitea/workflows/release-matrix.yml"
+      - "ci/release-matrix.json"
+      - "tools/ci-matrix/**"
+      - "tools/install_openjpeg_2_5_4.sh"
+      - "docs/release-ci-matrix.md"
+      - "README.md"
+      - "RUSTREWRITE.md"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - "crates/**"
+      - "programs/**"
+      - "tests/**"
+  pull_request:
+    paths:
+      - ".gitea/workflows/release-matrix.yml"
+      - "ci/release-matrix.json"
+      - "tools/ci-matrix/**"
+      - "tools/install_openjpeg_2_5_4.sh"
+      - "docs/release-ci-matrix.md"
+      - "README.md"
+      - "RUSTREWRITE.md"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - "crates/**"
+      - "programs/**"
+      - "tests/**"
+  workflow_dispatch:
+
+env:
+  CARGO_BUILD_JOBS: 1
+  CARGO_INCREMENTAL: 0
+  CARGO_PROFILE_DEV_DEBUG: 0
+  CARGO_PROFILE_TEST_DEBUG: 0
+  FORCE_SKIA_BINARIES_DOWNLOAD: 1
+  RUSTDOCFLAGS: -D warnings
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Validate matrix coverage and ubuntu-only policy
+        run: cargo run --locked -p metacrate-ci-matrix -- audit
+
+  matrix:
+    needs: audit
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - profile: linux-msrv-portable
+            toolchain: 1.96.0
+            target: x86_64-unknown-linux-gnu
+            native_dependencies: false
+          - profile: linux-stable-default
+            toolchain: stable
+            target: x86_64-unknown-linux-gnu
+            native_dependencies: true
+          - profile: linux-stable-minimal
+            toolchain: stable
+            target: x86_64-unknown-linux-gnu
+            native_dependencies: false
+          - profile: linux-stable-features
+            toolchain: stable
+            target: x86_64-unknown-linux-gnu
+            native_dependencies: true
+          - profile: linux-stable-release-surface
+            toolchain: stable
+            target: x86_64-unknown-linux-gnu
+            native_dependencies: true
+          - profile: windows-stable-portable
+            toolchain: stable
+            target: x86_64-pc-windows-gnu
+            native_dependencies: false
+          - profile: macos-stable-portable
+            toolchain: stable
+            target: x86_64-apple-darwin
+            native_dependencies: false
+    env:
+      OPENJPEG_PREFIX: /tmp/metacrate-openjpeg-${{ github.run_id }}-${{ matrix.profile }}
+      PKG_CONFIG_PATH: /tmp/metacrate-openjpeg-${{ github.run_id }}-${{ matrix.profile }}/lib/pkgconfig
+      LD_LIBRARY_PATH: /tmp/metacrate-openjpeg-${{ github.run_id }}-${{ matrix.profile }}/lib
+    steps:
+      - uses: actions/checkout@v4
+      - name: Cache immutable Cargo downloads only
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+          key: release-downloads-${{ runner.os }}-${{ matrix.toolchain }}-${{ hashFiles('Cargo.lock') }}
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ matrix.toolchain }}
+          targets: ${{ matrix.target }}
+      - name: Install pinned native feature prerequisites
+        if: matrix.native_dependencies == true
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes build-essential cmake pkg-config libopus-dev libasound2-dev
+          tools/install_openjpeg_2_5_4.sh "$OPENJPEG_PREFIX"
+          pkg-config --modversion libopenjp2
+          pkg-config --modversion opus
+          pkg-config --modversion alsa
+      - name: Revalidate matrix with selected toolchain
+        run: cargo run --locked -p metacrate-ci-matrix -- audit
+      - name: Execute isolated release profile
+        run: cargo run --locked -p metacrate-ci-matrix -- run ${{ matrix.profile }} --evidence artifacts/ci-matrix/${{ matrix.profile }}.json
+      - name: Upload exact matrix evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-matrix-${{ matrix.profile }}
+          path: artifacts/ci-matrix/${{ matrix.profile }}.json
+          if-no-files-found: error