Complete first release candidate audit (#107)

.gitea/workflows/release-candidate.yml

@@ -0,0 +1,103 @@
+name: First release candidate
+
+on:
+  push:
+    paths:
+      - ".gitea/workflows/release-candidate.yml"
+      - "ci/release-candidate-policy.json"
+      - "ci/evidence/**"
+      - "docs/release-candidate.md"
+      - "CHANGELOG.md"
+      - "release/**"
+      - "api/**"
+      - "programs/**"
+      - "tests/**"
+      - "tools/**"
+      - "crates/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+  pull_request:
+    paths:
+      - ".gitea/workflows/release-candidate.yml"
+      - "ci/release-candidate-policy.json"
+      - "ci/evidence/**"
+      - "docs/release-candidate.md"
+      - "CHANGELOG.md"
+      - "release/**"
+      - "api/**"
+      - "programs/**"
+      - "tests/**"
+      - "tools/**"
+      - "crates/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+  workflow_dispatch:
+
+env:
+  CARGO_BUILD_JOBS: 1
+  CARGO_INCREMENTAL: 0
+  CARGO_PROFILE_DEV_DEBUG: 0
+  CARGO_PROFILE_TEST_DEBUG: 0
+  FORCE_SKIA_BINARIES_DOWNLOAD: 1
+  OPENJPEG_PREFIX: /tmp/metacrate-openjpeg-release-candidate
+  PKG_CONFIG_PATH: /tmp/metacrate-openjpeg-release-candidate/lib/pkgconfig
+  LD_LIBRARY_PATH: /tmp/metacrate-openjpeg-release-candidate/lib
+  RUSTDOCFLAGS: -D warnings
+
+jobs:
+  non-fuzz-release-gate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: 1.97.1
+          components: rustfmt, clippy
+      - name: Install every Linux release prerequisite
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes build-essential clang cmake curl ninja-build pkg-config python3 libfontconfig1-dev libfreetype6-dev libopus-dev libasound2-dev
+          tools/install_openjpeg_2_5_4.sh "$OPENJPEG_PREFIX"
+      - name: Record source identity without a shipped helper
+        run: echo "METACRATE_RUST_COMMIT=$(git rev-parse --verify HEAD)" >>"$GITHUB_ENV"
+      - name: Verify generated surfaces, mappings, parity, and milestone inventories
+        run: |
+          python3 tools/generate_rust_mapping.py --check
+          python3 tools/generate_api_shims.py --check
+          python3 tools/check_api_coverage.py
+          python3 tools/check_test_parity.py
+          python3 tools/generate_lsl_tables.py --check
+          python3 tools/check_milestone_09.py
+          python3 tools/check_milestone_10.py
+      - name: Format, compile, test, lint, and document the complete workspace
+        run: |
+          cargo fmt --all -- --check
+          cargo check --workspace --all-targets --all-features --locked -j 1
+          cargo test --workspace --all-features --locked -j 1
+          cargo clippy --workspace --all-targets --all-features --locked -j 1 -- -D warnings
+          cargo doc --workspace --all-features --no-deps --locked -j 1
+      - name: Compile downstream and SemVer consumers
+        run: |
+          cargo check --locked --manifest-path tests/api-compile/Cargo.toml
+          cargo run --locked --manifest-path tests/semver-port/Cargo.toml
+      - name: Exercise all offline program and fake-grid behavior
+        run: |
+          cargo test --locked -p libremetaverse-programs --tests -j 1
+          cargo run --locked -p libremetaverse-programs --bin live-grid-smoke -- --audit-only
+          cargo run --locked -p libremetaverse-programs --bin live-grid-smoke -- --fake --evidence artifacts/release-candidate/fake-grid-smoke.jsonl
+      - name: Revalidate all checked-in audits and checksums
+        run: |
+          cargo run --locked -p metacrate-ci-matrix -- audit
+          cargo run --locked -p metacrate-ci-matrix -- documentation-audit --evidence artifacts/release-candidate/documentation.json
+          cargo run --locked -p metacrate-ci-matrix -- dependency-audit --evidence artifacts/release-candidate/dependency.json
+          cargo run --locked -p metacrate-ci-matrix -- provenance-audit --evidence artifacts/release-candidate/provenance.json
+          sha256sum --check release/SHA256SUMS
+      - name: Enforce the aggregate non-fuzz release-candidate decision
+        run: cargo run --locked -p metacrate-ci-matrix -- release-candidate-audit --evidence artifacts/release-candidate/status.json
+      - name: Upload release-candidate evidence, including failures
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: metacrate-0.0.1-release-candidate
+          path: artifacts/release-candidate/
+          if-no-files-found: error