Consolidate required CI gate (#115)

.gitea/workflows/ci.yml

@@ -0,0 +1,88 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  required:
+    name: required
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      CARGO_BUILD_JOBS: "2"
+      CARGO_INCREMENTAL: "0"
+      CARGO_PROFILE_DEV_DEBUG: "0"
+      CARGO_PROFILE_TEST_DEBUG: "0"
+      RUSTDOCFLAGS: "-D warnings"
+      CARGO_HOME: ${{ runner.tool_cache }}/metacrate/cargo/home-rust-1.97.1-aarch64-unknown-linux-gnu
+      OPENJPEG_PREFIX: ${{ runner.tool_cache }}/metacrate/native/openjpeg-2.5.4-${{ runner.arch }}
+      PKG_CONFIG_PATH: ${{ runner.tool_cache }}/metacrate/native/openjpeg-2.5.4-${{ runner.arch }}/lib/pkgconfig
+      LD_LIBRARY_PATH: ${{ runner.tool_cache }}/metacrate/native/openjpeg-2.5.4-${{ runner.arch }}/lib
+      CARGO_TARGET_DIR: ${{ runner.tool_cache }}/metacrate/cargo/target-rust-1.97.1-aarch64-unknown-linux-gnu-${{ hashFiles('.gitea/workflows/ci.yml', 'Cargo.lock', 'Cargo.toml', 'ci/ci-coverage.json', 'ci/dependency-policy.json', 'deny.toml', 'tools/install_openjpeg_2_5_4.sh', 'crates/libremetaverse-imaging-skia/Cargo.toml') }}
+      METACRATE_EXPECTED_HOST: aarch64-unknown-linux-gnu
+      METACRATE_PROVENANCE_DIAGNOSTICS_DIR: artifacts/ci/provenance-candidates
+      METACRATE_SKIA_ARCHIVE: ${{ runner.tool_cache }}/metacrate/native/skia-0.99.0-aarch64-unknown-linux-gnu/skia-binaries-a25a0fdb7d90429aa2d1-aarch64-unknown-linux-gnu-jpegd-jpege-pdf-svg-textlayout-vulkan-webpd-webpe.tar.gz
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Inspect the runner-persistent, architecture-keyed cache
+        run: |
+          mkdir -p "$CARGO_HOME" "$CARGO_TARGET_DIR" "$(dirname "$METACRATE_SKIA_ARCHIVE")"
+          test -f "$CARGO_TARGET_DIR/.metacrate-ready" && cargo_hit=true || cargo_hit=false
+          test -f "$OPENJPEG_PREFIX/metacrate-openjpeg.identity" && test -f "$METACRATE_SKIA_ARCHIVE" && native_hit=true || native_hit=false
+          test -x "$CARGO_HOME/bin/cargo-deny" && test -x "$CARGO_HOME/bin/cargo-machete" && tools_hit=true || tools_hit=false
+          echo "METACRATE_CARGO_CACHE_HIT=$cargo_hit" >> "$GITHUB_ENV"
+          echo "METACRATE_NATIVE_CACHE_HIT=$native_hit" >> "$GITHUB_ENV"
+          echo "METACRATE_TOOLS_CACHE_HIT=$tools_hit" >> "$GITHUB_ENV"
+
+      - name: Install the single native prerequisite set
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes build-essential clang cmake curl git ninja-build pkg-config python3 libfontconfig1-dev libfreetype6-dev libopus-dev libasound2-dev
+
+      - name: Install pinned Rust and audit tools
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: 1.97.1
+          components: clippy,rustfmt
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-deny@0.20.2,cargo-machete@0.9.2
+
+      - name: Verify pinned audit tool versions
+        run: |
+          cargo deny --version | grep '0.20.2'
+          cargo machete --version | grep '0.9.2'
+
+      - name: Validate and populate the exact native cache
+        run: |
+          test "$(uname -m)" = aarch64
+          rustc -vV | grep '^host: aarch64-unknown-linux-gnu$'
+          tools/install_openjpeg_2_5_4.sh "$OPENJPEG_PREFIX"
+          pkg-config --exact-version 2.5.4 libopenjp2
+          mkdir -p "$(dirname "$METACRATE_SKIA_ARCHIVE")"
+          if ! echo 'dd127f458a5e67a79f3936a8aa19f822fe90a1d6a11b50b5f84df2b0519d909c  '"$METACRATE_SKIA_ARCHIVE" | sha256sum --check --status; then
+            curl --fail --location --proto '=https' --tlsv1.2 --output "$METACRATE_SKIA_ARCHIVE" \
+              https://github.com/rust-skia/skia-binaries/releases/download/0.99.0/skia-binaries-a25a0fdb7d90429aa2d1-aarch64-unknown-linux-gnu-jpegd-jpege-pdf-svg-textlayout-vulkan-webpd-webpe.tar.gz
+          fi
+          echo 'dd127f458a5e67a79f3936a8aa19f822fe90a1d6a11b50b5f84df2b0519d909c  '"$METACRATE_SKIA_ARCHIVE" | sha256sum --check
+
+      - name: Run the authoritative code-ready graph
+        run: cargo run --locked -p metacrate-ci-matrix -- required-gate --evidence artifacts/ci/required-gate.json
+
+      - name: Mark the validated cache generation ready
+        run: touch "$CARGO_TARGET_DIR/.metacrate-ready"
+
+      - name: Upload stage timing and audit evidence
+        if: always()
+        uses: actions/upload-artifact@v3
+        with:
+          name: required-ci-evidence
+          path: artifacts/ci/
+          if-no-files-found: error