Fix extra-language CI compare/smoke for HeaderStore typing

.github/workflows/ci.yml

@@ -26,8 +26,9 @@ on:
         value: ${{ jobs.compact-required.outputs.passed == 'true' && jobs.assemble-site.outputs.ready == 'true' }}
 
 # Separate from the full-ci caller's lock: workflow_call inherits its context.
-# Push-to-main now runs full coverage; cancel superseded SHAs so merge trains
-# do not stack 50-job matrices. Scheduled/manual full-ci keeps its own lock.
+# Push-to-main is Ruby+Spinel, not the extra-language matrix; cancel
+# superseded SHAs so merge trains do not stack. Scheduled/manual full-ci
+# is the extra-SDK ledger and keeps its own lock.
 concurrency:
   group: validation-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' || github.event_name == 'push' }}
@@ -113,9 +114,7 @@ jobs:
         env:
           WRITEBOOK_ROOT: /tmp/writebook
           WRITEBOOK_INVENTORY_REPORT: writebook-inventory-current.json
-        run: |
-          cargo build --locked --release --bin roundhouse
-          cargo test --locked --test writebook --release -- --ignored --nocapture
+        run: cargo test --locked --release --bin roundhouse --test writebook -- --ignored --nocapture
       - name: Save complete check report
         id: report
         if: always() && (steps.reuse.outcome != 'success' || steps.reuse.outputs.hit != 'true')
@@ -310,16 +309,19 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: python3 scripts/ci-reuse.py probe --job store-check --input fixtures/store
+      # Debug, not release: the analyzer claim is the same IR. On PR
+      # 37439350975 this job spent 95s of 113s compiling a release
+      # binary for a check that finishes in seconds.
       - name: cargo build
         id: build
         if: steps.reuse.outcome != 'success' || steps.reuse.outputs.hit != 'true'
-        run: cargo build --locked --release --bin roundhouse
+        run: cargo build --locked --bin roundhouse
       - name: The analyzer reports no errors, no warnings and no ingest gaps on the store
         id: check
         if: steps.reuse.outcome != 'success' || steps.reuse.outputs.hit != 'true'
         run: |
           set -euo pipefail
-          target/release/roundhouse check --continue fixtures/store 2>&1 | tee /tmp/store-check.txt
+          target/debug/roundhouse check --continue fixtures/store 2>&1 | tee /tmp/store-check.txt
           grep -E "^roundhouse-check: .* 0 error\(s\), 0 warning\(s\), 0 gap-attributed note\(s\), 0 survey gap\(s\)" /tmp/store-check.txt
       - name: Record actual successful execution
         id: execution
@@ -431,6 +433,7 @@ jobs:
       # Preprocess each time: Spinel uses conditional __has_include headers.
       SCCACHE_DIRECT: "false"
       SCCACHE_IDLE_TIMEOUT: "0"
+      MAKEFLAGS: "-j4"
     steps:
       - uses: actions/checkout@v7
         with:
@@ -579,33 +582,43 @@ jobs:
       - uses: ruby/setup-ruby@v1
         with:
           ruby-version: ${{ env.MRI_RUBY }}
-      - name: Install the gem the overlay escape surface uses
-        run: gem install rails-html-sanitizer --no-document
-      # The native Date reference uses ActiveRecord against in-memory
-      # SQLite. Fixture generation ships source, not its installed gems.
-      - name: Install ActiveRecord for the native Date reference
-        run: gem install activerecord -v '~> 8.1.0' --no-document
-      # `tests/emit_and_run.rs` and `tests/relation_runtime_cruby.rs`
-      # run the emitted Ruby tree, whose database layer is the sqlite3
-      # gem. The second skipped without it and passed: before this step
-      # the unit job ran it as a no-op. The first refuses to skip.
+      # libvips42: `tests/vips_loader_policy.rs` boots an emitted variant
+      # app and asks `Vips.vips_foreign_find_load` after the app's loader
+      # policy. CRuby binds through FFI, so the library is enough; headers
+      # are the compiled Spinel job.
+      - name: System libvips for the emitted ruby-vips processor
+        run: |
+          "$GITHUB_WORKSPACE/scripts/ci-apt-install" libvips42
+      # One gem process: three sequential `gem install` steps were paying
+      # RubyGems startup separately for the same default gem path.
       #
-      # Campfire launcher regressions (`tests/ci_campfire_optimization_test.py`,
-      # invoked from `tests/ci_policy_workflow.rs`) preload
-      # `scripts/campfire-test-bcrypt.rb`, which `require "bcrypt"`. A
-      # runner without the gem fails those tests; a dev box that has it
-      # hides the gap.
+      # rails-html-sanitizer — `tests/overlay_sanitize_autolink.rs` shells
+      # out to ruby and loads the CRuby overlay's escape surface. Without
+      # the gem the overlay falls back to the shared scanner (which refuses
+      # markup by design) and the test fails naming this step.
+      # setup-ruby, not the runner's system ruby: `gem install` against
+      # system ruby is a Gem::FilePermissionError, and the test asserts
+      # EXACT sanitizer output, so the ruby it runs on is part of the
+      # assertion. 3.4 is the version campfire-conformance pins.
       #
-      # `tests/vips_loader_policy.rs` boots an emitted variant app and
-      # asks `Vips.vips_foreign_find_load` after the app's loader policy.
-      # That require is ruby-vips over the system libvips: without both,
-      # the test dies on `cannot load such file -- vips` while a machine
-      # that already has the gem hides the gap. CRuby binds through FFI,
-      # so libvips42 is enough; headers are the compiled Spinel job.
-      - name: System libvips for the emitted ruby-vips processor
-        run: sudo apt-get update -qq && sudo apt-get install -y -qq libvips42
+      # activerecord — the native Date reference uses ActiveRecord against
+      # in-memory SQLite. Fixture generation ships source, not its gems.
+      #
+      # sqlite3 — `tests/emit_and_run.rs` and `tests/relation_runtime_cruby.rs`
+      # run the emitted Ruby tree. The second skipped without the gem and
+      # passed: before this install the unit job ran it as a no-op.
+      #
+      # bcrypt — Campfire launcher regressions
+      # (`tests/ci_campfire_optimization_test.py`) preload
+      # `scripts/campfire-test-bcrypt.rb`. A runner without the gem fails
+      # those tests; a dev box that has it hides the gap.
+      #
+      # ruby-vips — pairs with libvips42 above; without the gem the vips
+      # loader test dies on `cannot load such file -- vips`.
       - name: Install gems used by emitted Ruby and Campfire harness tests
-        run: gem install sqlite3 bcrypt ruby-vips --no-document
+        run: |
+          gem install --no-document rails-html-sanitizer sqlite3 bcrypt ruby-vips
+          gem install --no-document activerecord -v '~> 8.1.0'
       # Bounded build → run → free waves: every --all-targets identity still
       # goes through Cargo (lib, bins, each integration target). Finished
       # integration executables and their own split-DWARF sidecars are freed
@@ -636,8 +649,9 @@ jobs:
         run: |
           python3 scripts/ci-resources.py --out "$RUNNER_TEMP/unit-resources/bench" -- \
             bash -euo pipefail -c '
+              test -x target/debug/emit_preview
               for target in typescript crystal rust python elixir go kotlin swift csharp; do
-                cargo run --quiet --bin emit_preview -- --target "$target" fixtures/real-blog >/dev/null
+                target/debug/emit_preview --target "$target" fixtures/real-blog >/dev/null
               done
             '
       - name: Upload unit resource samples
@@ -961,6 +975,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     continue-on-error: true
+    env:
+      MAKEFLAGS: "-j4"
     steps:
       - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-rust
@@ -1084,7 +1100,8 @@ jobs:
       # app's own hardening line.
       # CRuby binds libvips through FFI; only compiled Spinel needs headers.
       - name: System libvips
-        run: sudo apt-get update -qq && sudo apt-get install -y -qq libvips42 sqlite3
+        run: |
+          "$GITHUB_WORKSPACE/scripts/ci-apt-install" libvips42 sqlite3
       - name: Cache the prepared oracle
         id: oracle
         uses: actions/cache@v6
@@ -1149,6 +1166,8 @@ jobs:
     outputs:
       artifact-id: ${{ steps.binary.outputs.artifact-id }}
       execution: ${{ steps.result.outputs.status }}
+    env:
+      MAKEFLAGS: "-j4"
     steps:
       - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-rust
@@ -1162,7 +1181,8 @@ jobs:
           chmod +x spinel-dist/spinel spinel-dist/spin spinel-dist/spinel_rbs_extract
           echo "$PWD/spinel-dist" >> $GITHUB_PATH
       - name: System libvips + libsqlite3-dev + libjemalloc-dev
-        run: sudo apt-get update -qq && sudo apt-get install -y -qq libvips-dev libsqlite3-dev libjemalloc-dev
+        run: |
+          "$GITHUB_WORKSPACE/scripts/ci-apt-install" libvips-dev libsqlite3-dev libjemalloc-dev
       - name: Fetch pinned once-campfire
         run: |
           curl -fsSL "https://codeload.github.com/basecamp/once-campfire/tar.gz/${CAMPFIRE_SHA}" -o /tmp/campfire.tar.gz
@@ -1301,6 +1321,7 @@ jobs:
         ports: ['6379:6379']
     env:
       BUNDLE_PATH: vendor/bundle
+      MAKEFLAGS: "-j4"
     steps:
       - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-rust
@@ -1329,7 +1350,8 @@ jobs:
         # this program's allocator and `spin build` links `-ljemalloc`.
         # The DEV package, not libjemalloc2: the runtime library LD_PRELOAD
         # uses cannot be linked against.
-        run: sudo apt-get update -qq && sudo apt-get install -y -qq libvips-dev libsqlite3-dev libjemalloc-dev sqlite3
+        run: |
+          "$GITHUB_WORKSPACE/scripts/ci-apt-install" libvips-dev libsqlite3-dev libjemalloc-dev sqlite3
       - name: Fetch pinned once-campfire
         run: |
           curl -fsSL "https://codeload.github.com/basecamp/once-campfire/tar.gz/${CAMPFIRE_SHA}" -o /tmp/campfire.tar.gz
@@ -1371,6 +1393,7 @@ jobs:
         ports: ['6379:6379']
     env:
       BUNDLE_PATH: vendor/bundle
+      MAKEFLAGS: "-j4"
     steps:
       - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-rust
@@ -1387,7 +1410,8 @@ jobs:
           chmod +x spinel-dist/spinel spinel-dist/spin spinel-dist/spinel_rbs_extract
           echo "$PWD/spinel-dist" >> $GITHUB_PATH
       - name: System libvips + libsqlite3-dev + libjemalloc-dev
-        run: sudo apt-get update -qq && sudo apt-get install -y -qq libvips-dev libsqlite3-dev libjemalloc-dev sqlite3
+        run: |
+          "$GITHUB_WORKSPACE/scripts/ci-apt-install" libvips-dev libsqlite3-dev libjemalloc-dev sqlite3
       - name: Fetch pinned once-campfire
         run: |
           curl -fsSL "https://codeload.github.com/basecamp/once-campfire/tar.gz/${CAMPFIRE_SHA}" -o /tmp/campfire.tar.gz
@@ -1881,6 +1905,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     continue-on-error: true
+    env:
+      MAKEFLAGS: "-j4"
     steps:
       - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-rust
@@ -2029,6 +2055,19 @@ jobs:
         if: matrix.target == 'swift'
         run: |
           "$GITHUB_WORKSPACE/scripts/ci-apt-install" libsqlite3-dev
+      - &swiftpm-cache
+        name: Cache SwiftPM checkouts
+        if: matrix.target == 'swift'
+        uses: actions/cache@v6
+        with:
+          # Cloned Hummingbird/NIO trees. Object files stay per-package in
+          # .build/; sharing those across emit dirs is not reliable.
+          path: |
+            ~/.cache/org.swift.swiftpm
+            ~/.swiftpm
+          key: swiftpm-${{ runner.os }}-${{ runner.arch }}-swift6.1-${{ hashFiles('src/emit/swift/package.rs') }}
+          restore-keys: |
+            swiftpm-${{ runner.os }}-${{ runner.arch }}-swift6.1-
       - name: Install .NET (C#)
         if: matrix.target == 'csharp'
         uses: actions/setup-dotnet@v6
@@ -2094,7 +2133,11 @@ jobs:
         run: cargo test --test framework_tests_kotlin -- --ignored --nocapture
       - name: cargo test --test framework_tests_swift
         if: ${{ !cancelled() && matrix.target == 'swift' }}
-        run: cargo test --test framework_tests_swift -- --ignored --nocapture
+        run: |
+          # scripts/compare then runs emit_preview; compiling it here reuses
+          # the libroundhouse just built for the test harness.
+          cargo build --bin emit_preview --quiet
+          cargo test --test framework_tests_swift -- --ignored --nocapture
       - name: cargo test --test typescript_toolchain real_blog -- --ignored
         if: ${{ !cancelled() && matrix.target == 'typescript' }}
         run: cargo test --test typescript_toolchain real_blog -- --ignored --nocapture
@@ -2379,6 +2422,7 @@ jobs:
         if: matrix.target == 'swift'
         run: |
           "$GITHUB_WORKSPACE/scripts/ci-apt-install" libsqlite3-dev
+      - *swiftpm-cache
       - name: Install .NET (C#)
         if: matrix.target == 'csharp'
         uses: actions/setup-dotnet@v6
@@ -2513,6 +2557,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     continue-on-error: true
+    env:
+      MAKEFLAGS: "-j4"
     steps:
       - uses: actions/checkout@v7
       - uses: actions/download-artifact@v8
@@ -2597,6 +2643,8 @@ jobs:
     # 26 of its 30 minutes on 2026-09-12 (run 34725916085). A publish
     # that times out four minutes short is a flake waiting to happen.
     timeout-minutes: 60
+    env:
+      MAKEFLAGS: "-j4"
     steps:
       - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-rust
@@ -2780,6 +2828,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     continue-on-error: true
+    env:
+      MAKEFLAGS: "-j4"
     steps:
       - uses: actions/checkout@v7
       - uses: actions/download-artifact@v8

README.md

@@ -60,8 +60,9 @@ oracle: the same URL fetched from Rails and from each target must
 produce the same response — emitted tests, a differential compare
 against live Rails (DOM node for DOM node, JSON value for value), and
 browser end-to-end tests for what a static diff can't reach — and
-the full target matrix runs after merge to `main` and in scheduled
-validation, with a Ruby floor and targeted additions on pull requests. →
+the full target matrix runs in scheduled validation, with a Ruby floor
+and targeted additions on pull requests (canonical `main` keeps Ruby
+plus Spinel). →
 [`--target`](docs/guide/transpile.md) · [targets](docs/guide/targets.md)
 · [what of Rails comes through](docs/guide/rails-coverage.md) ·
 [verifying](docs/guide/verifying.md)

SECURITY.md

@@ -11,7 +11,7 @@ from everyone.
 - If you have Hardening ideas, found a weakness in tooling or low level
   vulnerability, please open a public issue or pull request as usual.
 - If you found a high level security issue that could be used to exploit a
-  compiled app and cause serious damage, please report privately throigh
+  compiled app and cause serious damage, please report privately through
   [GitHub's private vulnerability
   reporting](https://github.com/rubys/roundhouse/security/advisories/new).
   Please include reproduction steps and the targets you checked and if you