ci: single setup-rust composite — toolchain pin, mold, centralized build profiles (T1)

.github/actions/setup-rust/action.yml

@@ -0,0 +1,120 @@
+name: Setup Rust
+description: >-
+  Install the Rust toolchain (pinned by default to the same version as
+  rust-toolchain.toml — see the `toolchain` input), optionally the mold
+  linker, and pin RUSTUP_TOOLCHAIN for the rest of this job so it can never
+  silently drift from what this step actually installed.
+
+# Why RUSTUP_TOOLCHAIN: dtolnay/rust-toolchain only runs `rustup default`,
+# which rust-toolchain.toml would otherwise outrank for every in-repo cargo
+# invocation (rustup precedence: RUSTUP_TOOLCHAIN env > directory override >
+# rust-toolchain.toml file > `rustup default`). Exporting the toolchain this
+# step actually resolved — via the action's own `outputs.name`, not a
+# second guess at it — makes that drift structurally impossible, for a
+# pinned stable lane and a nightly lane alike. No lane needs special-casing.
+#
+# Why one place for mold: mold's apt-install/verify/RUSTFLAGS-export used to
+# be copy-pasted per job (8 install sites, 2 "verify" blocks, 4 written-out
+# copies of the linker RUSTFLAGS string across reborn-tests.yml and
+# reborn-e2e.yml). One `mold: true` input replaces all of that.
+
+inputs:
+  toolchain:
+    description: >-
+      Toolchain spec passed through to dtolnay/rust-toolchain. Defaults to
+      the same version pinned in rust-toolchain.toml — bump both together;
+      scripts/ci/ws12_workflow_contracts.py fails the build if they drift.
+      Pass an explicit value (e.g. nightly-2025-11-01) for a lane that
+      intentionally does not track the pinned stable toolchain.
+    required: false
+    default: "1.98.0"
+  components:
+    description: Comma-separated rustup components, passed through.
+    required: false
+    default: ""
+  targets:
+    description: Comma-separated target triples, passed through.
+    required: false
+    default: ""
+  mold:
+    description: >-
+      Install mold+clang, verify the linker actually links, and export the
+      canonical mold RUSTFLAGS prefix. Linux-only (a no-op elsewhere).
+      Defaults to false: most jobs in this repo do not link with mold; the
+      handful that do pass `mold: true` explicitly.
+    required: false
+    default: "false"
+  extra_rustflags:
+    description: >-
+      Extra RUSTFLAGS this job needs (e.g. the nightly `-Zcrate-attr=...`
+      the coverage and crate-bucket lanes compile with). Pass them HERE, not
+      as a job-level `env: RUSTFLAGS:` — a job-level env key is re-applied
+      to every step and therefore shadows what this action writes to
+      $GITHUB_ENV, silently dropping the mold linker flags. Routing them
+      through this input keeps one owner for the final value;
+      scripts/ci/ws12_workflow_contracts.py fails any job that pairs
+      setup-rust with its own RUSTFLAGS env key.
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - name: Install Rust
+      id: install
+      uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+      with:
+        toolchain: ${{ inputs.toolchain }}
+        components: ${{ inputs.components }}
+        targets: ${{ inputs.targets }}
+
+    - name: Pin the resolved toolchain for the rest of this job
+      shell: bash
+      run: |
+        echo "RUSTUP_TOOLCHAIN=${{ steps.install.outputs.name }}" >> "$GITHUB_ENV"
+
+    - name: Install mold and clang
+      if: ${{ inputs.mold == 'true' && runner.os == 'Linux' }}
+      shell: bash
+      run: |
+        scripts/ci/install-ci-apt-packages.sh clang mold
+        test -x /usr/bin/mold
+
+    - name: Verify mold linker is active
+      if: ${{ inputs.mold == 'true' && runner.os == 'Linux' }}
+      shell: bash
+      run: |
+        clang_output=$(echo 'int main(void) { return 0; }' \
+          | clang --ld-path=/usr/bin/mold -Wl,--version -x c - -o /tmp/clang-mold-check 2>&1)
+        grep -qi mold <<< "$clang_output"
+        printf 'fn main() { println!("mold-link-ok"); }\n' > /tmp/mold-link-check.rs
+        rustc /tmp/mold-link-check.rs \
+          -C linker=clang \
+          -C link-arg=--ld-path=/usr/bin/mold \
+          -o /tmp/mold-link-check
+        test "$(/tmp/mold-link-check)" = "mold-link-ok"
+
+    - name: Export mold RUSTFLAGS
+      if: >-
+        ${{ (inputs.mold == 'true' && runner.os == 'Linux')
+            || inputs.extra_rustflags != '' }}
+      shell: bash
+      env:
+        MOLD_RUSTFLAGS: "-C linker=clang -C link-arg=--ld-path=/usr/bin/mold"
+        USE_MOLD: ${{ inputs.mold == 'true' && runner.os == 'Linux' }}
+        EXTRA_RUSTFLAGS: ${{ inputs.extra_rustflags }}
+      run: |
+        # Compose the whole value here so exactly one place owns it. Order:
+        # mold linker flags, then the job's extra flags, then anything an
+        # earlier step already exported. A job-level `env: RUSTFLAGS:` would
+        # shadow this write for every later step (job env is re-applied per
+        # step, on top of $GITHUB_ENV), which is why jobs pass their flags
+        # through `extra_rustflags` instead and ws12 enforces it.
+        flags=""
+        if [[ "${USE_MOLD}" == "true" ]]; then
+          flags="${MOLD_RUSTFLAGS}"
+        fi
+        if [[ -n "${EXTRA_RUSTFLAGS}" ]]; then
+          flags="${flags:+${flags} }${EXTRA_RUSTFLAGS}"
+        fi
+        echo "RUSTFLAGS=${flags}${RUSTFLAGS:+ ${RUSTFLAGS}}" >> "$GITHUB_ENV"

.github/dist-build-setup.yml

@@ -1,3 +1,14 @@
+- name: Install Rust through the repo's single setup path
+  # cargo-dist re-includes this fragment on every regeneration
+  # (github-build-setup in [workspace.metadata.dist]), so unlike an inline
+  # step it survives `dist generate` — which is why the bootstrap belongs
+  # here rather than as a hand-edited `curl | sh` in the generated workflow.
+  # Container images ship without cargo; hosted runners already have it and
+  # resolve rust-toolchain.toml themselves, so this mirrors the previous
+  # step's condition exactly rather than changing release behaviour.
+  if: ${{ matrix.container }}
+  uses: ./.github/actions/setup-rust
+
 - name: Install Node.js for the embedded WebUI
   uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4
   with:

.github/workflows/code_style.yml

@@ -83,7 +83,7 @@ jobs:
             echo "has_clippy=false" >> "$GITHUB_OUTPUT"
           fi
 
-          if printf '%s\n' "$CHANGED_FILES" | grep -Eq '^(crates/|tests/|migrations/|Cargo\.toml$|Cargo\.lock$|deny\.toml$|Dockerfile|\.gitignore$|scripts/ci/|\.githooks/|docker/reborn/entrypoint\.sh$|scripts/reborn_webui_v2_live_qa/|scripts/live-canary/|\.github/workflows/(live-canary|reborn-e2e)\.yml$|scripts/check_no_panics\.py$|scripts/no_panics_reborn_baseline\.txt$|scripts/(check|test-check)-type-duplicates\.py$|\.github/scripts/(pr-labeler|test-pr-labeler)\.sh$|\.github/workflows/(code_style|main-ci-slack-alerts)\.yml$|\.github/workflows/ironclaw-release\.yml$)'; then
+          if printf '%s\n' "$CHANGED_FILES" | grep -Eq '^(crates/|tests/|migrations/|Cargo\.toml$|Cargo\.lock$|deny\.toml$|Dockerfile|\.gitignore$|scripts/ci/|\.githooks/|docker/reborn/entrypoint\.sh$|scripts/reborn_webui_v2_live_qa/|scripts/live-canary/|\.github/workflows/(live-canary|reborn-e2e)\.yml$|scripts/check_no_panics\.py$|scripts/no_panics_reborn_baseline\.txt$|scripts/(check|test-check)-type-duplicates\.py$|\.github/scripts/(pr-labeler|test-pr-labeler)\.sh$|\.github/workflows/(code_style|main-ci-slack-alerts)\.yml$|\.github/workflows/ironclaw-release\.yml$|rust-toolchain\.toml$|\.github/actions/setup-rust/)'; then
             echo "has_code=true" >> "$GITHUB_OUTPUT"
           else
             echo "has_code=false" >> "$GITHUB_OUTPUT"
@@ -162,7 +162,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+        uses: ./.github/actions/setup-rust
         with:
           components: rustfmt
       - name: Install Python
@@ -354,7 +354,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+        uses: ./.github/actions/setup-rust
         with:
           components: clippy
       - name: Enable pnpm for setup-node cache
@@ -456,7 +456,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+        uses: ./.github/actions/setup-rust
         with:
           components: clippy
       - name: Enable pnpm for setup-node cache
@@ -503,7 +503,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+        uses: ./.github/actions/setup-rust
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"

.github/workflows/coverage.yml

@@ -51,12 +51,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 90
     env:
-      CARGO_PROFILE_DEV_DEBUG: 0
-      CARGO_PROFILE_TEST_DEBUG: 0
       # LLVM 21.1.3 predates these now-stable APIs used by current dependencies.
       # Coverage-only compatibility; ordinary CI remains the MSRV authority.
       RUSTC_BOOTSTRAP: "1"
-      RUSTFLAGS: "-Zcrate-attr=feature(array_windows,debug_closure_helpers,slice_as_array)"
       # `--workspace` below runs BOTH root-package test tiers in one job: the
       # Reborn integration suites (tests/integration/*) and the root QA suites
       # (tests/reborn_qa_*). Both overrun libtest's 2 MiB default test-thread
@@ -113,9 +110,13 @@ jobs:
           docker system prune -af || true
           df -h
 
-      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # branch coverage
+      - uses: ./.github/actions/setup-rust
         with:
           toolchain: nightly-2025-11-01
+          # Nightly crate attributes for the instrumented build. They belong
+          # here rather than in a job-level `env: RUSTFLAGS:`, which would
+          # split ownership of the variable with the composite.
+          extra_rustflags: "-Zcrate-attr=feature(array_windows,debug_closure_helpers,slice_as_array)"
           components: llvm-tools-preview
           targets: wasm32-wasip2
 
@@ -206,7 +207,6 @@ jobs:
     env:
       # Keep the shipping binary on the same crash-safe coverage toolchain.
       RUSTC_BOOTSTRAP: "1"
-      RUSTFLAGS: "-Zcrate-attr=feature(array_windows,debug_closure_helpers,slice_as_array)"
     permissions:
       id-token: write
       contents: read
@@ -222,9 +222,13 @@ jobs:
           docker system prune -af || true
           df -h
 
-      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # branch coverage
+      - uses: ./.github/actions/setup-rust
         with:
           toolchain: nightly-2025-11-01
+          # Nightly crate attributes for the instrumented build. They belong
+          # here rather than in a job-level `env: RUSTFLAGS:`, which would
+          # split ownership of the variable with the composite.
+          extra_rustflags: "-Zcrate-attr=feature(array_windows,debug_closure_helpers,slice_as_array)"
           components: llvm-tools-preview
           targets: wasm32-wasip2
 

.github/workflows/ironclaw-release.yml

@@ -126,13 +126,16 @@ jobs:
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: "3.12"
-      - name: Install Rust non-interactively if not already installed
+      - name: Install Rust through the repo's single setup path
+        # Mirrors .github/dist-build-setup.yml, which cargo-dist re-inlines
+        # here on `dist generate`. Both must carry it: the fragment so a
+        # regeneration keeps it, this file because the checked-in workflow is
+        # what actually runs. validate_release_workflow_installs_rust asserts
+        # the presence here, since the absence-only bootstrap checks happily
+        # passed a version of this file with no Rust install at all.
         if: ${{ matrix.container }}
-        run: |
-          if ! command -v cargo > /dev/null 2>&1; then
-            curl --proto '=https' --tlsv1.2 --max-time 120 -sSf https://sh.rustup.rs | sh -s -- -y
-            echo "$HOME/.cargo/bin" >> $GITHUB_PATH
-          fi
+        uses: ./.github/actions/setup-rust
+
       - name: "Install Node.js for the embedded WebUI"
         uses: "actions/setup-node@820762786026740c76f36085b0efc47a31fe5020"
         with:

.github/workflows/ironclaw-stress.yml

@@ -47,7 +47,6 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
-  CARGO_PROFILE_RELEASE_DEBUG: 0
   IRONCLAW_DISABLE_OS_KEYCHAIN: "1"
 
 jobs:
@@ -62,7 +61,7 @@ jobs:
           persist-credentials: false
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+        uses: ./.github/actions/setup-rust
 
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
@@ -141,7 +140,7 @@ jobs:
           persist-credentials: false
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+        uses: ./.github/actions/setup-rust
 
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
@@ -187,7 +186,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+        uses: ./.github/actions/setup-rust
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           key: ironclaw-stress-soak
@@ -221,7 +220,6 @@ jobs:
     timeout-minutes: 60
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     env:
-      CARGO_PROFILE_RELEASE_DEBUG: 0
       IRONCLAW_DISABLE_OS_KEYCHAIN: "1"
       SECRETS_MASTER_KEY: stress-ci-secret-master-key-0123456789abcdef
       IRONCLAW_REBORN_RUNNER_WORKER_COUNT: "0"
@@ -237,7 +235,7 @@ jobs:
           persist-credentials: false
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+        uses: ./.github/actions/setup-rust
 
       - name: Install Node.js for WebUI bundle build
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v4
@@ -436,7 +434,6 @@ jobs:
           --health-timeout 5s
           --health-retries 5
     env:
-      CARGO_PROFILE_RELEASE_DEBUG: 0
       IRONCLAW_DISABLE_OS_KEYCHAIN: "1"
       IRONCLAW_REBORN_POSTGRES_URL: postgres://postgres:postgres@localhost:5432/ironclaw_stress
       IRONCLAW_REBORN_SECRET_MASTER_KEY: stress-ci-secret-master-key-0123456789abcdef
@@ -455,7 +452,7 @@ jobs:
           persist-credentials: false
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+        uses: ./.github/actions/setup-rust
 
       - name: Install Node.js for WebUI bundle build
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v4