EDGEAI-1554: Re-pin shared CI, and run advisories ungated - #194

Picks up EdgeFirstAI/.github#26 — a9b62d89 → 797eea74 — plus two fixes and a restructure.

1. The nightly gate now actually gates

It applied its "has main moved" check only on schedule, so a workflow_dispatch bypassed it silently. It also compared against the last successful run, and hal's last green nightly on main was 2025-12-08 — so every comparison since has been against a December commit and the gate has never once skipped.

Now: every trigger, compared against the last run that reached a verdict (success or failure; cancelled and friends are discarded, since a run killed before its lanes start proves nothing). A force input is forwarded for deliberately re-running an unchanged commit. The || false fallback is load-bearing — inputs is null on a schedule trigger.

2. cargo audit runs ungated

It moved out of rust-full into advisories.yml and is called without needs: changed. Every other lane asks a question about the code; this one asks about the RustSec database, which moves whether the code does or not. The 2026-09-15 nightly failed on RUSTSEC-2026-0204 against a Cargo.lock nobody had touched — a gated lane would have gone quiet exactly then.

Free hard-coded runner, parses Cargo.lock without building. With #193 merged this should now be green.

nightly-extra is also gone for hal: with audit removed it is only the hack lane, which skips when hack-args is empty. It used to boot a runner and install two tools to run the audit alone.

3. fetch-angle.sh — the macOS failure

Root cause, and it was never about the release asset:

mv "${DEST}"/dist/* "${DEST}"/ 2>/dev/null || true

When ${DEST}/EGL.xcframework already exists — which a partially restored target/ cache leaves behind — mv refuses to merge one directory into another and fails. The redirect hid the message, || true hid the status, so the payload stayed in ${DEST}/dist and the script ran on to fail in the cp with "No such file or directory" for a path the zip definitely contains.

That is why the same commit passed at 21:12 and failed at 00:57: the first had a cache hit and skipped the flatten entirely. Windows and iOS use the same script and the same release and were never affected.

Now: extract to a staging dir and move each item in deliberately, replacing what is there; verify both framework binaries afterwards and fail naming the missing path; require both binaries for the "already extracted" short-circuit, since checking only EGL let a half-populated directory look complete; drop a stale flat-lib on re-extract.

Reproduced against the real v2.1.28252 package — the old logic fails with the exact CI error and leaves dist/ behind; the new logic passes from a partial cache, a clean directory, a warm cache and a corrupted one.

4. Mutation testing moves to its own workflow

The corpus is ~7057 mutants, roughly 39 hours of work:

As a nightly job it capped at 120 minutes, got through 5%, never once completed, and held the run open for two hours after every other lane finished — which also blocked log retrieval for lanes that had already failed. Everything else in the nightly finishes in 27 minutes.

mutants.yml now tests a rotating window of shards each night on its own schedule. Parallelism is a matrix of runners, not cargo-mutants' --jobs — that is documented as incompatible with --in-place, since parallel jobs on one machine each need their own tree and target directory at "often 2GB+", which does not fit one runner's ~14GB disk. A matrix gives every shard a whole machine, so --in-place stays valid.

Free standard runners, and no coverage instrumentation — by design, not omission. A mutant is caught when a test fails, so which lines ran is irrelevant.

A bug found while verifying the rotation

Walking the window by date looked obvious, but snapping to window-aligned blocks strands the tail whenever the window does not divide the shard count. At 64 shards with a window of 10, integer division gives 6 blocks covering 0..59 and shards 60-63 are never tested at all — silently.

Fixed by walking the start one window per night modulo the total. Verified by extracting the plan step verbatim from the YAML and simulating consecutive nights:

total=64 window=8    full coverage after 8 nights   <- the default, exact sweep
total=64 window=10   full coverage after 7 nights
total=64 window=12   full coverage after 6 nights
total=10 window=3    full coverage after 4 nights

Not yet verified

workflow_dispatch is unavailable for a workflow that is not on the default branch, so mutants.yml cannot be test-run until this merges — its first real execution will be the first scheduled one. The shard arithmetic is verified; the cargo mutants --shard invocation and per-shard timing on a free runner are not.

ci:full is on this PR so the macOS lanes actually exercise the fetch-angle.sh fix; Quick does not run macOS.