ci(HUB-0000): drop unused workflows and harden CI - #100

Trims the fork's GitHub Actions to what it uses and fixes the setup step that currently fails every Rust job.

Review ci.yml first, then the deletions.

Why now

#90 moved to extractions/setup-just@v4, which calls extractions/setup-crate, and the repo's action allowlist doesn't include it, so every job that installs just failed at "Set up job". #68 pinned setup-just back to v2 and setup-rust-toolchain back to v1 as a stopgap. This PR keeps setup-rust-toolchain on v2 and removes setup-just entirely, so it also drops #68's two Renovate allowedVersions caps (<4 for setup-just, <2 for setup-rust-toolchain). CI now installs just (and cargo-machete) with taiki-e/install-action, which is already on the allowlist.

Removed

The vouch data files (VOUCHED.td, issue-unvouched-message, DISCUSSION_TEMPLATE/) and the release recipes in justfile and MAINTENANCE.md stay. They do nothing on their own, and leaving them avoids modify/delete conflicts on each upstream sync.

The Security Audit workflow's weekly schedule is gone too. It has never run here, and on a schedule rustsec/audit-check opens issues, which needs issues: write. RustSec still runs on any PR that touches the dependency graph, and Cycode's Vulnerable Dependencies check runs on every PR.

Kept

fmt, clippy, typos, lockfile (advisory), machete, msrv, check-wasm, test-linux, test-mac, test-windows, check-examples, the two Security Audit jobs, and Cycode (an app, not a workflow).

Improvements

• One required check, CI Required. A rollup job that fails when any CI job fails or is cancelled. A skipped Rust job passes only when orchestrate chose to skip the Rust jobs. Branch protection can require this one name, and jobs can be renamed or added without touching the ruleset.
• CI changes run the Rust jobs. The old orchestrate filter skipped every Rust job when only .github/workflows/ changed, so action bumps (chore(deps): update github-actions #68, chore(deps): update github-actions (major) #90) went untested. Now a PR skips the Rust jobs only when every changed file is docs or repo metadata (docs/, root *.md, CODEOWNERS, templates, Renovate config, vouch data, audit.yml). Anything else, including ci.yml, runs everything. The filter diffs the PR merge commit against its first parent (fetch-depth: 2) instead of fetching 350 commits.
• One run/skip decision instead of two. The old run_style flag matched only .rs/.toml, so a Cargo.lock-only PR (lock-file maintenance) skipped clippy, msrv, machete and check-wasm.
• Runs where it matters. CI ran on pushes to main (the upstream mirror) and never on unity/hub-consolidated. It now runs on pushes to unity/hub-consolidated and unity/hub-4.0, not main. msrv, check-wasm and check-examples were PR-only; they now run on those pushes too.
• A Rust cache PRs can use. Only those branch pushes save caches; PRs restore the base branch's entry. Before, each PR saved its own ~0.6 to 1 GB entries that no other PR could read; the repo is at its 10 GB cache limit with 23 PR-scoped entries, and since the base branch never ran CI, every PR built cold.
• One cache step per job. setup-rust-toolchain@v2 already runs Swatinem/rust-cache, so the extra rust-cache steps ran it twice. They're gone; jobs that compile nothing (fmt, lockfile, machete) no longer cache at all.
• timeout-minutes on every job (5 to 60, roughly 3 to 5x a cold run), so a hung runner stops early instead of running for 6 hours.
• Concurrency. A new push to a PR cancels its older run; branch pushes each keep their own run. Same for Security Audit.
• Least privilege. Both workflows default to contents: read; checks: write moved from the whole audit workflow to the cargo-audit job that needs it.
• Warnings on setup-rust-toolchain v2. v1 set RUSTFLAGS=-D warnings, so rustc warnings failed the build and test jobs on every platform. v2 (from chore(deps): update github-actions (major) #90) instead sets CARGO_BUILD_WARNINGS=deny. That also fails every build on cargo 1.100's manifest lints (unused dependencies, missing [lints]) in upstream crates, so the base has never been green on v2. This PR sets CARGO_BUILD_WARNINGS: warn workflow-wide and passes rustflags: -D warnings to the jobs that compile (clippy, msrv, test-linux, test-mac, test-windows, check-examples), as v1 did. Rustc warnings stay fatal on all three platforms; cargo manifest lints only warn. Like v1, RUSTFLAGS replaces the rustflags in .cargo/config.toml for those jobs.
• check-wasm installs nightly, rust-src and the wasm target through setup-rust-toolchain. It gets no -D warnings, as before, because RUSTFLAGS would override the atomics flags the just recipe sets.
• Security Audit also runs when audit.toml, deny.toml or the workflow itself changes.

toolchain: 1.95.0 in msrv still equals rust-version = "1.95" in crates/gpui/Cargo.toml and msrv in the justfile.

Branch protection

The protect-unity-branches ruleset requires no status checks today, so nothing here breaks it. After merge, add a "Require status checks to pass" rule naming CI Required (from GitHub Actions) for unity/hub-consolidated and unity/hub-4.0. Optionally add the Cycode checks too.

How to test

• This PR changes ci.yml, so every Rust job runs on it; see the checks below.
• actionlint passes on both workflows.
• Filter logic checked locally: docs-only changes skip; ci.yml, Cargo.lock, crates/gpui/README.md and an empty diff all run.

Not tested: a docs-only PR (the skip path of CI Required) and the cache save on a branch push. Both show up on the first such PR and the push after merge.

🤖 Generated with Claude Code