rust-test.yml

name: Rust Tests
on:
  push:
    branches:
      - main
  pull_request:
    paths:
      - crates/**
      - Cargo.toml
      - Cargo.lock
      - .github/workflows/rust-test.yml

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: "-C debuginfo=1 -C target-cpu=x86-64-v3"
  RUST_BACKTRACE: "1"
  CARGO_INCREMENTAL: "0"

# Least-privilege: these jobs only read the repo (checkout + build + test).
# Codecov upload uses its own token secret and is non-fatal (fail_ci_if_error: false).
permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    env:
      # Override the workflow-level debuginfo=1 for this job too (parity with
      # test-with-coverage, TD-CI-COVERAGE-MOLD-1). The `test` job links the
      # full lance+datafusion integration-test set at the SAME disk/RSS cliff
      # the coverage job hit — and #507 (+4055 lines across causal-edge +
      # cognitive-shader-driver: ce64-v2 layout + MailboxSoaOwner/
      # SurrealMailboxView) grew that link footprint enough to tip the
      # previously-marginal link into a hard `ld` SIGBUS (signal 7 = object
      # file truncated when the runner partition fills mid-link). debuginfo=1
      # carried no value here (CI never opens a debugger); dropping it cut the
      # coverage job's per-binary link from ~930 MB to ~252 MB (-73%, measured
      # in b56bb2cd) and relieves BOTH ceilings (mold/GNU-ld RSS + disk). mold
      # is already installed below. Note: a job-level RUSTFLAGS gives this job
      # its own Swatinem cache key — the first run after this change
      # repopulates the test cache.
      RUSTFLAGS: "-C debuginfo=0 -C target-cpu=x86-64-v3"
    defaults:
      run:
        working-directory: lance-graph
    steps:
      - uses: actions/checkout@v4
        with:
          path: lance-graph
      - name: Checkout AdaWorldAPI/ndarray (sibling dependency)
        uses: actions/checkout@v4
        with:
          repository: AdaWorldAPI/ndarray
          # ndarray master now exports wht_f32, kmeans, squared_l2,
          # dequantize_i8_to_f32, quantize_f32_to_i2, dequantize_i2_to_f32
          # publicly (ndarray PR #115, merged 2026-04-30). Pin retired.
          path: ndarray
      - name: Checkout AdaWorldAPI/OGAR (sibling dependency, NO-PIN path deps)
        uses: actions/checkout@v4
        with:
          repository: AdaWorldAPI/OGAR
          path: OGAR
      # Toolchain comes from `rust-toolchain.toml` (channel + components), NOT
      # from a version restated here. `rustup show` installs and activates
      # whatever that file pins — so a bump is ONE edit in ONE file, which is
      # exactly what that file's own comment asks for ("a bump edits `channel`
      # and leaves the prose behind"). Previously this installed `stable` and
      # set it as default; inside the repo the toolchain file won anyway, so
      # these jobs already ran on the pin while the workflow said otherwise.
      - name: Setup rust toolchain (pinned by rust-toolchain.toml)
        run: rustup show
      - name: Setup mold linker
        # Heavy lance+datafusion integration-test binaries OOM the default GNU `ld`
        # at the `cargo test --no-run` link step (intermittent). mold links them
        # fast + low-memory (already used by release.yml / rust-publish.yml).
        uses: rui314/setup-mold@9c9c13bf4c3f1adef0cc596abc155580bcb04444 # v1
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: "lance-graph-deps"
          workspaces: |
            lance-graph/crates/lance-graph
      - name: Install dependencies
        run: |
          sudo apt update
          sudo apt install -y protobuf-compiler
      - name: Build tests
        run: cargo test --manifest-path crates/lance-graph/Cargo.toml --no-run
      - name: Run unit tests
        run: cargo test --manifest-path crates/lance-graph/Cargo.toml --lib
      - name: Run doc tests
        run: cargo test --manifest-path crates/lance-graph/Cargo.toml --doc
      # lance-graph-contract is the zero-dep trait crate every workspace
      # consumer (planner, callcenter, shader-driver, ...) depends on.
      # Its clippy gate (style.yml) catches type errors but does NOT
      # execute tests, so a logically-broken assertion can ship green —
      # PR #322's `log_norm_growth_negative_when_m_attenuates` slipped
      # through exactly this way and was caught only after merge.
      # Adding the test gate here closes that hole. Cost is minimal:
      # zero-dep crate, ~1 s build + <1 s test execution, reuses the
      # already-installed toolchain and Swatinem cache from above.
      - name: Run contract unit tests
        run: cargo test --manifest-path crates/lance-graph-contract/Cargo.toml --lib
      # Per PR #431 review: the `compile_fail` typestate proofs in
      # `tests/cognition_typestate.rs` and the integration test bodies
      # themselves were silently un-gated by `--lib`. Adding `--tests`
      # picks up the integration crate; `--doc` picks up doctest /
      # compile_fail blocks in library modules.
      - name: Run contract integration tests
        run: cargo test --manifest-path crates/lance-graph-contract/Cargo.toml --tests
      - name: Run contract doctests
        run: cargo test --manifest-path crates/lance-graph-contract/Cargo.toml --doc
      # weather-poc is workspace-EXCLUDED. A new workflow introduced by the
      # same pull request cannot gate that pull request because `pull_request`
      # workflow selection comes from the base branch. Run both surfaces here
      # so D-WXS-4's zero-dep codec and its live NodeRow agreement are tested
      # before merge, not one merge later.
      - name: Run weather-poc tests (zero-dependency codec)
        run: cargo test --manifest-path crates/weather-poc/Cargo.toml
      - name: Run weather-poc canonical-row agreement tests
        run: cargo test --manifest-path crates/weather-poc/Cargo.toml --features canonical-row
      # lance-graph-ogar is the workspace-EXCLUDED armed tier: it owns the
      # mirror<->live-vocab codebook-parity check (`assert_codebook_parity`:
      # forward, reverse, and domain agreement — the compile-time COUNT_FUSE
      # was RETIRED 2026-08-14 in favor of this runtime bijection + per-plug
      # hotplug activation, see lance-graph-ogar's crate docs) against the
      # OGAR sibling checked out above. Without this step that check only
      # ever ran on a developer machine — a same-sized codebook remap would
      # ship green (codex/coderabbit finding on PR #658), and a stale mirror
      # row would ship silently (caught live 2026-08-23: a mirror commit
      # claiming 14 Ontology concepts were "minted in ogar-vocab" when OGAR
      # had never minted them). One scoped step closes both.
      - name: Run lance-graph-ogar codebook-parity + hotplug-activation tests (armed tier, OGAR sibling)
        run: cargo test --manifest-path crates/lance-graph-ogar/Cargo.toml
      # deepnsm: standalone 0-dep codec crate, workspace-excluded, so the
      # lance-graph test steps above never reached it. ~217 lib + integration +
      # doctests, fast (no lance/datafusion/ndarray deps). Gating.
      - name: Run deepnsm tests
        run: cargo test --manifest-path crates/deepnsm/Cargo.toml
      # deepnsm-v2: the palette256² rebuild of deepnsm (PR #798), a standalone
      # crate with a single path-dep on lance-graph-contract, workspace-excluded
      # like deepnsm — so the steps above never reach its 18 tests. Same blind-gate
      # posture as deepnsm; one scoped step arms it. Gating.
      - name: Run deepnsm-v2 tests
        run: cargo test --manifest-path crates/deepnsm-v2/Cargo.toml
      # lance-graph-supervisor: every test in the crate (including the W2b
      # real-owner probes over the production MailboxSoA, PR #634) is gated
      # behind the `supervisor` feature (ractor dep), so no step above ever
      # executes them — the exact "green CI that didn't test the real fuse"
      # membrane failure (E-SEMANTIC-OS-CONVERGENCE-1). Flagged by
      # coderabbit on #634. Cheap: contract + ractor + the shader-driver
      # dev-dep, no lance/datafusion.
      #
      # `cycle-driver` ADDED 2026-08-05. It is a SEPARATE feature that
      # `supervisor` does not imply, so the step above — despite being the
      # crate's own step — never compiled `cycle_driver`, the three
      # `probe_ignition*` / `d_ign_b_lenses` test binaries, or any of the #879
      # loop-closure contract. Measured: `--features supervisor` runs 13 tests;
      # `--features supervisor,cycle-driver` runs 43. The 30 in the gap include
      # `probe_ignition_64k_start_at_full_population` — the 64k-owner /
      # 17-sealed headline canonized as
      # E-64K-1TO1-OWNERS-IS-THE-MAIN-MODEL-1. #891 recorded this gap and
      # deliberately did not touch the workflow; #898 closed the same shape for
      # callcenter but not this one. One added feature closes it.
      #
      # Verified locally before landing: 43 passed, 0 failed. Strict superset of
      # what this step ran before, so it cannot lose coverage.
      - name: Run supervisor tests (W2b real-owner probes + #879 cycle driver)
        run: cargo test --manifest-path crates/lance-graph-supervisor/Cargo.toml --features supervisor,cycle-driver
      #
      # CLIPPY ARMED 2026-09-05 (TD-SUPERVISOR-CLIPPY-RED-ON-BASE-1, closed).
      # Same shape as sigker below: the crate was clippy-red on arrival, so the
      # PR that found it (#1188) recorded the debt rather than widening itself
      # into a lint sweep. The nine findings are now fixed, so the gate is armed
      # in the same commit — an unarmed lint fix decays back, and this crate's
      # whole reason for being unlinted was that no step reached it under
      # `--features supervisor,cycle-driver`.
      #
      # What the debt row got wrong, corrected here from the measured output:
      # the eight `cycle_driver.rs` findings are `unnecessary_mut_passed` at the
      # CALL SITES, not `needless_pass_by_ref_mut` on the signature —
      # `recover_fleet` already takes `sink: &S`, and eight `#[cfg(test)]`
      # callers passed `&mut sink` into it. The ninth is `for_kv_map` in
      # `tests/probe_ignition_64k.rs`. All nine are in test code; none touches
      # the loop-closure contract.
      #
      # Verified locally before landing on the pinned 1.98.1: clippy clean,
      # 50 tests passed across 13 binaries, 0 failed, `fmt --check` clean.
      - name: Lint supervisor (gated features, so root clippy never reaches them)
        run: |
          cargo clippy --manifest-path crates/lance-graph-supervisor/Cargo.toml \
            --features supervisor,cycle-driver --all-targets -- -D warnings
      # causal-edge: workspace-EXCLUDED, but a path-dep of lance-graph,
      # lance-graph-planner, cognitive-shader-driver and sigma-tier-router — so
      # its LIB already compiles inside gated builds while its TESTS ran
      # nowhere but on a developer machine. #981 landed a #[test] here and this
      # PR lands two falsifiers here; none of them could ever have gone red in
      # CI. Same "blind gate" closed above for deepnsm / supervisor /
      # bgz-tensor, one crate at a time.
      #
      # Verified locally before landing: 75 passed, 0 failed.
      #
      # Deliberately TESTS ONLY. A `clippy -D warnings` step would be red on
      # arrival: the crate carries 7 pre-existing findings, all in edge.rs /
      # tables.rs / v2_layout_tests.rs and NONE in the edge_v3.rs this PR
      # touches. Gating them here would fail this PR for defects it did not
      # introduce; they are recorded in ISSUES
      # ISS-CAUSAL-EDGE-CARRIES-SEVEN-PRE-EXISTING-CLIPPY-FINDINGS instead.
      - name: Run causal-edge tests (workspace-excluded, previously ungated)
        run: cargo test --manifest-path crates/causal-edge/Cargo.toml
      # bgz-tensor: workspace-EXCLUDED metric-algebraic codec crate (deps the
      # ndarray sibling checked out above + in-repo holograph). None of the
      # steps above reach it, so its 207 lib tests — including the V3
      # `morton_cascade` Fisher-z compute (E-MORTON-CASCADE-V3-1) — only ever
      # ran on a developer machine. A green CI that never built the new module
      # is exactly the "blind gate" this repo has repeatedly closed
      # (deepnsm / supervisor / ogar above). One scoped step arms it. Gating.
      - name: Run bgz-tensor tests (workspace-excluded, ndarray sibling)
        run: cargo test --manifest-path crates/bgz-tensor/Cargo.toml --lib
      # sigker: workspace-EXCLUDED path-signature codec (mandatory path dep on
      # the ndarray sibling checked out above). None of the steps above reach
      # it, so its 62 tests only ever ran on a developer machine — including
      # the two W1.5 consumer wirings that are the whole point of the crate
      # today: kernel.rs's signature_pde_sweep delegation (ndarray PR #293) and
      # randomized.rs's randomized_signature_sweep delegation (ndarray PR #294).
      # A parity test against a scalar oracle that CI never runs is not a gate.
      # Same "blind gate" closed above for deepnsm / supervisor / causal-edge /
      # bgz-tensor, one crate at a time.
      #
      # Verified locally before landing: 62 passed, 0 failed.
      #
      # TESTS + CLIPPY. This step was tests-only when first added, because the
      # crate was clippy-red on arrival (TD-SIGKER-CLIPPY-RED-ON-BASE-1) and
      # gating it would have failed that PR for a defect it did not introduce.
      # Both findings are now fixed, so the clippy half is armed here: a lint
      # fix with no gate decays back, and this crate's whole reason for being
      # unlinted was that no step reached it.
      #
      # Verified locally before landing: 62 tests passed, clippy clean.
      - name: Run sigker tests (workspace-excluded, ndarray sibling)
        run: cargo test --manifest-path crates/sigker/Cargo.toml
      - name: Lint sigker (workspace-excluded, so root clippy never reaches it)
        run: |
          cargo clippy --manifest-path crates/sigker/Cargo.toml \
            --all-targets -- -D warnings
      # lance-graph-callcenter UNDER `--features query` — the same blind gate as
      # supervisor above, but one level subtler: the crate was not merely
      # untested, it has `default = []`, so even a bare `cargo test` on it would
      # compile almost nothing and report a green it had not earned.
      #
      # Measured, not hypothetical. Running this combination by hand on
      # 2026-08-05 found 209 passed / 2 FAILED: the `graph_table` fixture minted
      # rows with the V1 `CLASSID_OSINT` while `OSINT_GOTHAM.classid` resolves to
      # `CLASSID_OSINT_V3` under the default `guid-v3-tail`, so
      # `project_snapshot`'s class filter matched zero of two rows and every
      # assertion ran against an empty snapshot (fixed in #897; recorded as
      # E-A-FEATURE-CONDITIONAL-CLASSID-SILENTLY-EMPTIED-A-FIXTURE-1). The same
      # feature gap had already produced a clippy EXIT=0 over never-compiled
      # `vsa_udfs` / `transcode::ontology_table` earlier the same day.
      #
      # 211 tests, ~2 min incremental. Gating.
      - name: Run callcenter tests --features query (blind-gate closure)
        run: cargo test --manifest-path crates/lance-graph-callcenter/Cargo.toml --features query --lib
      # Codex P2 (PR #861): the two self-asserting probe examples validate
      # their fixtures via assert! inside example main() — cargo test never
      # executes an example's main(), so those asserts only ever ran on a
      # developer's local `cargo run --example` invocation. Running the
      # examples explicitly here closes that blind-gate (same posture as
      # deepnsm / supervisor / bgz-tensor above).
      - name: Probe falsifier - eyes opened (fixture asserts)
        run: cargo run -p lance-graph-planner --example probe_eyes_opened
      - name: Probe falsifier - babel stances (fixture asserts)
        run: cargo run -p lance-graph-planner --example probe_babel_stances


  # ── Split out of `test` DELIBERATELY, before it broke ─────────────────────
  #
  # Everything below was added to the `test` job in this branch: the workspace
  # compile gate plus ten per-crate test steps for members that had no gate at
  # all. They accumulate their test binaries into one `target/`, and `test` is
  # a job with a MEASURED history at exactly that cliff — its own env block
  # records "a hard `ld` SIGBUS (signal 7 = object file truncated when the
  # runner partition fills mid-link)".
  #
  # Measured here (clean tree, manifest `debug = 0`): `cargo build --workspace`
  # costs 3.5 GB, `cargo test --workspace --no-run` costs 14 GB across 86
  # binaries — the same order as a runner's free disk. Adding a subset of that
  # to a job already known to have filled its partition is a bet with no upside.
  #
  # So `test` goes back to exactly the disk profile it had before this branch,
  # and every addition lives here with its own runner and its own cache key.
  # This is preventive: the split is cheaper than the flake it avoids, and a
  # flake here would be indistinguishable from a real failure.
  member-tests:
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    env:
      # Same reason as `test`: CI never opens a debugger, and debug info is
      # what pushes the link over the partition. See that job's env block.
      RUSTFLAGS: "-C debuginfo=0 -C target-cpu=x86-64-v3"
    defaults:
      run:
        working-directory: lance-graph
    steps:
      - uses: actions/checkout@v4
        with:
          path: lance-graph
      - name: Checkout AdaWorldAPI/ndarray (sibling dependency)
        uses: actions/checkout@v4
        with:
          repository: AdaWorldAPI/ndarray
          path: ndarray
      - name: Checkout AdaWorldAPI/OGAR (sibling dependency, NO-PIN path deps)
        uses: actions/checkout@v4
        with:
          repository: AdaWorldAPI/OGAR
          path: OGAR
      - name: Setup rust toolchain (pinned by rust-toolchain.toml)
        run: rustup show
      - name: Setup mold linker
        uses: rui314/setup-mold@9c9c13bf4c3f1adef0cc596abc155580bcb04444 # v1
      # Its OWN cache key. Sharing `lance-graph-deps` with `test` would have two
      # jobs writing different contents under one key and thrashing it.
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: "lance-graph-members"
          workspaces: |
            lance-graph
      - name: Install dependencies
        run: |
          sudo apt update
          sudo apt install -y protobuf-compiler
      # ── The structural net: every member, present and future ─────────────
      #
      # The per-crate steps below are a hand-maintained allowlist, and that is
      # exactly how `lance-graph-hydrate` reached `main` un-compiling: it was a
      # workspace MEMBER, but membership gates nothing when no job says
      # `--workspace`. This step is the net that needs no maintenance — a member
      # added tomorrow is covered the moment it is listed in `[workspace]`.
      #
      # Measured before landing (2026-08-22, clean tree, `[profile.dev]
      # debug = 0` from the manifest):
      #
      #   cargo build --workspace           exit 0, 6m18s, target/ 3.5 GB
      #   cargo test  --workspace --no-run  exit 0, target/ 14 GB, 86 binaries
      #
      # BUILD and not TEST, and the reason is the second row. The test scope
      # SUCCEEDS — an earlier ENOSPC was against a target already holding 15 GB
      # of debug-laden artifacts from builds predating the manifest default, and
      # measured that tree rather than the test scope. What rules it out here is
      # size: linking every member's test binaries costs 14 GB, which is the
      # same order as a GitHub runner's free disk. The compile costs 3.5 GB.
      #
      # KNOWN RISK, stated rather than discovered later: the per-crate test
      # steps below run in THIS job and accumulate their test binaries into the
      # same `target/`. They are a subset of those 14 GB, so this job's disk
      # headroom is not proven — only the workspace compile is. If the job ever
      # fails on disk, the fix is to split the per-crate tests into their own
      # job (or `cargo clean -p` between them), not to drop the gate.
      #
      # A new member's TESTS therefore still need a line below. That edge
      # disappears if the runner is ever measured to hold the 14 GB, at which
      # point these ten steps collapse into one.
      - name: Build every workspace member (structural gate)
        run: cargo build --workspace

      # ── The rest of the allowlist gap, closed in one pass ────────────────
      #
      # No workflow here runs `--workspace`, so `[workspace] members` gates
      # nothing and ELEVEN of 25 members were reached by no job at all
      # (EPIPHANIES E-THE-GATE-IS-A-HAND-MAINTAINED-ALLOWLIST-NOT-THE-WORKSPACE-1,
      # ISSUES ISS-CI-GATE-IS-AN-ALLOWLIST-NINE-MEMBERS-UNGATED). Two of them
      # (catalog, planner) are deps of lance-graph, so their LIBS compiled
      # inside a gated build while their tests ran nowhere; the others compiled
      # nowhere at all. That is how `lance-graph-hydrate` reached `main`
      # un-compiling.
      #
      # Every step below was RUN LOCALLY on the pinned toolchain before being
      # added, and the count in each comment is what it returned. A gate is
      # only added for a crate that is green; nothing here is armed on hope.
      - name: Run catalog tests (previously ungated)          # 12 + 15 green
        run: cargo test --manifest-path crates/lance-graph-catalog/Cargo.toml
      - name: Run planner tests (previously ungated)          # 368 + 4 green, 6 ignored
        run: cargo test --manifest-path crates/lance-graph-planner/Cargo.toml
      - name: Run ontology tests (previously ungated)         # 276 + 2 + 6 green
        run: cargo test --manifest-path crates/lance-graph-ontology/Cargo.toml
      - name: Run rbac tests (previously ungated)             # 23 green
        run: cargo test --manifest-path crates/lance-graph-rbac/Cargo.toml
      - name: Run archetype tests (previously ungated)        # 16 green
        run: cargo test --manifest-path crates/lance-graph-archetype/Cargo.toml
      - name: Run consumer-conformance tests (previously ungated)  # 8 green, 2 ignored
        run: cargo test --manifest-path crates/lance-graph-consumer-conformance/Cargo.toml
      - name: Run sigma-tier-router tests (previously ungated)     # 20 green
        run: cargo test --manifest-path crates/sigma-tier-router/Cargo.toml
      - name: Run neural-debug tests (previously ungated)     # 11 green
        run: cargo test --manifest-path crates/neural-debug/Cargo.toml
      - name: Run shader-driver tests (previously ungated)    # 107 + 2 green
        run: cargo test --manifest-path crates/cognitive-shader-driver/Cargo.toml
      # lance-graph-benches carries NO tests — it is a benches-only crate with
      # one `harness = false` target (`graph_execution`). `cargo test` on it
      # runs zero tests and would be a gate that cannot fail; the meaningful
      # check is that the bench target still COMPILES, which is the same shape
      # build.yml already uses for lance-graph's own benches.
      - name: Check benches compile (previously ungated)      # no tests by design
        run: cargo check --manifest-path crates/lance-graph-benches/Cargo.toml --benches
      # lance-graph-hydrate: the crate this whole sweep came out of. It is a
      # workspace MEMBER and did not compile at #981 — `object_store 0.13.2`, a
      # semver-compatible release already in the lockfile, moved `get`/`put`
      # onto `ObjectStoreExt`. The compile fix rides with the crate's own PR
      # (claude/hydrate-from-zip); the GATE belongs here with the other nine.
      - name: Run hydrate tests (previously ungated)          # 33 green
        run: cargo test --manifest-path crates/lance-graph-hydrate/Cargo.toml
      # These two were missed by the FIRST sweep on this branch, and the miss was
      # in the measuring, not the workflow: the check extracted members with
      # `"crates/[a-z0-9-]+"` — no underscore — so `surreal_container` was never
      # in the list, and `tools/dto-class-check` is not under `crates/` at all.
      # The claim "every member is gated" was therefore false when it was made.
      # A membership check that cannot see two of its inputs is the same shape
      # as a gate that cannot fire.
      - name: Run surreal_container tests (missed by the first sweep)   # 5 + 5 green
        run: cargo test --manifest-path crates/surreal_container/Cargo.toml
      - name: Run dto-class-check tests (missed by the first sweep)     # 1 green
        run: cargo test --manifest-path tools/dto-class-check/Cargo.toml

  test-with-coverage:
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    env:
      # Override the workflow-level debuginfo=1 for this job only. llvm-cov
      # coverage lives in __llvm_covmap/__llvm_prf_* ELF sections, NOT in
      # DWARF (verified locally: 600/600 contract tests pass under
      # `-C instrument-coverage -C debuginfo=0`, covmap sections present,
      # .profraw emitted). At debuginfo=1 each of the 17 instrumented
      # integration-test binaries links to ~930 MB (measured; ~252 MB at
      # debuginfo=0, -73%) — the full set + deps tree sits exactly at the
      # hosted runner's disk/RSS cliff, which is the 2/50 intermittent
      # exit-101 (TD-CI-COVERAGE-MOLD-1). Dropping debuginfo relieves BOTH
      # ceilings (GNU-ld/mold RSS at link, and disk). Note: a job-level
      # RUSTFLAGS gives this job its own Swatinem cache key — the first run
      # after this change repopulates the coverage cache.
      RUSTFLAGS: "-C debuginfo=0 -C target-cpu=x86-64-v3"
    defaults:
      run:
        working-directory: lance-graph
    steps:
      - uses: actions/checkout@v4
        with:
          path: lance-graph
      - name: Checkout AdaWorldAPI/ndarray (sibling dependency)
        uses: actions/checkout@v4
        with:
          repository: AdaWorldAPI/ndarray
          # ndarray master now exports wht_f32, kmeans, squared_l2,
          # dequantize_i8_to_f32, quantize_f32_to_i2, dequantize_i2_to_f32
          # publicly (ndarray PR #115, merged 2026-04-30). Pin retired.
          path: ndarray
      - name: Checkout AdaWorldAPI/OGAR (sibling dependency, NO-PIN path deps)
        uses: actions/checkout@v4
        with:
          repository: AdaWorldAPI/OGAR
          path: OGAR
      # Toolchain comes from `rust-toolchain.toml` (channel + components), NOT
      # from a version restated here. `rustup show` installs and activates
      # whatever that file pins — so a bump is ONE edit in ONE file, which is
      # exactly what that file's own comment asks for ("a bump edits `channel`
      # and leaves the prose behind"). Previously this installed `stable` and
      # set it as default; inside the repo the toolchain file won anyway, so
      # these jobs already ran on the pin while the workflow said otherwise.
      - name: Setup rust toolchain (pinned by rust-toolchain.toml)
        run: rustup show
      - name: Setup mold linker
        # Parity with the `test` job above (TD-CI-COVERAGE-MOLD-1): the heavy
        # lance+datafusion test binaries OOM the default GNU `ld` at link
        # (intermittent) — and llvm-cov INSTRUMENTED binaries are larger, so
        # the OOM is MORE likely here than in the plain `test` job that already
        # has mold. Without this step the coverage job flaked while `test`
        # stayed green (2/50 runs). mold links them fast + low-memory.
        uses: rui314/setup-mold@9c9c13bf4c3f1adef0cc596abc155580bcb04444 # v1
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: "lance-graph-deps"
          workspaces: |
            lance-graph/crates/lance-graph
      - name: Install dependencies
        run: |
          sudo apt update
          sudo apt install -y protobuf-compiler
      - name: Install cargo-llvm-cov
        uses: taiki-e/install-action@cargo-llvm-cov
      - name: Run tests with coverage
        run: |
          cargo llvm-cov --manifest-path crates/lance-graph/Cargo.toml --lcov --output-path lcov.info
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v4
        with:
          files: lcov.info
          flags: rust-unittests
          fail_ci_if_error: false