ci(rust): skip unnecessary setup steps

.github/actions/utils/setup-rust-with-cache/action.yml

@@ -19,6 +19,14 @@ name: setup-rust-with-cache
 description: Setup Rust toolchain with Swatinem/rust-cache
 
 inputs:
+  install-nextest:
+    description: "Whether to install cargo-nextest"
+    required: false
+    default: "false"
+  install-system-dependencies:
+    description: "Whether to install system packages required to build or run Rust binaries"
+    required: false
+    default: "true"
   read-cache:
     description: "Whether to read from cache"
     required: false
@@ -54,15 +62,15 @@ runs:
       with:
         aggressive: ${{ inputs.free-disk-space-aggressive }}
 
-    - name: Install system dependencies (Linux)
-      if: runner.os == 'Linux'
+    - name: Install Rust build and runtime dependencies (Linux)
+      if: runner.os == 'Linux' && inputs.install-system-dependencies == 'true'
       run: |
         sudo apt-get update
         sudo apt-get install -y libhwloc-dev pkg-config libudev-dev
       shell: bash
 
-    - name: Install system dependencies (macOS)
-      if: runner.os == 'macOS'
+    - name: Install Rust build and runtime dependencies (macOS)
+      if: runner.os == 'macOS' && inputs.install-system-dependencies == 'true'
       run: |
         # Pin version of hwloc to 2.12.2_1
         # brew extract doesn't have this version, so we fetch the formula directly
@@ -117,10 +125,11 @@ runs:
       shell: bash
 
     - name: Install cargo-nextest
-      if: runner.os == 'Linux'
+      if: runner.os == 'Linux' && inputs.install-nextest == 'true'
       run: |
-        if command -v cargo-nextest &> /dev/null; then
-          echo "cargo-nextest already installed"
+        NEXTEST_VERSION="0.9.137"
+        if cargo nextest --version 2>/dev/null | grep -q "^cargo-nextest ${NEXTEST_VERSION}"; then
+          echo "cargo-nextest ${NEXTEST_VERSION} already installed"
           cargo nextest --version
           exit 0
         fi
@@ -130,18 +139,17 @@ runs:
           x86_64)  NEXTEST_PLATFORM="linux" ;;
           aarch64) NEXTEST_PLATFORM="linux-arm" ;;
           *)
-            echo "Unsupported architecture: $ARCH, skipping nextest"
-            exit 0
+            echo "::error::Unsupported architecture for cargo-nextest: $ARCH"
+            exit 1
             ;;
         esac
 
-        curl -LsSf "https://get.nexte.st/latest/${NEXTEST_PLATFORM}" | tar xzf - -C ${CARGO_HOME:-~/.cargo}/bin
+        curl -LsSf "https://get.nexte.st/${NEXTEST_VERSION}/${NEXTEST_PLATFORM}" |
+          tar xzf - -C ${CARGO_HOME:-~/.cargo}/bin
         cargo nextest --version
       shell: bash
-      continue-on-error: true
 
     - name: Configure Cargo for CI
-      if: inputs.read-cache == 'true'
       run: |
         echo "CARGO_INCREMENTAL=0" >> $GITHUB_ENV
         echo "CARGO_PROFILE_DEV_DEBUG=0" >> $GITHUB_ENV

.github/config/components.yml

@@ -174,8 +174,7 @@ components:
       - "sort"
       - "doctest"
       - "machete"
-      - "test-1"
-      - "test-2"
+      - "test"
       - "compat"
       - "build-aarch64-gnu"
       - "build-aarch64-musl"
@@ -497,7 +496,6 @@ components:
     paths:
       - "core/bench/dashboard/**"
       - "scripts/dashboard/**"
-    tasks: ["build"]
 
   # Core tools component
   rust-tools:

.github/workflows/_test.yml

@@ -62,18 +62,6 @@ jobs:
           task: ${{ inputs.task }}
           component: ${{ inputs.component }}
 
-      - name: Upload coverage to Codecov
-        if: startsWith(inputs.component, 'rust') && startsWith(inputs.task, 'test-')
-        uses: codecov/codecov-action@v7.0.0
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          files: codecov.json
-          disable_search: true
-          flags: rust
-          fail_ci_if_error: false
-          verbose: true
-          override_pr: ${{ github.event.pull_request.number }}
-
       # Python SDK
       - name: Set up Docker Buildx for Python
         if: inputs.component == 'sdk-python' && inputs.task == 'test'

.github/workflows/_test_rust.yml

@@ -0,0 +1,125 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: _test_rust
+on:
+  workflow_call:
+    inputs:
+      component:
+        type: string
+        required: true
+        description: "Rust component to test"
+      task:
+        type: string
+        required: true
+        description: "Rust task to run"
+    secrets:
+      CODECOV_TOKEN:
+        required: false
+
+permissions:
+  contents: read
+  security-events: write
+  pull-requests: write
+
+jobs:
+  run:
+    if: inputs.task != 'test'
+    uses: ./.github/workflows/_test.yml
+    with:
+      component: ${{ inputs.component }}
+      task: ${{ inputs.task }}
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+
+  build-rust-tests:
+    if: inputs.task == 'test'
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7.0.1
+
+      - name: Build and archive Rust tests
+        uses: ./.github/actions/rust/pre-merge
+        with:
+          task: test-build
+          component: ${{ inputs.component }}
+
+      - name: Upload build coverage to Codecov
+        uses: codecov/codecov-action@v7.0.0
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: codecov.json
+          disable_search: true
+          flags: rust
+          fail_ci_if_error: false
+          verbose: true
+          override_pr: ${{ github.event.pull_request.number }}
+
+      - name: Upload build reports
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: rust-test-build-reports-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            target/llvm-cov/**
+            codecov.json
+          if-no-files-found: ignore
+          retention-days: 7
+
+  run-rust-tests:
+    if: inputs.task == 'test'
+    needs: build-rust-tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        partition: [1, 2]
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7.0.1
+
+      - name: Run Rust test partition
+        uses: ./.github/actions/rust/pre-merge
+        with:
+          task: test-run-${{ matrix.partition }}
+          component: ${{ inputs.component }}
+          test-partition-count: ${{ strategy.job-total }}
+
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v7.0.0
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: codecov.json
+          disable_search: true
+          flags: rust
+          fail_ci_if_error: false
+          verbose: true
+          override_pr: ${{ github.event.pull_request.number }}
+
+      - name: Upload reports
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: rust-test-${{ matrix.partition }}-reports-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            target/llvm-cov/**
+            codecov.json
+          if-no-files-found: ignore
+          retention-days: 7

.github/workflows/coverage-baseline.yml

@@ -52,6 +52,7 @@ jobs:
       - name: Setup Rust with cache
         uses: ./.github/actions/utils/setup-rust-with-cache
         with:
+          install-nextest: "true"
           # Also warms the GitHub Actions build cache for subsequent PR builds
           save-cache: "true"
           # llvm-cov instrumentation roughly doubles object sizes; the light

.github/workflows/pre-merge.yml

@@ -56,7 +56,7 @@ jobs:
     strategy:
       fail-fast: true
       matrix: ${{ fromJson(needs.detect.outputs.rust_matrix) }}
-    uses: ./.github/workflows/_test.yml
+    uses: ./.github/workflows/_test_rust.yml
     with:
       component: ${{ matrix.component }}
       task: ${{ matrix.task }}

core/integration/src/harness/context.rs

@@ -51,7 +51,9 @@ fn is_cleanup_disabled_by_env() -> bool {
 }
 
 static TEST_LOGS_DIR: LazyLock<PathBuf> = LazyLock::new(|| {
-    PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+    std::env::var_os("CARGO_MANIFEST_DIR")
+        .map(PathBuf::from)
+        .expect("CARGO_MANIFEST_DIR should be set when running integration tests")
         .parent()
         .and_then(|p| p.parent())
         .expect("Failed to find workspace root")

core/integration/tests/server/http_tls.rs

@@ -40,11 +40,21 @@ const READY_RETRY_INTERVAL: Duration = Duration::from_millis(50);
 const REQUEST_TIMEOUT: Duration = Duration::from_secs(30);
 
 /// Absolute path to a repo loopback cert asset. The spawned server's CWD is a
-/// temp dir, so relative paths break; `CARGO_MANIFEST_DIR` is the integration
-/// crate, whose sibling `../certs` holds the checked-in loopback material.
+/// temp dir, so relative paths break; nextest remaps the runtime
+/// `CARGO_MANIFEST_DIR` to the integration crate, whose sibling `../certs`
+/// holds the checked-in loopback material.
 fn cert_asset(file: &str) -> PathBuf {
-    std::fs::canonicalize(format!("{}/../certs/{file}", env!("CARGO_MANIFEST_DIR")))
-        .unwrap_or_else(|error| panic!("canonicalize repo cert asset {file}: {error}"))
+    let manifest_dir = std::env::var_os("CARGO_MANIFEST_DIR")
+        .map(PathBuf::from)
+        .expect("CARGO_MANIFEST_DIR should be set when running integration tests");
+    let asset_path = manifest_dir.join("../certs").join(file);
+
+    std::fs::canonicalize(&asset_path).unwrap_or_else(|error| {
+        panic!(
+            "canonicalize repo cert asset {}: {error}",
+            asset_path.display()
+        )
+    })
 }
 
 /// Boot iggy-server-ng with `[http.tls]` enabled against the repo loopback

scripts/ci/python-sdk-version-sync.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements.  See the NOTICE file
 # distributed with this work for additional information

scripts/ci/sync-python-interpreter-version.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements.  See the NOTICE file
 # distributed with this work for additional information

scripts/ci/sync-rustc-version.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements.  See the NOTICE file
 # distributed with this work for additional information

scripts/ci/third-party-licenses.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements.  See the NOTICE file
 # distributed with this work for additional information

scripts/ci/uv-lock-check.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements.  See the NOTICE file
 # distributed with this work for additional information