Cleanup workflows for rust

Author: 4og

.bazelrc

@@ -24,6 +24,10 @@ build --tool_java_runtime_version=remotejdk_17
 build --credential_helper="*.qnx.com=%workspace%/.github/tools/qnx_credential_helper.py"
 build --experimental_retain_test_configuration_across_testonly # needed for QNX tests until bazel update to 8.6.0. See https://github.com/bazelbuild/bazel/pull/28115
 
+# Ferrocene must be common compiler for HOST. To ensure metadata compatibility for proc macro crates!
+common --extra_toolchains=@score_gcc_x86_64_toolchain//:x86_64-linux-gcc_12.2.0
+common --extra_toolchains=@score_toolchains_rust//toolchains/ferrocene:ferrocene_x86_64_unknown_linux_gnu
+
 build:_bl_stub --//score/json:base_library=nlohmann
 build:_bl_stub --//score/memory/shared/flags:use_typedshmd=False
 
@@ -43,13 +47,15 @@ build:bl-x86_64-linux --config=_bl_stub
 build:bl-x86_64-linux --config=_bl_toolchain_common
 build:bl-x86_64-linux --platforms=@score_bazel_platforms//:x86_64-linux-gcc_12.2.0-posix
 build:bl-x86_64-linux --extra_toolchains=@score_gcc_x86_64_toolchain//:x86_64-linux-gcc_12.2.0
+build:bl-x86_64-linux --extra_toolchains=@score_toolchains_rust//toolchains/ferrocene:ferrocene_x86_64_unknown_linux_gnu
 test:bl-x86_64-linux --config=_bl_common
 
 # Target configuration for CPU:AArch64|OS:Linux build (do not use it in case of system toolchains!)
 build:bl-aarch64-linux --config=_bl_stub
 build:bl-aarch64-linux --config=_bl_toolchain_common
 build:bl-aarch64-linux --platforms=@score_bazel_platforms//:aarch64-linux-gcc_12.2.0-posix
 build:bl-aarch64-linux --extra_toolchains=@score_gcc_aarch64_toolchain//:aarch64-linux-gcc_12.2.0
+build:bl-aarch64-linux --extra_toolchains=@score_toolchains_rust//toolchains/ferrocene:ferrocene_aarch64_unknown_linux_gnu
 test:bl-aarch64-linux --config=_bl_common
 test:bl-aarch64-linux --test_timeout=300
 test:bl-aarch64-linux --run_under=//:qemu_aarch64
@@ -61,6 +67,7 @@ build:bl-x86_64-qnx --config=_bl_toolchain_common
 build:bl-x86_64-qnx --platforms=@score_bazel_platforms//:x86_64-qnx-sdp_8.0.0-posix
 build:bl-x86_64-qnx --extra_toolchains=@score_qcc_x86_64_toolchain//:x86_64-qnx-sdp_8.0.0
 build:bl-x86_64-qnx --extra_toolchains=@score_qnx_x86_64_ifs_toolchain//:ifs-x86_64-qnx-sdp_8.0.0
+build:bl-x86_64-qnx --extra_toolchains=@score_toolchains_rust//toolchains/ferrocene:ferrocene_x86_64_pc_nto_qnx800
 test:bl-x86_64-qnx --config=_bl_common
 test:bl-x86_64-qnx --run_under=@score_qnx_unit_tests//src:run_under_qnx
 test:bl-x86_64-qnx --test_tag_filters=
@@ -73,12 +80,29 @@ build:bl-aarch64-qnx --incompatible_strict_action_env
 build:bl-aarch64-qnx --platforms=@score_bazel_platforms//:aarch64-qnx-sdp_8.0.0-posix
 build:bl-aarch64-qnx --extra_toolchains=@score_qcc_aarch64_toolchain//:aarch64-qnx-sdp_8.0.0
 build:bl-aarch64-qnx --extra_toolchains=@score_qnx_aarch64_ifs_toolchain//:ifs-aarch64-qnx-sdp_8.0.0
+build:bl-aarch64-qnx --extra_toolchains=@score_toolchains_rust//toolchains/ferrocene:ferrocene_aarch64_unknown_nto_qnx800
 test:bl-aarch64-qnx --config=_bl_common
 test:bl-aarch64-qnx --test_timeout=300
 test:bl-aarch64-qnx --run_under=@score_qnx_unit_tests//src:run_under_qnx
 test:bl-aarch64-qnx --test_tag_filters=
 test:bl-aarch64-qnx --test_lang_filters=cc,rust
 
+# Ferrocene Rust coverage config
+build:ferrocene-coverage --@rules_rust//rust/settings:extra_rustc_flag=-Cinstrument-coverage
+build:ferrocene-coverage --@rules_rust//rust/settings:extra_rustc_flag=-Clink-dead-code
+build:ferrocene-coverage --@rules_rust//rust/settings:extra_rustc_flag=-Ccodegen-units=1
+build:ferrocene-coverage --@rules_rust//rust/settings:extra_rustc_flag=-Cdebuginfo=2
+build:ferrocene-coverage --@rules_rust//rust/settings:extra_exec_rustc_flag=-Cinstrument-coverage
+build:ferrocene-coverage --@rules_rust//rust/settings:extra_exec_rustc_flag=-Clink-dead-code
+build:ferrocene-coverage --@rules_rust//rust/settings:extra_exec_rustc_flag=-Ccodegen-units=1
+build:ferrocene-coverage --@rules_rust//rust/settings:extra_exec_rustc_flag=-Cdebuginfo=2
+test:ferrocene-coverage --run_under=@score_tooling//coverage:llvm_profile_wrapper
+
+# Clippy linting for Rust
+build --aspects=@score_rust_policies//clippy:linters.bzl%clippy_strict
+build --output_groups=+rules_lint_human
+build:lint --@aspect_rules_lint//lint:fail_on_violation=true
+
 # Coverage configuration for C++
 coverage --features=coverage
 coverage --combined_report=lcov

.github/actions/setup-rust-build/action.yml

@@ -0,0 +1,47 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+name: 'Setup Rust Build Environment'
+description: 'Checks out code, installs protoc, and caches cargo dependencies'
+inputs:
+  repo-token:
+    description: 'GitHub token for protoc downloads'
+    required: true
+runs:
+  using: "composite"
+  steps:
+    - name: Checkout Repository
+      uses: actions/checkout@v4
+    - name: Install protoc 26.1
+      uses: arduino/setup-protoc@v3
+      with:
+        version: 26.1
+        repo-token: ${{ inputs.repo-token }}
+    - name: Cache cargo & target
+      uses: actions/cache@v3
+      with:
+        path: |
+          ~/.cargo/registry
+          ~/.cargo/git
+          target
+          ~/.cargo/bin
+        key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+        restore-keys: |
+          ${{ runner.os }}-cargo-
+    - name: Install cargo-tarpaulin if not already installed
+      run: |
+        if ! command -v cargo-tarpaulin > /dev/null; then
+          cargo install cargo-tarpaulin --version 0.32.7 --locked
+        else
+          echo "cargo-tarpaulin is already installed"
+        fi
+      shell: bash

.github/workflows/build.yml

@@ -31,15 +31,17 @@ jobs:
       matrix:
         include:
           - bazel-config: bl-x86_64-linux
-            bazel-build-target: "//score/..."
+            bazel-build-target: "//score/... //src/..."
             bazel-test-target: >-
               //score/...
+              //src/...
               -//score/language/safecpp/aborts_upon_exception:abortsuponexception_toolchain_test
             bazel-test-extra-flags: ""
           - bazel-config: bl-aarch64-linux
-            bazel-build-target: "//score/..."
+            bazel-build-target: "//score/... //src/..."
             bazel-test-target: >-
               //score/...
+              //src/...
               -//score/language/safecpp/aborts_upon_exception:abortsuponexception_toolchain_test
               -//score/os/test:acl_test
               -//score/os/test:errno_test

.github/workflows/build_linux.yml

@@ -30,6 +30,7 @@ jobs:
           - bazel-config: bl-x86_64-qnx
             bazel-test-target: >-
               //score/...
+              //src/...
               -//score/language/futurecpp/tests:memory_resource_test
               -//score/language/futurecpp/tests:zip_iterator_test
               -//score/language/safecpp/aborts_upon_exception:abortsuponexception_toolchain_test
@@ -40,6 +41,7 @@ jobs:
           - bazel-config: bl-aarch64-qnx
             bazel-test-target: >-
               //score/...
+              //src/...
               -//score/language/futurecpp/tests:memory_resource_test
               -//score/language/safecpp/aborts_upon_exception:abortsuponexception_toolchain_test
               -//score/memory/shared:shared_memory_factory_test
@@ -51,7 +53,7 @@ jobs:
       contents: read
       pull-requests: read
     with:
-      bazel-target: "//score/..."
+      bazel-target: "//score/... //src/..."
       bazel-config: ${{ matrix.bazel-config }}
       bazel-test-target: ${{ matrix.bazel-test-target }}
       credential-helper: ".github/tools/qnx_credential_helper.py"

.github/workflows/build_qnx.yml

@@ -10,20 +10,16 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 # *******************************************************************************
-
 name: cargo build, test, coverage and miri report
-
 on:
   push:
     branches: [main, development]
   pull_request:
     branches: [main, development]
     types: [opened, ready_for_review, reopened, synchronize]
-
 env:
   CARGO_TERM_COLOR: always
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
 jobs:
   cargo-checks:
     #permissions for docs deployment
@@ -36,26 +32,21 @@ jobs:
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v4
-
       - name: Setup Rust Build Environment
         uses: ./.github/actions/setup-rust-build
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
-
       # ---------- BUILD ----------
       - name: Cargo build
         run: cargo build --verbose
-
       # ---------- TARPAULIN(TEST + COVERAGE) ----------
       - name: Run tests under coverage
         run: cargo +nightly tarpaulin --version 0.32.7 --skip-clean --out Html --verbose --no-dead-code --engine llvm --all-features
-
       - name: Upload coverage report
         uses: actions/upload-artifact@v4
         with:
           name: coverage-report
           path: tarpaulin-report.html
-
       # ---------- MIRI ----------
       - name: Install nightly + miri (minimal profile)
         uses: actions-rs/toolchain@v1
@@ -65,21 +56,17 @@ jobs:
           profile: minimal
           components: miri
           override: true
-
       - name: Prefetch crates for nightly
         if: github.event.pull_request.draft == false
         run: cargo +nightly-2025-12-15 fetch --locked
-
       - name: Purge Miri artifacts
         if: github.event.pull_request.draft == false
         run: |
           rm -rf target/miri
           rm -rf ~/.cache/miri
-
       - name: Prefetch and build dependencies for Miri
         if: github.event.pull_request.draft == false
         run: cargo +nightly-2025-12-15 miri setup
-
       - name: Run Miri and save report
         if: github.event.pull_request.draft == false
         env:

.github/workflows/build_qnx8.yml

@@ -1,5 +1,5 @@
 # *******************************************************************************
-# Copyright (c) 2025 Contributors to the Eclipse Foundation
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
 #
 # See the NOTICE file(s) distributed with this work for additional
 # information regarding copyright ownership.
@@ -10,18 +10,14 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 # *******************************************************************************
-
 name: Copyright checks
+permissions:
+  contents: read
 on:
   pull_request:
     types: [opened, reopened, synchronize]
   merge_group:
     types: [checks_requested]
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
 jobs:
   copyright-check:
-    uses: eclipse-score/cicd-workflows/.github/workflows/copyright.yml@main
-    with:
-      bazel-target: "run --lockfile_mode=error //:copyright.check"
+    uses: eclipse-score/cicd-workflows/.github/workflows/copyright.yml@af347722c7ae3ed85518895c11268d96ac728f62