mvp-smoke.yml

# SPDX-License-Identifier: MPL-2.0
name: MVP Smoke (Best Effort)

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

# Cause-B mitigation (#77): cancel superseded runs so stacked pushes
# to the same ref don't pile up identical jobs in the queue.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always

jobs:
  mvp-smoke:
    name: MVP Smoke
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4

      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@6d9817901c499d6b02debbb57edb38d33daa680b # stable
        with:
          toolchain: stable

      - name: Cache Cargo
        uses: Swatinem/rust-cache@65012b490220f477f20ab979e35ae732e6de4e68 # v2

      - name: Install just
        uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2
        with:
          # Governance R1 requires versioned family-tool pins
          # (just|must|trust|adjust|bust|dust|intend); bare `tool: just`
          # tripped the Security policy check on every push to main since
          # #130 landed (2026-05-30). 1.51.0 is the current upstream stable.
          tool: just@1.51.0

      - name: Build release
        run: cargo build --release

      - name: MVP smoke checks (best effort)
        run: just --justfile Justfile mvp-env