feat(reusables): add working_directory input to rust-ci + elixir-ci (#186)

## Summary

Stacked on #174. Adds a `working_directory` string input (default `.`)
to both reusable workflows so wrappers can target a sub-crate or sub-app
layout without re-implementing the workflow.

## What changes

**rust-ci-reusable.yml:**
- New `working_directory` input (default `.`)
- Each job declares `defaults.run.working-directory: ${{
inputs.working_directory }}`
- `hashFiles('Cargo.toml')` guards now use
`hashFiles(format('{0}/Cargo.toml', inputs.working_directory))`
- Swatinem/rust-cache `workspaces:` parameter passes the working
directory so caches are keyed per sub-crate

**elixir-ci-reusable.yml:**
- New `working_directory` input (default `.`)
- Job declares `defaults.run.working-directory`
- `mix.exs` and `mix.lock` lookups + cache `path:` entries all consult
the input via `format()`

## Why

Audit of the 6 remaining elixir-ci.yml consumers + the 5 complex
rust-ci.yml consumers (as of 2026-05-26):

**elixir (3 of 6 need this):**
- burble → `server/`
- feedback-o-tron → (working-directory)
- verisimdb → (working-directory)

**rust (1 of 5 needs this; the rest use matrix dimensions):**
- reasonably-good-token-vault → per-crate (`vault-broker`, `rgtv-cli`)

## Explicitly out of scope

Multi-OS / multi-Rust-version / multi-crate matrices and `cross build`
support are deferred. The 4 matrix-using rust-ci repos each use a
**different** matrix dimension (`os` / `rust` / `workspaces` /
`manifests`) — no single shared abstraction fits cleanly. They stay
bespoke for now; re-evaluate after the current wrapper sweep completes.

| Repo | Matrix dimension |
|---|---|
| julia-the-viper | `os` (linux/macos/windows) |
| verisimiser | `rust` (1.85, stable) |
| reasonably-good-token-vault | `crate` (multi-workspace — covered by
`working_directory` per-job) |
| verisimdb | `manifest` (fuzz/Cargo.toml + rust-core/fuzz/Cargo.toml) +
coverage + audit |

## Test plan

- [x] YAML parse OK locally (python3 yaml.safe_load both files)
- [ ] CI on this PR — but circular-validation caveat applies (per #174
PR description) — `pull_request` runs target-branch workflow, not the
PR's
- [ ] Owner merge order: #174 → this PR (this is stacked on
`feat/rust-ci-reusable`; GitHub will retarget to `main` automatically
once #174 merges)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/elixir-ci-reusable.yml

@@ -43,6 +43,15 @@
 #       with:
 #         elixir-version: "1.18"
 #         enable_dialyzer: true
+#
+# Sub-directory project (mix.exs lives in a subfolder — applies to
+# burble's server/, feedback-o-tron, verisimdb):
+#
+#   jobs:
+#     elixir-ci:
+#       uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@main
+#       with:
+#         working_directory: server
 
 name: Elixir CI (reusable)
 
@@ -74,6 +83,16 @@ on:
         type: boolean
         required: false
         default: true
+      working_directory:
+        description: |
+          Directory containing `mix.exs` (relative to the repo root). All
+          mix invocations and cache lookups consult this directory.
+          Default `.` keeps single-app repos unchanged. Set to e.g.
+          `server` for a sub-app layout (burble, feedback-o-tron,
+          verisimdb at audit time).
+        type: string
+        required: false
+        default: "."
 
 permissions:
   contents: read
@@ -83,11 +102,14 @@ jobs:
     name: Compile + test
     runs-on: ${{ inputs.runs-on }}
     # Guard on mix.exs so the wrapper is safe to add unconditionally.
-    if: hashFiles('mix.exs') != ''
+    if: hashFiles(format('{0}/mix.exs', inputs.working_directory)) != ''
     permissions:
       contents: read
     env:
       MIX_ENV: test
+    defaults:
+      run:
+        working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -104,14 +126,14 @@ jobs:
       - name: Cache deps
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
-          path: deps
-          key: deps-${{ inputs.elixir-version }}-${{ hashFiles('mix.lock') }}
+          path: ${{ inputs.working_directory }}/deps
+          key: deps-${{ inputs.elixir-version }}-${{ hashFiles(format('{0}/mix.lock', inputs.working_directory)) }}
 
       - name: Cache _build
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
-          path: _build
-          key: build-${{ inputs.elixir-version }}-${{ hashFiles('mix.lock') }}
+          path: ${{ inputs.working_directory }}/_build
+          key: build-${{ inputs.elixir-version }}-${{ hashFiles(format('{0}/mix.lock', inputs.working_directory)) }}
 
       - name: Install deps
         run: mix deps.get

.github/workflows/rust-ci-reusable.yml

@@ -29,6 +29,25 @@
 #       with:
 #         enable_audit: true
 #         enable_coverage: true
+#
+# Sub-crate / monorepo workspace (Cargo.toml lives in a subdirectory):
+#
+#   jobs:
+#     rust-ci-cli:
+#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@main
+#       with:
+#         working_directory: crates/cli
+#     rust-ci-server:
+#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@main
+#       with:
+#         working_directory: crates/server
+#
+# Out-of-scope (left bespoke per-repo): multi-OS matrices, cross-compile
+# (`cross build`), multi-Rust-version matrices. Each has too much per-repo
+# variance to share a single abstraction cleanly (verified against the 5
+# matrix-using repos as of 2026-05-26: julia-the-viper / verisimdb /
+# verisimiser / reasonably-good-token-vault use four different matrix
+# dimensions).
 
 name: Rust CI (reusable)
 
@@ -65,6 +84,17 @@ on:
         type: string
         required: false
         default: "--all-targets"
+      working_directory:
+        description: |
+          Directory containing `Cargo.toml` (relative to the repo root). All
+          cargo invocations cd into this directory; `hashFiles()` guards also
+          consult it. Default `.` keeps single-crate repos unchanged. Set
+          to e.g. `crates/server` for a sub-crate, or pass a different
+          value per wrapper call when running the reusable in a workspace
+          via separate jobs.
+        type: string
+        required: false
+        default: "."
 
 permissions:
   contents: read
@@ -76,9 +106,12 @@ jobs:
   check:
     name: Cargo check + clippy + fmt
     runs-on: ${{ inputs.runs-on }}
-    if: hashFiles('Cargo.toml') != ''
+    if: hashFiles(format('{0}/Cargo.toml', inputs.working_directory)) != ''
     permissions:
       contents: read
+    defaults:
+      run:
+        working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -93,6 +126,8 @@ jobs:
 
       - name: Cache cargo registry and build
         uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
+        with:
+          workspaces: ${{ inputs.working_directory }}
 
       - name: Cargo check
         run: cargo check ${{ inputs.check_args }}
@@ -107,9 +142,12 @@ jobs:
     name: Cargo test
     runs-on: ${{ inputs.runs-on }}
     needs: check
-    if: hashFiles('Cargo.toml') != ''
+    if: hashFiles(format('{0}/Cargo.toml', inputs.working_directory)) != ''
     permissions:
       contents: read
+    defaults:
+      run:
+        working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -122,6 +160,8 @@ jobs:
 
       - name: Cache cargo registry and build
         uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
+        with:
+          workspaces: ${{ inputs.working_directory }}
 
       - name: Run tests
         run: cargo test ${{ inputs.test_args }}
@@ -139,9 +179,12 @@ jobs:
   audit:
     name: Cargo audit (security)
     runs-on: ${{ inputs.runs-on }}
-    if: ${{ inputs.enable_audit && hashFiles('Cargo.toml') != '' }}
+    if: ${{ inputs.enable_audit && hashFiles(format('{0}/Cargo.toml', inputs.working_directory)) != '' }}
     permissions:
       contents: read
+    defaults:
+      run:
+        working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -164,9 +207,12 @@ jobs:
   coverage:
     name: Coverage (tarpaulin + codecov)
     runs-on: ${{ inputs.runs-on }}
-    if: ${{ inputs.enable_coverage && hashFiles('Cargo.toml') != '' }}
+    if: ${{ inputs.enable_coverage && hashFiles(format('{0}/Cargo.toml', inputs.working_directory)) != '' }}
     permissions:
       contents: read
+    defaults:
+      run:
+        working-directory: ${{ inputs.working_directory }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2