ci: split lint into parallel jobs and remove redundant checks

Split the monolithic lint job into two parallel CI jobs for faster
feedback:

- `lint`: format check, workspace-wide clippy, and multi-feature
  combination checks (~1-2 min)
- `lint-feature-matrix`: per-feature clippy via cargo hack (~5-6 min)

Previously, all 150 clippy invocations ran sequentially in a single
job. The most common CI failure on PRs is the per-feature matrix
catching dead code or unused warnings that only surface when
individual features are tested in isolation. By splitting these into
parallel jobs, contributors get fast feedback on the common checks
while the thorough feature matrix runs alongside.

Also removes 6 redundant cargo_feature checks from lint.sh that are
already covered by `cargo hack --each-feature`:
- opentelemetry-otlp "default", "http-proto", "metrics"
- opentelemetry-jaeger-propagator "default"
- opentelemetry-proto "default", "full"

Updates CONTRIBUTING.md to document the cargo hack lint command so
contributors can catch per-feature issues locally before pushing.

Author: bryantbiggs

.github/workflows/ci.yml

@@ -65,16 +65,36 @@ jobs:
       with:
         toolchain: stable
         components: rustfmt, clippy
-    - uses: taiki-e/install-action@650c5ca14212efbbf3e580844b04bdccf68dac31 # v2.67.18
-      with:
-          tool: cargo-hack
     - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
       with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
     - name: Format
       run: cargo fmt --all -- --check
     - name: Lint
       run: bash ./scripts/lint.sh
+  lint-feature-matrix:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
+      with:
+        egress-policy: audit
+
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      with:
+        submodules: true
+    - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+      with:
+        toolchain: stable
+        components: clippy
+    - uses: taiki-e/install-action@650c5ca14212efbbf3e580844b04bdccf68dac31 # v2.67.18
+      with:
+          tool: cargo-hack
+    - uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
+      with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+    - name: Lint (per-feature matrix)
+      run: bash ./scripts/lint_feature_matrix.sh
   external-types:
     strategy:
       matrix:

CONTRIBUTING.md

@@ -179,10 +179,13 @@ All such features should adhere to naming convention  `<signal>_<feature_name>`
 
 ## Style Guide
 
-- Run `cargo clippy --all` - this will catch common mistakes and improve
-your Rust code
-- Run `cargo fmt` - this will find and fix code formatting
-issues.
+- Run `cargo fmt` - this will find and fix code formatting issues.
+- Run `cargo clippy --workspace --all-targets --all-features -- -Dwarnings` - this will catch common
+  mistakes and improve your Rust code.
+- Run `cargo hack --each-feature --no-dev-deps clippy -- -Dwarnings` - this checks clippy for each
+  feature in isolation and catches issues like dead code or unused imports that only appear when
+  individual features are enabled. Install with `cargo install cargo-hack` if you don't have it.
+  This is the most common source of CI lint failures on PRs.
 
 ## Testing and Benchmarking
 

scripts/lint.sh

@@ -9,33 +9,23 @@ cargo_feature() {
     -Dwarnings
 }
 
-if rustup component add clippy && \
-  ((cargo --list | grep -q hack) || cargo install cargo-hack); then
+if rustup component add clippy; then
   # Exit with a nonzero code if there are clippy warnings
   cargo clippy --workspace --all-targets --all-features -- -Dwarnings
 
-  # Run through all the features one by one and exit if there are clippy warnings
-  cargo hack --each-feature --no-dev-deps clippy -- -Dwarnings
-
   # `opentelemetry-prometheus` doesn't belong to the workspace
   cargo clippy --manifest-path=opentelemetry-prometheus/Cargo.toml --all-targets --all-features -- \
     -Dwarnings
 
+  # Multi-feature combinations not covered by per-feature checks
   cargo_feature opentelemetry "trace,metrics,logs,testing"
 
-  cargo_feature opentelemetry-otlp "default"
   cargo_feature opentelemetry-otlp "default,tls"
   cargo_feature opentelemetry-otlp "default,tls-roots"
-  cargo_feature opentelemetry-otlp "http-proto"
   cargo_feature opentelemetry-otlp "http-proto, reqwest-blocking-client"
   cargo_feature opentelemetry-otlp "http-proto, reqwest-client"
   cargo_feature opentelemetry-otlp "http-proto, reqwest-rustls"
-  cargo_feature opentelemetry-otlp "metrics"
-
-  cargo_feature opentelemetry-jaeger-propagator "default"
 
-  cargo_feature opentelemetry-proto "default"
-  cargo_feature opentelemetry-proto "full"
   cargo_feature opentelemetry-proto "gen-tonic,trace"
   cargo_feature opentelemetry-proto "gen-tonic,trace,with-serde"
   cargo_feature opentelemetry-proto "gen-tonic,trace,with-schemars,with-serde"

scripts/lint_feature_matrix.sh

@@ -0,0 +1,13 @@
+#!/bin/bash
+
+set -eu
+
+# Run clippy for each feature individually across all workspace crates.
+# This catches dead code, unused imports, and other warnings that only
+# surface when features are tested in isolation (e.g., a function gated
+# behind feature A but missing #[cfg(feature = "A")]).
+
+if rustup component add clippy && \
+  ((cargo --list | grep -q hack) || cargo install cargo-hack); then
+  cargo hack --each-feature --no-dev-deps clippy -- -Dwarnings
+fi

scripts/precommit.sh

@@ -2,6 +2,6 @@ REPO_ROOT=$(dirname $( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null
 
 pushd "${REPO_ROOT}" > /dev/null
 
-cargo update && cargo fmt --all && ./scripts/lint.sh && ./scripts/test.sh
+cargo update && cargo fmt --all && ./scripts/lint.sh && ./scripts/lint_feature_matrix.sh && ./scripts/test.sh
 
 popd > /dev/null