feat!: rewrite aitrack and opentrack in Rust (5.0)

.cargo/config.toml

@@ -0,0 +1,7 @@
+[alias]
+xtask = "run --quiet --package xtask --"
+# Warnings fail the run at the end instead of stopping at the first crate, so every crate is linted;
+# extra arguments (`cargo lint -p aitrack-core`) reach cargo.
+lint = ["clippy", "--all-targets", "--keep-going", "--config", "build.warnings='deny'"]
+# opentrack in debug; a separate data dir keeps it apart from an installed copy
+dev = "run --package opentrack -- --data-dir target/opentrack-dev"

.gitattributes

@@ -1 +1,3 @@
 * text=auto eol=lf
+# Reader corpora test exact bytes: CRLF lines and invalid UTF-8.
+crates/core/tests/fixtures/readers/corpus/** -text

.githooks/commit-msg

@@ -0,0 +1,15 @@
+#!/bin/sh
+# Conventional Commits: the changelog and release notes are generated from them.
+header=$(head -n 1 "$1")
+case "$header" in
+  Merge\ * | Revert\ * | fixup!\ * | squash!\ *) exit 0 ;;
+esac
+if ! printf '%s\n' "$header" | grep -Eq '^(build|chore|ci|docs|feat|fix|perf|refactor|revert|test)(\([^)]+\))?!?: [^ ]'; then
+  echo "commit-msg: \"$header\" is not <type>(<scope>)?!?: <subject>" >&2
+  echo "commit-msg: types are build, chore, ci, docs, feat, fix, perf, refactor, revert, test" >&2
+  exit 1
+fi
+if [ "${#header}" -gt 100 ]; then
+  echo "commit-msg: the header is ${#header} characters; keep it to 100" >&2
+  exit 1
+fi

.github/actions/setup-rust/action.yml

@@ -1,5 +1,10 @@
 name: Set up Rust
 description: Install the toolchain pinned in rust-toolchain.toml
+inputs:
+  targets:
+    description: Extra targets to install, comma-separated
+    required: false
+    default: ''
 runs:
   using: composite
   steps:
@@ -19,3 +24,4 @@ runs:
       with:
         toolchain: ${{ steps.toolchain.outputs.version }}
         components: ${{ steps.toolchain.outputs.components }}
+        targets: ${{ inputs.targets }}

.github/dependabot.yml

@@ -1,35 +1,11 @@
 version: 2
 updates:
-  - package-ecosystem: bun
-    directory: /
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 5
-    # Let a compromised release get caught and yanked before it is proposed; security updates skip this.
-    cooldown:
-      default-days: 7
-    # One PR per weekly run instead of a dozen: dev tooling and runtime deps
-    # each move together, and majors stay separate so they get a real look.
-    groups:
-      # Before the groups below: Tauri's api (runtime) and cli (dev) must move together.
-      tauri:
-        patterns: ['@tauri-apps/*']
-      runtime:
-        dependency-type: production
-        update-types: [minor, patch]
-      dev:
-        dependency-type: development
-        update-types: [minor, patch]
-    commit-message:
-      prefix: chore
-      prefix-development: chore
-      include: scope
-
   - package-ecosystem: cargo
     directory: /
     schedule:
       interval: weekly
     open-pull-requests-limit: 5
+    # Let a compromised release get caught and yanked before it is proposed; security updates skip this.
     cooldown:
       default-days: 7
     groups:

.github/workflows/ci.yml

@@ -2,7 +2,6 @@ name: CI
 
 on:
   push:
-    # main runs fill the Rust and Nx caches that pull requests restore.
     branches: [main]
   pull_request:
     branches: [main]
@@ -15,223 +14,75 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
+env:
+  CARGO_INCREMENTAL: 0
+  CARGO_TERM_COLOR: always
+
 jobs:
   audit:
-    name: Audit
+    name: Audit (Rust)
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - name: Lint workflows
-        uses: docker://rhysd/actionlint@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667 # 1.7.12
-        with:
-          args: -color
-
       - name: Review dependency changes
         if: github.event_name == 'pull_request'
         uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
         with:
           fail-on-severity: high
 
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
-        with:
-          bun-version-file: package.json
-
-      # Audit reads only the lockfile, so it needs no install.
-      - run: bun audit --audit-level=high
-
       - uses: taiki-e/install-action@3a3daafd3b7f23b8f65d9f5ba2db203fb59b79e2 # v2
         with:
-          tool: cargo-audit
+          tool: cargo-deny
 
-      # Fails on vulnerabilities; unmaintained and yanked crates stay warnings.
-      - run: cargo audit
+      - run: cargo deny check advisories sources
 
-  test:
-    name: Check
+  lint:
+    name: Lint (Rust)
     runs-on: ubuntu-latest
-    env:
-      NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          # `nx affected` diffs against the merge base, which a shallow clone
-          # does not have; a blobless clone keeps the history without old file contents.
-          fetch-depth: 0
-          filter: blob:none
-
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
-        with:
-          bun-version-file: package.json
-
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
-        with:
-          node-version-file: .node-version
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile
 
       - name: Set up Rust
         uses: ./.github/actions/setup-rust
 
-      - uses: nrwl/nx-set-shas@e602fada7ad5987b0f7b1905e7a99ea1c661514c # v5.1.0
-
-      # One run lets Nx schedule the checks in parallel. The desktop matrix, Linux
-      # included, checks the Rust shell with its system libraries.
-      - name: Format, lint, typecheck, unused, test and build
-        run: bun nx affected -t format:check,lint,typecheck,check:unused,test,build --configuration ci --exclude opentrack
-
-      # Separate from the unit tests, which would otherwise pick up SMOKE_CLI too.
-      - name: CLI smoke tests and publish tarballs
-        run: bun nx affected -t test:smoke,package:check
-        env:
-          SMOKE_CLI: dist/cli.js
-
-  # `engines` promises this to users, while everything else runs on .node-version.
-  node-floor:
-    name: Check (Node 24)
-    runs-on: ubuntu-latest
-    env:
-      NX_NO_CLOUD: true
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-          filter: blob:none
-
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
-          bun-version-file: package.json
+          shared-key: lint
+          save-if: ${{ github.ref == 'refs/heads/main' }}
 
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
-        with:
-          node-version: 24
+      - name: Install GTK
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libgtk-3-dev libayatana-appindicator3-dev libxdo-dev
 
-      - name: Install dependencies
-        run: bun install --frozen-lockfile
+      - run: cargo fmt --all --check
 
-      - name: Set up Rust
-        uses: ./.github/actions/setup-rust
+      - run: cargo lint
 
-      - uses: nrwl/nx-set-shas@e602fada7ad5987b0f7b1905e7a99ea1c661514c # v5.1.0
-
-      # Skip the cache: Nx does not hash the Node version into these test results.
-      - name: Test the published packages
-        run: bun nx affected -t test --exclude repo-tools,opentrack,opentrack-ui --skip-nx-cache
-
-      - name: CLI smoke tests
-        run: bun nx affected -t test:smoke --skip-nx-cache
-        env:
-          SMOKE_CLI: dist/cli.js
-
-  cross-platform:
-    name: Check (${{ matrix.os }})
-    runs-on: ${{ matrix.os }}
-    env:
-      NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
-      # Avoid the native runner's allocation crash after successful Windows tasks.
-      NX_NATIVE_COMMAND_RUNNER: ${{ matrix.os == 'windows-latest' && 'false' || 'true' }}
-      # Debug info only slows the clippy and test builds; nothing here is debugged.
-      CARGO_PROFILE_DEV_DEBUG: 0
-      # These packages only prove the bundle works; Publish keeps the size-tuned profile.
-      CARGO_PROFILE_RELEASE_LTO: false
-      CARGO_PROFILE_RELEASE_CODEGEN_UNITS: 16
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: macos-latest
-            platform: macos-arm64
-            installer: target/release/bundle/dmg/*.dmg
-            cargo-jobs: 3
-          - os: windows-latest
-            platform: windows-x64
-            installer: target/release/bundle/nsis/*.exe
-            cargo-jobs: 2
-          - os: ubuntu-24.04 # The release image, so packaging breaks here before it does at a tag.
-            platform: linux-x64
-            installer: |
-              target/release/bundle/appimage/*.AppImage
-              target/release/bundle/deb/*.deb
-            cargo-jobs: 4
+  test:
+    name: Test
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-          filter: blob:none
-
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
-        with:
-          bun-version-file: package.json
-
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
-        with:
-          node-version-file: .node-version
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile
 
       - name: Set up Rust
         uses: ./.github/actions/setup-rust
 
-      - uses: nrwl/nx-set-shas@e602fada7ad5987b0f7b1905e7a99ea1c661514c # v5.1.0
-
-      # The Ubuntu Check job already runs these on Linux.
-      - name: CLI smoke tests and publish tarballs
-        if: runner.os != 'Linux'
-        run: bun nx affected -t test:smoke,package:check
-        env:
-          SMOKE_CLI: dist/cli.js
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+        with:
+          shared-key: test
+          save-if: ${{ github.ref == 'refs/heads/main' }}
 
-      # A pull request that cannot change the desktop app skips its Rust build.
-      - name: Check whether Opentrack is affected
-        id: opentrack
-        shell: bash
-        run: |
-          affected=true
-          if [ "$GITHUB_EVENT_NAME" = pull_request ]; then
-            projects=$(bun nx show projects --affected -p opentrack --json)
-            [[ $projects == *'"opentrack"'* ]] || affected=
-          fi
-          echo "affected=$affected" >> "$GITHUB_OUTPUT"
-
-      - name: Install Linux desktop libraries
-        if: runner.os == 'Linux' && steps.opentrack.outputs.affected
-        # Not cached: the caching action saves an empty cache when a mirror 404s, failing every later run.
+      - name: Install GTK
         run: |
           sudo apt-get update
-          sudo apt-get install -y libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev libxdo-dev libssl-dev patchelf
+          sudo apt-get install -y libgtk-3-dev libayatana-appindicator3-dev libxdo-dev
 
-      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
-        if: steps.opentrack.outputs.affected
-        with:
-          # Pull request caches are visible only to that pull request; main's serve them all.
-          save-if: ${{ github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch' }}
-
-      - name: Check Rust formatting
-        if: steps.opentrack.outputs.affected
-        run: bun nx run opentrack:format:check
-
-      # The Rust shell embeds the renderer and bundles the native Node sidecar;
-      # Nx builds those dependencies without running their JS checks or tests.
-      - name: Lint Rust
-        if: steps.opentrack.outputs.affected
-        run: bun nx run opentrack:lint
-
-      - name: Test Rust
-        if: steps.opentrack.outputs.affected
-        run: bun nx run opentrack:test
-
-      - name: Package and check Opentrack
-        if: steps.opentrack.outputs.affected
-        run: bun nx run opentrack:bundle:check
-        env:
-          CARGO_BUILD_JOBS: ${{ matrix.cargo-jobs }}
-
-      - name: Upload installer artifact
-        if: steps.opentrack.outputs.affected
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      - uses: taiki-e/install-action@3a3daafd3b7f23b8f65d9f5ba2db203fb59b79e2 # v2
         with:
-          name: opentrack-${{ matrix.platform }}
-          path: ${{ matrix.installer }}
-          if-no-files-found: error
+          tool: cargo-nextest
+
+      - run: cargo nextest run --workspace
+

.github/workflows/platforms.yml

@@ -0,0 +1,39 @@
+name: Platforms
+
+# macOS and Windows runners cost far more than Linux, so pull requests check Linux only and these run
+# on demand, e.g. before a release or after platform-specific changes.
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  CARGO_INCREMENTAL: 0
+  CARGO_TERM_COLOR: always
+
+jobs:
+  check:
+    name: Lint and test (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Set up Rust
+        uses: ./.github/actions/setup-rust
+
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+        with:
+          shared-key: platforms
+
+      - uses: taiki-e/install-action@3a3daafd3b7f23b8f65d9f5ba2db203fb59b79e2 # v2
+        with:
+          tool: cargo-nextest
+
+      - run: cargo lint
+
+      - run: cargo nextest run --workspace