ci: consolidate CI into single job; fix sidebar footer (#14)

.gitea/workflows/ci.yml

@@ -2,11 +2,9 @@ name: CI
 
 on:
   push:
-    branches:
-      - "**"
-  pull_request:
     branches:
       - main
+  pull_request:
 
 env:
   CARGO_TERM_COLOR: always
@@ -23,10 +21,10 @@ concurrency:
 
 jobs:
   # ---------------------------------------------------------------------------
-  # Stage 1: Code quality checks (run in parallel)
+  # Stage 1: Lint, audit, and test (single job to share cargo cache)
   # ---------------------------------------------------------------------------
-  fmt:
-    name: Format
+  check:
+    name: Check
     runs-on: docker
     container:
       image: rust:1.94-bookworm
@@ -37,105 +35,59 @@ jobs:
           git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}"
           git checkout FETCH_HEAD
-      - run: rustup component add rustfmt
-      # Format check does not compile, so sccache is not needed here.
-      - run: cargo fmt --all --check
-        env:
-          RUSTC_WRAPPER: ""
-
-  clippy:
-    name: Clippy
-    runs-on: docker
-    container:
-      image: rust:1.94-bookworm
-    steps:
-      - name: Checkout
-        run: |
-          git init
-          git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
-          git fetch --depth=1 origin "${GITHUB_SHA}"
-          git checkout FETCH_HEAD
-      - name: Install sccache
+      - name: Install tools
         run: |
+          rustup component add rustfmt clippy
           curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.9.1/sccache-v0.9.1-x86_64-unknown-linux-musl.tar.gz \
             | tar xz --strip-components=1 -C /usr/local/bin/ sccache-v0.9.1-x86_64-unknown-linux-musl/sccache
           chmod +x /usr/local/bin/sccache
-      - run: rustup component add clippy
-      # Lint the agent (native only).
+          cargo install cargo-audit --locked
+        env:
+          RUSTC_WRAPPER: ""
+
+      # Format (no compilation needed)
+      - name: Format
+        run: cargo fmt --all --check
+        env:
+          RUSTC_WRAPPER: ""
+
+      # Clippy (compiles once, sccache reuses across feature sets)
       - name: Clippy (agent)
         run: cargo clippy -p compliance-agent -- -D warnings
-      # Lint the dashboard for both feature sets independently.
-      # sccache deduplicates shared crates between the two compilations.
       - name: Clippy (dashboard server)
         run: cargo clippy -p compliance-dashboard --features server --no-default-features -- -D warnings
       - name: Clippy (dashboard web)
         run: cargo clippy -p compliance-dashboard --features web --no-default-features -- -D warnings
       - name: Clippy (mcp)
         run: cargo clippy -p compliance-mcp -- -D warnings
-      - name: Show sccache stats
-        run: sccache --show-stats
-        if: always()
 
-  audit:
-    name: Security Audit
-    runs-on: docker
-    if: github.ref == 'refs/heads/main'
-    container:
-      image: rust:1.94-bookworm
-    steps:
-      - name: Checkout
-        run: |
-          git init
-          git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
-          git fetch --depth=1 origin "${GITHUB_SHA}"
-          git checkout FETCH_HEAD
-      - run: cargo install cargo-audit
-        env:
-          RUSTC_WRAPPER: ""
-      - run: cargo audit
+      # Security audit
+      - name: Security Audit
+        run: cargo audit
         env:
           RUSTC_WRAPPER: ""
 
-  # ---------------------------------------------------------------------------
-  # Stage 2: Tests (only after all quality checks pass)
-  # ---------------------------------------------------------------------------
-  test:
-    name: Tests
-    runs-on: docker
-    needs: [fmt, clippy, audit]
-    container:
-      image: rust:1.94-bookworm
-    steps:
-      - name: Checkout
-        run: |
-          git init
-          git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
-          git fetch --depth=1 origin "${GITHUB_SHA}"
-          git checkout FETCH_HEAD
-      - name: Install sccache
-        run: |
-          curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.9.1/sccache-v0.9.1-x86_64-unknown-linux-musl.tar.gz \
-            | tar xz --strip-components=1 -C /usr/local/bin/ sccache-v0.9.1-x86_64-unknown-linux-musl/sccache
-          chmod +x /usr/local/bin/sccache
-      - name: Run tests (core + agent)
+      # Tests (reuses compilation artifacts from clippy)
+      - name: Tests (core + agent)
         run: cargo test -p compliance-core -p compliance-agent
-      - name: Run tests (dashboard server)
+      - name: Tests (dashboard server)
         run: cargo test -p compliance-dashboard --features server --no-default-features
-      - name: Run tests (dashboard web)
+      - name: Tests (dashboard web)
         run: cargo test -p compliance-dashboard --features web --no-default-features
+
       - name: Show sccache stats
         run: sccache --show-stats
         if: always()
 
   # ---------------------------------------------------------------------------
-  # Stage 3: Deploy (only on main, after tests pass)
+  # Stage 2: Deploy (only on main, after checks pass)
   # Each service only deploys when its relevant files changed.
   # ---------------------------------------------------------------------------
   detect-changes:
     name: Detect Changes
     runs-on: docker
     if: github.ref == 'refs/heads/main'
-    needs: [test]
+    needs: [check]
     container:
       image: alpine:latest
     outputs: