Release 0.3.0: Redrob Query as a Rust egui/wgpu app

.github/PULL_REQUEST_TEMPLATE.md

@@ -13,18 +13,18 @@
 <!-- The commands you actually ran, and what they printed. -->
 
 ```
-npm run release:check
-npm test
-npm run build
-npm run rust:fmt && npm run rust:clippy && npm run rust:test
+python3 scripts/check-brand.py
+cargo fmt --all -- --check
+cargo clippy -p redrob-query -p redrob-query-core --all-targets -- -D warnings
+cargo test -p redrob-query-core
 ```
 
 ## Checklist
 
 - [ ] No credentials, connection strings, or real database contents in the diff,
       the tests, or the commit messages.
-- [ ] Read-only guarantees preserved: no new desktop/native mutation command is
-      registered, and saved desktop profiles stay read-only.
+- [ ] Read-only guarantees preserved: typed queries still go through the engine's
+      read-only gate, and writes only through reviewed edits and the structure forms.
 - [ ] If local-storage behaviour changed, `docs/SECURITY.md` says what is now
       stored.
 - [ ] If user-visible strings changed, they name Redrob Query — not DBeaver.

.github/workflows/ci.yml

@@ -1,159 +1,78 @@
+# The one pull-request workflow. `checks` runs the repository scripts: the brand-asset pins. `rust`
+# runs formatting, clippy and the tests of OUR crates (the shell `redrob-query` and the engine
+# `redrob-query-core`) with `--profile ci` (root Cargo.toml: every dependency at opt-level 0, no
+# incremental), and is skipped when no Rust input changed or when the pull request targets main (that
+# code already passed here on its way into develop). The release workflow does not repeat any of this;
+# PR policy is the org-wide workflow. Adapted from redrob-canvas.
 name: CI
 
-# Plain pull_request (never pull_request_target) and no secrets are consumed,
-# so a pull request from a fork receives no credential of any kind.
 on:
   pull_request:
-  push:
-    branches: [main, develop]
   workflow_dispatch:
 
 permissions:
   contents: read
 
 concurrency:
-  group: ci-${{ github.event.pull_request.number || github.ref }}
+  group: ci-${{ github.ref }}
   cancel-in-progress: true
 
+env:
+  CARGO_TERM_COLOR: always
+  CARGO_INCREMENTAL: 0
+  RUST_BACKTRACE: 1
+  OUR_CRATES: -p redrob-query -p redrob-query-core
+
 jobs:
-  frontend:
-    name: Release metadata, types, tests, build
-    runs-on: ubuntu-24.04
-    timeout-minutes: 20
+  checks:
+    name: brand assets
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
-      - name: Check out source
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 22
-          cache: npm
-
-      - name: Install locked JavaScript dependencies
-        run: npm ci
-
-      # Asserts productName, identifier, licence and the version fan-out across
-      # package.json, Cargo.toml, tauri.conf.json and package-lock.json.
-      - name: Validate release metadata
-        run: npm run release:check
-
-      # This job runs the checks individually rather than `npm run check`, so a guard wired only into
-      # that script would never run where the change is reviewed. Fails on a raw colour literal, a
-      # lucide import in source or in the manifest, a brand file whose hash moved, and a font-family
-      # that is not a system token.
-      - name: Check the design system
-        run: npm run check:design
-
-      - name: Typecheck
-        run: npm run typecheck
-
-      - name: Test
-        run: npm test
-
-      - name: Build
-        run: npm run build
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.3.1
+      - name: Brand assets match the design system pins
+        run: python3 scripts/check-brand.py
 
   rust:
-    name: Format, clippy, tests
-    runs-on: ubuntu-24.04
-    timeout-minutes: 30
+    name: fmt, clippy, test (profile ci)
+    # A release PR into main carries code that already passed here on its way into develop.
+    if: github.base_ref != 'main'
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
     steps:
-      - name: Check out source
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      # The Tauri shell links WebKitGTK; the redrob-core crate deliberately does not.
-      - name: Install Linux desktop dependencies
-        run: >-
-          sudo apt-get update && sudo apt-get install -y
-          libwebkit2gtk-4.1-dev libjavascriptcoregtk-4.1-dev
-          libsoup-3.0-dev librsvg2-dev patchelf libssl-dev
-
-      # Channel and components must match rust-toolchain.toml, which
-      # scripts/validate-release.mjs pins against Cargo rust-version.
-      - name: Set up Rust
-        uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.3.1
+      - name: Did any Rust input change?
+        id: rs
+        run: |
+          git fetch -q origin "${{ github.base_ref }}" --depth=1
+          if git diff --quiet "origin/${{ github.base_ref }}"...HEAD -- '*.rs' '*.toml' Cargo.lock '*.json' .github/workflows/ci.yml; then
+            echo changed=false >> "$GITHUB_OUTPUT"; else echo changed=true >> "$GITHUB_OUTPUT"; fi
+      - name: System libraries for the desktop app
+        if: steps.rs.outputs.changed == 'true'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            libxkbcommon-dev libwayland-dev libx11-dev libxrandr-dev libxi-dev \
+            libgl1-mesa-dev libgtk-3-dev libdbus-1-dev
+      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
+        if: steps.rs.outputs.changed == 'true'
         with:
-          toolchain: 1.94.0
+          toolchain: "1.95.0"
           components: rustfmt, clippy
-
-      - name: Format
-        run: npm run rust:fmt
-
-      - name: Clippy
-        run: npm run rust:clippy
-
-      - name: Test
-        run: npm run rust:test
-
-  # The live PostgreSQL and MySQL tests in redrob-core are #[ignore]d because they need a real
-  # server, and until this job nothing ever ran them: a write path checked only against SQLite and a
-  # hand-copied query is the gap the plan calls out. Service containers give each run fresh servers;
-  # only the core crate is built, so the WebKitGTK packages the shell needs are not installed here.
-  rust-live-databases:
-    name: Live PostgreSQL and MySQL tests
-    runs-on: ubuntu-24.04
-    timeout-minutes: 30
-    services:
-      postgres:
-        image: postgres:16.4
-        env:
-          POSTGRES_PASSWORD: redrob
-          POSTGRES_DB: redrob
-        ports: ["5432:5432"]
-        options: >-
-          --health-cmd "pg_isready -U postgres" --health-interval 5s --health-timeout 5s --health-retries 20
-      mysql:
-        image: mysql:8.4.2
-        env:
-          MYSQL_ROOT_PASSWORD: redrob
-          MYSQL_DATABASE: redrob
-        ports: ["3306:3306"]
-        options: >-
-          --health-cmd "mysqladmin ping -h 127.0.0.1 -predrob" --health-interval 5s --health-timeout 5s --health-retries 30
-    env:
-      # Throwaway credentials for the per-run service containers above; nothing else accepts them.
-      REDROB_TEST_POSTGRES_URL: postgres://postgres:redrob@127.0.0.1:5432/redrob
-      REDROB_TEST_MYSQL_URL: mysql://root:redrob@127.0.0.1:3306/redrob
-    steps:
-      - name: Check out source
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Set up Rust
-        uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
+      - uses: Swatinem/rust-cache@v2
+        if: steps.rs.outputs.changed == 'true'
         with:
-          toolchain: 1.94.0
-
-      - name: Live database tests
-        run: cargo test --locked -p redrob-core -- --ignored --exact --nocapture
-          connection::tests::live_postgres_native_scalars_when_configured
-          connection::tests::live_mysql_native_scalars_when_configured
-          connection::tests::live_postgres_cell_edits_commit_together_or_not_at_all
-          connection::tests::live_mysql_cell_edits_commit_together_or_not_at_all
-          connection::tests::live_postgres_table_changes_create_and_extend_a_table
-          connection::tests::live_mysql_table_changes_create_and_extend_a_table
-
-  # This job exists because its absence cost a failed release. The rustls advisory
-  # RUSTSEC-2026-0285 sat in Cargo.lock through every green pull request, because the
-  # only place cargo audit ran was the release workflow -- so the first thing that
-  # noticed was a tag. A dependency advisory should fail the pull request that could
-  # have fixed it, not the release that cannot.
-  rust-advisories:
-    name: Rust security advisories
-    runs-on: ubuntu-24.04
-    timeout-minutes: 15
-    steps:
-      - name: Check out source
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Set up Rust for security audit
-        uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
-        with:
-          toolchain: stable
-
-      - name: Install pinned cargo-audit
-        run: cargo +stable install cargo-audit --version 0.22.2 --locked
-
-      # The Cargo workspace is at the repository root, not under src-tauri.
-      - name: Audit locked Rust dependencies
-        run: cargo +stable audit --file Cargo.lock
+          key: ci-profile
+      - name: Formatting
+        if: steps.rs.outputs.changed == 'true'
+        run: cargo fmt --all -- --check
+      - name: Clippy
+        if: steps.rs.outputs.changed == 'true'
+        run: |
+          # shellcheck disable=SC2086 # OUR_CRATES is a list of flags on purpose
+          cargo clippy $OUR_CRATES --all-targets --locked --profile ci -- -D warnings
+      - name: Tests
+        if: steps.rs.outputs.changed == 'true'
+        run: |
+          # shellcheck disable=SC2086
+          cargo test $OUR_CRATES --locked --profile ci