From 1203102fe98b1a0f9cff7484526ef34196ece364 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Wed, 5 Aug 2026 14:03:05 +0800
Subject: [PATCH] ci: build against bread-ecosystem's shared Arch CI image, add
 check.yml
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Same fix as breadpad: build inside the shared pinned Arch container
(bread-ecosystem/ci/, cloned at the sha in ci/bread-ecosystem.rev)
instead of building natively against whatever's on the runner host.
Adds check.yml (clippy + test on feature/**/fix/**) as a fast-fail gate
before anything reaches main.

Verified locally: build, clippy, and test all pass through the new
container path — no pre-existing lint/test debt found here.
---
 .forgejo/workflows/check.yml       | 24 ++++++++++++++++++++++++
 .forgejo/workflows/dev-release.yml |  2 +-
 .forgejo/workflows/rc-release.yml  |  2 +-
 .forgejo/workflows/release.yml     |  2 +-
 ci/bread-ecosystem.rev             |  1 +
 ci/build.sh                        | 20 ++++++++++++++++++++
 6 files changed, 48 insertions(+), 3 deletions(-)
 create mode 100644 .forgejo/workflows/check.yml
 create mode 100644 ci/bread-ecosystem.rev
 create mode 100755 ci/build.sh

diff --git a/.forgejo/workflows/check.yml b/.forgejo/workflows/check.yml
new file mode 100644
index 0000000..b547c34
--- /dev/null
+++ b/.forgejo/workflows/check.yml
@@ -0,0 +1,24 @@
+name: check
+
+# Fast-fail lint/test on short-lived work branches, before it ever reaches
+# main and triggers a dev-track release build.
+on:
+  push:
+    branches: ['feature/**', 'fix/**']
+
+jobs:
+  check:
+    runs-on: [self-hosted, hestia]
+    steps:
+      - name: checkout
+        run: |
+          set -euo pipefail
+          rm -rf src && mkdir src
+          git clone --branch "${GITHUB_REF_NAME}" --depth 1 \
+            "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
+
+      - name: clippy
+        run: cd src && bash ci/build.sh cargo clippy --workspace --all-targets --locked -- -D warnings
+
+      - name: test
+        run: cd src && bash ci/build.sh cargo test --workspace --locked
diff --git a/.forgejo/workflows/dev-release.yml b/.forgejo/workflows/dev-release.yml
index fd4f4df..04b6a68 100644
--- a/.forgejo/workflows/dev-release.yml
+++ b/.forgejo/workflows/dev-release.yml
@@ -19,7 +19,7 @@ jobs:
             "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
 
       - name: build
-        run: cd src && cargo build --release --locked
+        run: cd src && bash ci/build.sh cargo build --release --locked
 
       - name: compute dev version
         run: |
diff --git a/.forgejo/workflows/rc-release.yml b/.forgejo/workflows/rc-release.yml
index d697a76..46c2343 100644
--- a/.forgejo/workflows/rc-release.yml
+++ b/.forgejo/workflows/rc-release.yml
@@ -21,7 +21,7 @@ jobs:
             "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
 
       - name: build
-        run: cd src && cargo build --release --locked
+        run: cd src && bash ci/build.sh cargo build --release --locked
 
       - name: prepare artifacts
         run: |
diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
index 803be86..cd68a3a 100644
--- a/.forgejo/workflows/release.yml
+++ b/.forgejo/workflows/release.yml
@@ -17,7 +17,7 @@ jobs:
             "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
 
       - name: build
-        run: cd src && cargo build --release --locked
+        run: cd src && bash ci/build.sh cargo build --release --locked
 
       - name: prepare artifacts
         run: |
diff --git a/ci/bread-ecosystem.rev b/ci/bread-ecosystem.rev
new file mode 100644
index 0000000..474f1fd
--- /dev/null
+++ b/ci/bread-ecosystem.rev
@@ -0,0 +1 @@
+620c5a1317a6b57276eabca961facdb78bf510db
diff --git a/ci/build.sh b/ci/build.sh
new file mode 100755
index 0000000..54695da
--- /dev/null
+++ b/ci/build.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Delegates to bread-ecosystem's shared CI build image/script, pinned to
+# the commit in ci/bread-ecosystem.rev — not `main`. bread-ecosystem's CI
+# files now affect every product's release pipeline, so bumping the pin
+# is a deliberate act instead of silent drift.
+#
+# Usage: ci/build.sh cargo build --release --locked
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+REV="$(cat "${ROOT}/ci/bread-ecosystem.rev")"
+
+CACHE_DIR="/tmp/bread-ecosystem-ci-${REV}"
+if [ ! -d "$CACHE_DIR" ]; then
+    rm -rf /tmp/bread-ecosystem-ci-*
+    git clone https://git.breadway.dev/Breadway/bread-ecosystem.git "$CACHE_DIR"
+    git -C "$CACHE_DIR" checkout --quiet "$REV"
+fi
+
+bash "${CACHE_DIR}/ci/build.sh" breadclip "$ROOT" "$@"