fix(ci): run the Rust lanes when any vendored crate moves

[M3gA-Mind]

Summary

• Makes any vendored-crate pointer bump run the openhuman Rust lanes. Today it runs none of them while PR CI Gate still reports success.
• Replaces an enumeration of vendored paths with vendor/**, because the enumeration is what went stale.

Problem

92bab8df ("bump tinycortex") changes exactly one thing — the vendor/tinycortex pointer. CI Lite run 32358998415:

success   TinyCortex Memory Tests
success   PR CI Gate                          <- the aggregate gate
skipped   Rust Quality (fmt, clippy)
skipped   Rust Core Coverage (cargo-llvm-cov)
skipped   Rust Feature-Gate Smoke (gates off)
skipped   Rust Tauri Coverage (cargo-llvm-cov)

That commit is the current tip of main, so the tip of main has not been compiled by CI, and main is what promote-main-to-release.yml moves to release.

The changes filters enumerate vendored paths and the list is stale: rust-core and rust-core-full name vendor/motosan-ai-oauth/** and vendor/tinychannels — 2 of 10 submodules, and motosan-ai-oauth is an in-tree directory rather than a submodule. rust-tauri names none at all. The tinycortex filter that did match feeds only TinyCortex's own test lane, which is why that ran while nothing compiled openhuman against the new pin.

Every vendored crate is force-resolved by path through [patch.crates-io] in both cargo worlds, so any bump changes what the core and the shell compile against.

Solution

Match vendor/** and .gitmodules in rust-core, rust-core-full and rust-tauri.

Deliberately not a list of the ten current submodules. The release Docker job had this exact defect: its hand-maintained list went stale three times before fe5bcb22 (#5596) replaced it with --init --recursive, and that commit message says so. A list here fails the same way on the eleventh crate.

rust-core-full gets them too — a dependency-graph change invalidates per-module test scoping for the same reason a Cargo.lock change does.

Cost: a vendored bump now runs the full Rust lanes rather than nothing. That is the intent; eight of the ten crates could previously move with zero verification.

Submission Checklist

• Tests added or updated — N/A: CI path-filter configuration. The behaviour under change is which jobs a given diff triggers, which is only observable in a real CI run; the reproduction is quoted above and the fix is verifiable by pushing a vendor-only diff.
• Diff coverage ≥ 80% — N/A: no executable lines changed. YAML filter globs and comments.
• Coverage matrix updated — N/A: no feature added, removed or renamed.
• All affected feature IDs listed under ## Related — N/A: no matrix feature IDs touched.
• No new external network dependencies introduced — none.
• Manual smoke checklist updated — N/A: does not touch a release-cut surface.
• Linked issue closed via Closes #NNN — see ## Related.

Impact

• CI cost: vendored bumps become expensive rather than free. Given Staging: tinymemory capability mismatch (8191 vs 262143) — memory_tree, memory_store_raw_chunks, memory_diff all failing #5598 — a pinned artifact diverging from the submodule the host compiles against — a bump is the change most likely to break the build and least likely to be checked.
• Risk: low. Widening a path filter can only cause more jobs to run, never fewer.

Related

• Closes: ci: a vendored submodule bump skips every Rust lane and still reports PR CI Gate success #5612
• Follow-up PR(s)/TODOs: the sibling fail-open, where the coverage lane reports success after running zero tests, is ci: the Rust coverage gate reports success after running zero tests #5613.

---

AI Authored PR Metadata (required for Codex/Linear PRs)

Linear Issue

• Key: N/A
• URL: N/A

Commit & Branch

• Branch: N/A
• Commit SHA: N/A

Validation Run

• pnpm --filter openhuman-app format:check — N/A: no formatted source changed (workflow YAML only).
• pnpm typecheck — N/A: no TypeScript changed.
• Focused tests: N/A: no test targets a path filter.
• Rust fmt/check (if changed): N/A: no Rust changed.
• Tauri fmt/check (if changed): N/A: no Tauri source changed.

Validation Blocked

• command: observing the filter fire on a vendored bump
• error: not reproducible locally — dorny/paths-filter evaluates against the PR's changed-file set on GitHub
• impact: verified by reading the filters against the observed skip in run 32358998415; the first vendored bump after merge is the live confirmation.

Behavior Changes

• Intended behavior change: a diff touching vendor/** or .gitmodules now triggers the Rust lanes in full-suite mode.
• User-visible effect: none.

Parity Contract

• Legacy behavior preserved: all existing filter entries are unchanged; this only adds.
• Guard/fallback/dispatch parity checks: vendor/** is a superset of the two paths previously named, so nothing that triggered before stops triggering.

Duplicate / Superseded PR Handling

• Duplicate PR(s): none
• Canonical PR: this one
• Resolution: N/A

Summary by CodeRabbit

• Bug Fixes
  • Updated CI change detection to recognize all vendored dependency updates.
  • Ensured relevant Rust core, full-suite, and Tauri checks run when vendored code or submodule references change.
  • Prevented changes to unlisted vendored components from incorrectly bypassing validation.

[tinysweeper]

tinysweeper found nothing blocking. Approving.

$0.0000 · 0 in / 0 out · 119 embedded · openrouter/openai/text-embedding-3-small

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9d02340d-251a-42ed-92af-e4220f6568a6

📥 Commits

Reviewing files that changed from the base of the PR and between 4225ca4 and b0c3983.

📒 Files selected for processing (1)

• .github/workflows/ci-lite.yml

Included review availability: Your plan provides up to 10 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

CI path filters now detect all vendored submodule and .gitmodules changes. These changes trigger the Rust core, full Rust suite, and Tauri lanes.

Changes

Vendored dependency CI coverage

Layer / File(s)	Summary
Broaden vendored path filters .github/workflows/ci-lite.yml	The Rust core, full-suite, and Tauri filters now match .gitmodules and vendor/**. Vendored submodule changes trigger compilation and full-suite validation instead of being skipped.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to b0c39

This change makes vendored-crate updates run the relevant Rust CI lanes instead of being skipped; it only increases validation coverage, and no actionable merge-blocking risk remains after normal checks and review.

Possibly related PRs

• tinyhumansai/openhuman#5537: Broadens CI filters for vendored submodule changes.
• tinyhumansai/openhuman#5548: Updates CI filters for a vendored submodule pointer change.
• tinyhumansai/openhuman#5596: Replaces stale vendored-submodule handling in release CI.

Suggested labels: test, infra-ci-release, rust-core

Suggested reviewers: senamakel, tinysweeper

Poem

A rabbit checks each vendor pin,
So Rust lanes wake when changes begin.
Core and Tauri hop in line,
Full-suite checks now run on time.
CI watches every crate—
No hidden skips by garden gate! 🐇

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the CI fix: Rust lanes run when any vendored crate moves.
Linked Issues check	✅ Passed	The changes match vendor/** and .gitmodules in all three Rust lane filters and preserve full-suite behavior for vendored dependency changes [#5612].
Out of Scope Changes check	✅ Passed	All changes are limited to CI path filters and comments required to trigger the three Rust lanes for vendored changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[M3gA-Mind]

Verification follow-up: the glob was reproducible locally after all

The body lists this under Validation Blocked ("not reproducible locally"). The part that actually
decides whether this PR works is checkable without CI, so I checked it.

dorny/paths-filter@v4 (ci-lite.yml:90) matches with picomatch, and a submodule pointer bump is
reported by git/GitHub as a single path with no trailing slash — gh api …/commits/72823015 --jq '.files[]'
returns modified vendor/tinyflows. So the question is whether vendor/** matches a bare gitlink.

Run against both picomatch majors in the repo's pnpm store (2.3.2 and 4.0.4), { dot: true }:

path	vendor/**	old vendor/tinychannels	old vendor/motosan-ai-oauth/**
vendor/tinycortex (the reported case, 92bab8d)	match	–	–
vendor/tinyflows (7282301)	match	–	–
vendor/tinychannels	match	match	–
vendor/motosan-ai-oauth/Cargo.toml	match	–	match
vendor/motosan-ai-oauth/src/lib.rs	match	–	match
.gitmodules	no match	–	–
src/core/all.rs (control)	no match	–	–

Three things this pins down:

1. vendor/** fires on bare gitlinks, so it covers the exact case the PR targets.
2. It is a strict superset of both patterns it replaces — the parity claim in the body holds, nothing
   that triggered before stops triggering.
3. .gitmodules genuinely needs its own entry; vendor/** does not cover it. Both are present.

Corroborating live evidence: the pre-existing tinycortex filter (ci-lite.yml:180, also a bare
vendor/tinycortex) did fire on 92bab8d — TinyCortex Memory Tests ran while every Rust lane
skipped. That is independent proof paths-filter sees the gitlink path.

Also checked the one risk the widening introduces: every lane this can newly trigger
(rust-quality, rust-feature-gate-smoke, rust-rss-bench, rust-core-coverage,
rust-tauri-coverage) already checks out with submodules: recursive, so a vendor-triggered run has
the vendored code present.

No code change — evidence only.

Adjacent gap, deliberately not folded in

The frontend filter has no vendor/ entry, yet app/src/services/__tests__/rpcMethods.test.ts:169
reads vendor/tinychannels/src/controllers/schemas.rs off disk at test time — the lane even carries a
dedicated git submodule update --init vendor/tinychannels step (ci-lite.yml:250-254). So a
tinychannels bump that changes a controller schema can still skip the drift guard written to catch it.
Same class as this PR, different lane. Leaving it out to keep the scope honest; worth a follow-up
issue alongside #5613.