ci: replace reusable shell inputs with typed operations

.github/workflows/_ci-suite.yaml

@@ -60,7 +60,7 @@ jobs:
       toolchain_components: "clippy, rustfmt, rust-src"
       enable_magic_cache: true
       enable_rust_cache: true
-      run_script: just ci-check
+      operation: quality
 
   cargo-graph:
     if: ${{ inputs.include_cargo_graph }}
@@ -74,12 +74,7 @@ jobs:
       toolchain_components: "rust-src"
       enable_magic_cache: true
       enable_rust_cache: true
-      run_script: |
-        mkdir -p target/cargo-rail
-        cargo rail config validate --strict
-        cargo rail config migrate --check
-        cargo rail unify --check --explain --format json \
-          --output target/cargo-rail/unify-result.json
+      operation: cargo-graph
       artifact_name: cargo-graph-${{ inputs.cache_key_prefix }}
       artifact_path: target/cargo-rail/unify-result.json
       artifact_always: true
@@ -95,9 +90,7 @@ jobs:
       toolchain_components: "rust-src"
       enable_magic_cache: true
       enable_rust_cache: true
-      run_script: |
-        just check-feature-matrix
-        just test-feature-matrix
+      operation: feature-contracts
 
   ci:
     name: CI (${{ matrix.target.name }})
@@ -115,25 +108,9 @@ jobs:
       toolchain_components: ${{ contains(matrix.target.name, 'windows-msvc') && 'clippy' || 'clippy, rustfmt, rust-src' }}
       enable_magic_cache: ${{ matrix.target.type == 'runson' }}
       enable_rust_cache: true
-      run_script: |
-        export RSCRYPTO_TEST_MODE="${{ inputs.test_mode }}"
-        case "${{ matrix.target.name }}" in
-          x86_64-pc-windows-msvc)
-            echo "Windows x86_64 lane: compile smoke plus BLAKE3 ASM runtime vectors"
-            cargo clippy --workspace --lib --all-features -- -D warnings
-            cargo test --workspace --all-features --no-run
-            cargo test --workspace --features blake3 --test blake3_official_vectors --test blake3_differential
-            ;;
-          aarch64-pc-windows-msvc)
-            echo "Windows AArch64 lane: compile-only smoke"
-            cargo clippy --workspace --lib --all-features -- -D warnings
-            cargo test --workspace --all-features --no-run
-            ;;
-          *)
-            bash scripts/ci/native-check.sh --all-targets
-            bash scripts/test/test.sh --all
-            ;;
-        esac
+      operation: native
+      target: ${{ matrix.target.name }}
+      test_mode: ${{ inputs.test_mode }}
 
   ci-ibm-s390x:
     name: CI (IBM Z s390x)
@@ -146,14 +123,8 @@ jobs:
       toolchain_components: "clippy, rustfmt"
       enable_magic_cache: false
       enable_rust_cache: true
-      pre_script: |
-        uname -a
-        lscpu
-        sed -n '1,50p' /proc/cpuinfo
-      run_script: |
-        export RSCRYPTO_TEST_MODE="${{ inputs.test_mode }}"
-        bash scripts/ci/native-check.sh
-        bash scripts/test/test.sh --all
+      operation: native-ibm
+      test_mode: ${{ inputs.test_mode }}
 
   ci-ibm-power10:
     name: CI (IBM POWER10 ppc64le)
@@ -166,14 +137,8 @@ jobs:
       toolchain_components: "clippy, rustfmt"
       enable_magic_cache: false
       enable_rust_cache: true
-      pre_script: |
-        uname -a
-        lscpu
-        sed -n '1,50p' /proc/cpuinfo
-      run_script: |
-        export RSCRYPTO_TEST_MODE="${{ inputs.test_mode }}"
-        bash scripts/ci/native-check.sh
-        bash scripts/test/test.sh --all
+      operation: native-ibm
+      test_mode: ${{ inputs.test_mode }}
 
   cross-targets:
     name: Cross Targets
@@ -186,7 +151,7 @@ jobs:
       toolchain_components: "clippy, rust-src"
       enable_magic_cache: true
       enable_rust_cache: true
-      run_script: bash scripts/ci/cross-targets.sh deep
+      operation: cross-targets
 
   supply-chain:
     name: Supply Chain (${{ inputs.supply_chain_mode }})
@@ -198,14 +163,5 @@ jobs:
       tools_mode: supply-chain
       enable_magic_cache: true
       enable_rust_cache: true
-      run_script: |
-        if [[ "${{ inputs.supply_chain_mode }}" == "full" ]]; then
-          cargo deny check all
-          # RustCrypto `rsa` is used only as a dev/test/bench oracle. Production
-          # RSA verification is implemented in `src/auth/rsa.rs`; keep this
-          # scoped to the known Marvin advisory until the oracle dependency is
-          # removed or fixed.
-          cargo audit --ignore RUSTSEC-2023-0071
-        else
-          cargo deny check advisories
-        fi
+      operation: supply-chain
+      supply_chain_mode: ${{ inputs.supply_chain_mode }}

.github/workflows/_rust-job.yaml

@@ -3,6 +3,9 @@ name: _rust-job
 on:
   workflow_call:
     inputs:
+      operation:
+        required: true
+        type: string
       runner:
         required: true
         type: string
@@ -30,13 +33,62 @@ on:
         required: false
         type: boolean
         default: true
-      pre_script:
+      test_mode:
         required: false
         type: string
         default: ""
-      run_script:
-        required: true
+      target:
+        required: false
+        type: string
+        default: ""
+      platform:
+        required: false
+        type: string
+        default: ""
+      supply_chain_mode:
+        required: false
+        type: string
+        default: ""
+      base_sha:
+        required: false
+        type: string
+        default: ""
+      miri_tree_borrows:
+        required: false
+        type: boolean
+        default: false
+      bench_targets:
+        required: false
+        type: string
+        default: all
+      bench_filter:
+        required: false
+        type: string
+        default: ""
+      bench_quick:
+        required: false
+        type: boolean
+        default: false
+      dudect_timeout:
+        required: false
+        type: number
+        default: 1800
+      dudect_filter:
+        required: false
+        type: string
+        default: ""
+      dudect_gate:
+        required: false
         type: string
+        default: required
+      binsec_timeout:
+        required: false
+        type: number
+        default: 900
+      upload_raw_artifacts:
+        required: false
+        type: boolean
+        default: false
       artifact_name:
         required: false
         type: string
@@ -73,18 +125,26 @@ jobs:
           enable-magic-cache: ${{ inputs.enable_magic_cache }}
           enable-rust-cache: ${{ inputs.enable_rust_cache }}
 
-      - name: Pre Run
-        if: inputs.pre_script != ''
-        shell: bash
-        env:
-          PRE_SCRIPT: ${{ inputs.pre_script }}
-        run: bash -euo pipefail <<<"$PRE_SCRIPT"
-
       - name: Run
         shell: bash
         env:
-          RUN_SCRIPT: ${{ inputs.run_script }}
-        run: bash -euo pipefail <<<"$RUN_SCRIPT"
+          RSCRYPTO_CI_OPERATION: ${{ inputs.operation }}
+          RSCRYPTO_CI_RUNNER: ${{ inputs.runner }}
+          RSCRYPTO_CI_TEST_MODE: ${{ inputs.test_mode }}
+          RSCRYPTO_CI_TARGET: ${{ inputs.target }}
+          RSCRYPTO_CI_PLATFORM: ${{ inputs.platform }}
+          RSCRYPTO_CI_SUPPLY_CHAIN_MODE: ${{ inputs.supply_chain_mode }}
+          RSCRYPTO_CI_BASE_SHA: ${{ inputs.base_sha }}
+          RSCRYPTO_CI_MIRI_TREE_BORROWS: ${{ inputs.miri_tree_borrows && 'true' || 'false' }}
+          RSCRYPTO_CI_BENCH_TARGETS: ${{ inputs.bench_targets }}
+          RSCRYPTO_CI_BENCH_FILTER: ${{ inputs.bench_filter }}
+          RSCRYPTO_CI_BENCH_QUICK: ${{ inputs.bench_quick && 'true' || 'false' }}
+          RSCRYPTO_CI_DUDECT_TIMEOUT: ${{ inputs.dudect_timeout }}
+          RSCRYPTO_CI_DUDECT_FILTER: ${{ inputs.dudect_filter }}
+          RSCRYPTO_CI_DUDECT_GATE: ${{ inputs.dudect_gate }}
+          RSCRYPTO_CI_BINSEC_TIMEOUT: ${{ inputs.binsec_timeout }}
+          RSCRYPTO_CI_UPLOAD_RAW_ARTIFACTS: ${{ inputs.upload_raw_artifacts && 'true' || 'false' }}
+        run: scripts/ci/run-rust-job.sh
 
       - name: Upload Artifact (always)
         if: always() && inputs.artifact_name != '' && inputs.artifact_path != '' && inputs.artifact_always

.github/workflows/bench.yaml

@@ -74,28 +74,10 @@ jobs:
       toolchain_components: ${{ matrix.toolchain_components }}
       enable_magic_cache: false
       enable_rust_cache: true
-      pre_script: |
-        echo "Bench host: ${{ matrix.platform }} (${{ matrix.os }})"
-        uname -a
-        lscpu
-        sed -n '1,50p' /proc/cpuinfo
-      run_script: |
-        RUN_DATE="$(date -u +"%Y-%m-%d")"
-        RUN_TIME="$(date -u +"%H_%M_%S")"
-        RUN_COMMIT="$(git rev-parse HEAD 2>/dev/null || echo unknown)"
-        BENCH_OUTPUT_DIR=benchmark-results \
-        BENCH_RESULTS_DIR=benchmark-results \
-        BENCH_RUN_DATE="$RUN_DATE" \
-        BENCH_RUN_TIME="$RUN_TIME" \
-        BENCH_RUN_OS="${{ matrix.os }}" \
-        BENCH_RUN_ARCH="${{ matrix.platform }}" \
-        BENCH_RUN_COMMIT="$RUN_COMMIT" \
-        BENCH_RUN_MODE=ci \
-        BENCH_ONLY="${{ inputs.targets || 'all' }}" \
-        BENCH_FILTER="${{ inputs.filter }}" \
-        BENCH_QUICK=${{ inputs.quick && 'true' || 'false' }} \
-        BENCH_ALLOW_FULL_HASHES_COMP=true \
-        BENCH_PLATFORM="${{ matrix.platform }}" \
-        scripts/ci/run-bench.sh
+      operation: benchmark
+      platform: ${{ matrix.platform }}
+      bench_targets: ${{ inputs.targets || 'all' }}
+      bench_filter: ${{ inputs.filter }}
+      bench_quick: ${{ inputs.quick }}
       artifact_name: benchmark-${{ matrix.artifact_suffix }}
       artifact_path: benchmark-results/

.github/workflows/ci.yaml

@@ -72,9 +72,8 @@ jobs:
       toolchain_components: "clippy, rustfmt"
       enable_magic_cache: false
       enable_rust_cache: true
-      run_script: |
-        set -euo pipefail
-        GITHUB_BASE_SHA="${{ github.event.pull_request.base.sha }}" bash scripts/ci/dependabot-smoke.sh
+      operation: dependabot-smoke
+      base_sha: ${{ github.event.pull_request.base.sha }}
 
   suite:
     name: CI Suite

.github/workflows/ct.yaml

@@ -11,8 +11,8 @@ on:
       dudect_timeout:
         description: "Timeout in seconds for each per-case dudect command."
         required: false
-        type: string
-        default: "1800"
+        type: number
+        default: 1800
       dudect_filter:
         description: "Optional comma-separated DudeCT case/name/filter substrings. Empty = all cases in selected gate."
         required: false
@@ -26,8 +26,8 @@ on:
       binsec_timeout:
         description: "Timeout in seconds for each BINSEC kernel batch on Linux targets."
         required: false
-        type: string
-        default: "900"
+        type: number
+        default: 900
       upload_raw_artifacts:
         description: "Upload raw CT build/proof artifacts for debugging. Default uploads compact reports only."
         required: false
@@ -43,8 +43,8 @@ on:
       dudect_timeout:
         description: "Timeout in seconds for each per-case dudect command."
         required: false
-        type: string
-        default: "1800"
+        type: number
+        default: 1800
       dudect_filter:
         description: "Optional comma-separated DudeCT case/name/filter substrings. Empty = all cases in selected gate."
         required: false
@@ -62,8 +62,8 @@ on:
       binsec_timeout:
         description: "Timeout in seconds for each BINSEC kernel batch on Linux targets."
         required: false
-        type: string
-        default: "900"
+        type: number
+        default: 900
       upload_raw_artifacts:
         description: "Upload raw CT build/proof artifacts for debugging. Default uploads compact reports only."
         required: false
@@ -118,61 +118,14 @@ jobs:
       toolchain_components: ${{ matrix.toolchain_components }}
       enable_magic_cache: ${{ matrix.enable_magic_cache }}
       enable_rust_cache: ${{ matrix.enable_rust_cache }}
-      pre_script: |
-        set -euo pipefail
-        mkdir -p target/ct-evidence-package
-        {
-          echo "CT platform: ${{ matrix.platform }}"
-          echo "CT target: ${{ matrix.target }}"
-          echo "CT runner: ${{ matrix.runner }}"
-          uname -a || true
-          rustc -vV
-          cargo -V
-          lscpu || true
-          sed -n '1,80p' /proc/cpuinfo || true
-        } 2>&1 | tee "target/ct-evidence-package/host-${{ matrix.artifact_suffix }}.log"
-      run_script: |
-        set -euo pipefail
-        evidence_dir="target/ct-evidence-package"
-        mkdir -p "$evidence_dir"
-        status=0
-        raw_artifacts="${{ inputs.upload_raw_artifacts && 'true' || 'false' }}"
-        raw_dudect_filter="${{ inputs.dudect_filter || '' }}"
-        raw_dudect_gate="${{ inputs.dudect_gate || 'required' }}"
-        dudect_filter="$(printf '%s' "$raw_dudect_filter" | tr -d '[:space:]')"
-        dudect_gate="$(printf '%s' "$raw_dudect_gate" | tr -d '[:space:]')"
-        if [[ "$raw_dudect_filter" != "$dudect_filter" ]]; then
-          echo "Normalized whitespace in DudeCT filter input."
-        fi
-        case "$dudect_gate" in
-          required|diagnostic|all) ;;
-          *)
-            echo "Invalid DudeCT gate: $dudect_gate" >&2
-            exit 2
-            ;;
-        esac
-        args=(
-          --target "${{ matrix.target }}"
-          --dudect-timeout "${{ inputs.dudect_timeout || '1800' }}"
-          --binsec-timeout "${{ inputs.binsec_timeout || '900' }}"
-          --dudect-gate "$dudect_gate"
-        )
-        if [[ -n "$dudect_filter" ]]; then
-          args+=(--dudect-filter "$dudect_filter")
-        fi
-        package_args=(--target "${{ matrix.target }}" --suffix "${{ matrix.artifact_suffix }}" --out-dir "$evidence_dir")
-
-        {
-          echo "Running: scripts/ct/full.py ${args[*]}"
-          scripts/ct/full.py "${args[@]}"
-        } 2>&1 | tee "$evidence_dir/ct-full-${{ matrix.artifact_suffix }}.log" || status=$?
-
-        if [[ "$raw_artifacts" == "true" ]]; then
-          package_args+=(--raw)
-        fi
-        scripts/ct/python.sh scripts/ct/package_evidence.py "${package_args[@]}"
-
-        exit "$status"
+      operation: constant-time
+      platform: ${{ matrix.platform }}
+      target: ${{ matrix.target }}
+      dudect_timeout: ${{ inputs.dudect_timeout }}
+      dudect_filter: ${{ inputs.dudect_filter }}
+      dudect_gate: ${{ inputs.dudect_gate }}
+      binsec_timeout: ${{ inputs.binsec_timeout }}
+      upload_raw_artifacts: ${{ inputs.upload_raw_artifacts }}
       artifact_name: ct-${{ matrix.artifact_suffix }}
       artifact_path: target/ct-evidence-package/
       artifact_always: true