Merge pull request #12 from kexi/chore/drop-intel-macos-and-readme-scanning

fix: drop unreliable macOS Intel release target; refresh README scanning docs

Author: kexi

.github/workflows/release.yml

@@ -98,14 +98,16 @@ jobs:
             runner: ubuntu-latest
             os_name: Linux
             arch_name: aarch64
-          # macOS Intel: uname -s = Darwin, uname -m = x86_64. Native on macos-13.
-          - target: x86_64-apple-darwin
-            runner: macos-13
-            os_name: Darwin
-            arch_name: x86_64
           # Apple Silicon: uname -m = arm64 (NOT aarch64), even though the Rust
           # triple is aarch64-apple-darwin. The archive must be named `arm64` to
           # match what action.yml's `uname -m` produces on Apple Silicon runners.
+          #
+          # No macOS Intel (x86_64-apple-darwin) target: GitHub's macos-13 Intel
+          # runners are unreliably scheduled (queued indefinitely), which blocked
+          # the whole release. Intel Macs fall back to `cargo install` in the
+          # composite action instead. Re-add a `- target: x86_64-apple-darwin`
+          # entry (and the UNAME_PAIRS row in the contract test) if a dependable
+          # Intel runner returns.
           - target: aarch64-apple-darwin
             runner: macos-14
             os_name: Darwin
@@ -215,10 +217,7 @@ jobs:
             runner: ubuntu-latest
             os_name: Linux
             arch_name: aarch64
-          - target: x86_64-apple-darwin
-            runner: macos-13
-            os_name: Darwin
-            arch_name: x86_64
+          # No macOS Intel target — see the upload-assets matrix for why.
           - target: aarch64-apple-darwin
             runner: macos-14
             os_name: Darwin

README.md

@@ -42,6 +42,10 @@ nix develop
 cargo build --release
 ```
 
+The dev shell also provides a [`just`](https://github.com/casey/just) task
+runner — run `just` to list recipes (`just build`, `just test`, `just lint`,
+`just dogfood`, `just ci`, …).
+
 ## Quick start
 
 ```sh
@@ -546,7 +550,7 @@ the GitHub Release matching the runner's OS/arch (fast: a tarball download, no
 compilation), and falls back to `cargo install --git` from source when no
 prebuilt asset exists for that platform. The release automation
 ([`.github/workflows/release.yml`](.github/workflows/release.yml)) publishes
-prebuilt binaries for Linux (x86_64, aarch64) and macOS (x86_64, arm64) on every
+prebuilt binaries for Linux (x86_64, aarch64) and macOS (arm64) on every
 release and keeps `v1`-named assets in step with the floating `v1` tag, so `@v1`
 gets the fast path on those platforms. The step's exit code is the verdict, so a
 failing scenario fails the job.
@@ -639,21 +643,35 @@ nix develop --command "$PITTY_BIN" run e2e/scenarios/positive   # must exit 0
 nix develop --command "$PITTY_BIN" run e2e/scenarios/meta       # must exit 0
 ```
 
-CI runs these tiers plus the residual `#[ignore]` PTY tests on **both Linux and
-macOS as required gates** via `nix develop` — a macOS PTY regression blocks
-merges. The meta tier asserts inner exit via `expect_exit`'s deadline form so
-the macOS gate stays non-flaky despite slower PTY teardown. See
-[`.github/workflows/ci.yml`](.github/workflows/ci.yml).
-
-## Supply-chain scanning
-
-A separate [Socket](https://socket.dev) workflow
-([`.github/workflows/socket.yml`](.github/workflows/socket.yml)) scans the
-dependency manifests (`Cargo.toml` / `Cargo.lock`) for malicious or risky
-crates. It needs a `SOCKET_SECURITY_API_KEY` repository (or org) Actions secret;
-without it the scan step is skipped (so pull requests from forks, which cannot
-see the secret, do not fail). Its actions are pinned to commit SHAs because this
-is the one workflow where a secret is in scope.
+CI runs these tiers — plus a `samples/` tier exercising the `matrix` and `bench`
+subcommands, and the residual `#[ignore]` PTY tests — on **both Linux and macOS
+as required gates** via `nix develop`, so a macOS PTY regression blocks merges.
+The meta tier asserts inner exit via `expect_exit`'s deadline form so the macOS
+gate stays non-flaky despite slower PTY teardown. See
+[`.github/workflows/ci.yml`](.github/workflows/ci.yml). Locally, `just dogfood`
+runs all three tiers and `just ci` reproduces the full gate set.
+
+## Security scanning
+
+Two scanners guard the repository:
+
+- **Secret scanning (gitleaks).** A pre-commit hook (via
+  [lefthook](https://github.com/evilmartians/lefthook), installed automatically
+  by the nix dev shell) runs `gitleaks git --staged` on every commit, so a
+  secret is caught before it lands. The authoritative gate is the `gitleaks` job
+  in [`.github/workflows/ci.yml`](.github/workflows/ci.yml), which scans full
+  history on push (and the PR range on pull requests) — the hook is bypassable
+  with `git commit --no-verify`, so CI is the backstop. Both read the in-repo
+  [`.gitleaks.toml`](.gitleaks.toml), which extends gitleaks' default ruleset
+  and deliberately ships no broad allowlist.
+- **Supply-chain scanning (Socket).** A separate
+  [Socket](https://socket.dev) workflow
+  ([`.github/workflows/socket.yml`](.github/workflows/socket.yml)) scans the
+  dependency manifest (`Cargo.toml`) for malicious or risky crates. It needs a
+  `SOCKET_SECURITY_API_KEY` repository (or org) Actions secret; without it the
+  scan step is skipped (so pull requests from forks, which cannot see the
+  secret, do not fail). Its actions are pinned to commit SHAs because this is a
+  workflow where a secret is in scope.
 
 ## License
 

tests/release_asset_name_contract.rs

@@ -28,15 +28,19 @@ const ACTION_YML: &str = include_str!("../action.yml");
 /// The release workflow source, embedded so the test reads what ships.
 const RELEASE_YML: &str = include_str!("../.github/workflows/release.yml");
 
-/// The four `(uname -s, uname -m)` pairs pitty ships prebuilt binaries for.
+/// The `(uname -s, uname -m)` pairs pitty ships prebuilt binaries for.
 /// This is the single source of truth both sides are checked against.
 ///
 /// Apple Silicon is `arm64` here (its `uname -m`), deliberately distinct from
 /// the `aarch64` Rust triple, because the action keys on `uname` output.
+///
+/// No `("Darwin", "x86_64")`: GitHub's macos-13 Intel runners were unreliably
+/// scheduled and blocked releases, so Intel Macs fall back to `cargo install` in
+/// the composite action. Add the pair back here and in release.yml's matrix if a
+/// dependable Intel runner returns.
 const UNAME_PAIRS: &[(&str, &str)] = &[
     ("Linux", "x86_64"),
     ("Linux", "aarch64"),
-    ("Darwin", "x86_64"),
     ("Darwin", "arm64"),
 ];