fix(continuous-integration): stabilize main branch checks

What changed

This stabilizes the main branch checks that were still failing after the recent Windows response-file changes.

• Replaces the shellspec cache-hit timing assertion with a behavioral cache-hit assertion, so hosted macOS runner latency no longer fails an otherwise correct cache hit.
• Retries the source bootstrap Cargo build and applies Cargo network settings before the release vendoring step starts.
• Adds a Windows-shaped release test that verifies the once-core response file keeps direct crate dependencies and Cargo dependency-set crate arguments.
• Adds compact, generic response-file context to failed declared graph actions: response-file paths, formats, argument counts, first arguments, and last arguments.
• Keeps response-file metadata borrowed until failure formatting, so successful graph actions no longer clone it just to prepare an error path.
• Splits the release-shaped response-file test fixture out of the test body so the workspace lint stays within the line-count rule.

Why

The latest main branch GitHub Actions runs were failing in three places: the Windows release graph build, macOS shellspec, and one Linux release packaging job. The macOS and Linux failures were not product regressions, they were brittle automation behavior. The Windows failure still needs enough hosted-runner context to distinguish generated arguments from runner-specific execution behavior.

The first pull request run also exposed two follow-up issues in the new changes: the workspace lint rejected the large test body, and the review check flagged Rust-specific response-file formatting inside the generic action runner.

Root cause

The shellspec failure used an absolute 100 millisecond budget for a cached run. The hosted macOS runner returned the cached result but took longer than that fixed threshold.

The Linux release packaging failure happened during the source bootstrap build, before the existing retry-wrapped dependency vendoring step. A transient Cargo registry transport error therefore failed the job immediately.

The Windows release graph build reports missing crates while compiling once-core. Local coverage now confirms that the release-shaped prelude path emits the expected dependency arguments when the providers are present. The failure formatter now prints generic response-file shape on the next hosted failure, so the remaining Windows issue can be diagnosed from the job log without moving toolchain-specific behavior into the generic executor.

The lint failure came from adding that release-shaped coverage as one large test function. The review check came from the first diagnostic implementation filtering for Rust compiler argument prefixes in a generic action failure formatter and cloning response-file data before knowing whether the action failed.

Approach

The shellspec now checks that the second identical execution returns the cached output and reports a cache hit. This preserves the behavior contract without encoding hosted-runner timing assumptions.

The bootstrap script retries the source-built Once binary path and sets Cargo network retry defaults before that build starts. That brings the bootstrap phase closer to the already-hardened vendoring phase.

For Windows, the test covers the exact release shape that matters for once-core: a direct once_cas dependency plus workspace dependencies selected through cargo_dependencies. The test fixture now lives outside the test function, which keeps the behavior coverage while satisfying the lint.

The declared-action diagnostic stays toolchain-agnostic by showing only generic response-file metadata and bounded first and last argument slices. The action runner now borrows that metadata and uses it only when building a failure message.

Impact

The user-facing command behavior is unchanged. The release and shellspec automation should be less sensitive to hosted-runner latency and registry transport issues. Failed graph actions now include more actionable response-file context without adding toolchain-specific behavior to the generic executor.

Validation

• mise exec -- cargo test -p once-frontend prelude_rust_windows_response_file_keeps_release_dependency_args
• mise exec -- cargo test -p once-cli declared_action_failure_message
• mise exec -- cargo fmt --all -- --check
• mise exec -- cargo clippy --workspace --all-targets -- -D warnings
• Direct once exec cache-hit verification with target/debug/once

I did not run the full shellspec suite locally because this worktree does not have target/release/once.

No GitHub comments yet.