From 154bed782388b0ab8597da7d6fb1a9ed0a91d052 Mon Sep 17 00:00:00 2001
From: Sirius DevOps <lance@siriusdevops.com>
Date: Thu, 10 Sep 2026 13:50:57 -0400
Subject: [PATCH] fix(ci): clippy clean on tests/hs.rs + pin step cwd to
 GITHUB_WORKSPACE

Two separate breakages from the first green-ish CI run:

1. tests/hs.rs asserted on a constant, which clippy rejects under
   -D warnings (clippy::assertions_on_constants) because the compiler
   folds the assert away. Compare through a runtime binding instead.

2. The release workflow built the aarch64 binary fine (13m02s, verified
   ARM ELF) but the publish step died with:
       /var/run/act/workflow/3: line 6: scripts/publish-release.sh: No such file or directory
   run: steps execute with act's cwd, not the repo root, so relative
   paths miss. Pin every run step with cd "${GITHUB_WORKSPACE}" (the
   pattern the osint-dashboard workflow already relies on).

Verified locally before pushing: cargo test 41 passed, cargo clippy
--all-targets -- -D warnings clean.
---
 .forgejo/workflows/ci.yml      | 2 ++
 .forgejo/workflows/release.yml | 5 ++++-
 tests/hs.rs                    | 9 +++++----
 3 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index ca59df8..0eff673 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -26,6 +26,8 @@ jobs:
       - name: cargo test + clippy on aarch64
         run: |
           set -euo pipefail
+          cd "${GITHUB_WORKSPACE}"
+          echo "workspace: $GITHUB_WORKSPACE"
           docker volume create "$CARGO_REGISTRY_VOLUME" > /dev/null
           docker volume create "$CARGO_TARGET_VOLUME" > /dev/null
           docker rm -f "$BUILD_CONTAINER" > /dev/null 2>&1 || true
diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
index ce85219..a27acea 100644
--- a/.forgejo/workflows/release.yml
+++ b/.forgejo/workflows/release.yml
@@ -40,6 +40,8 @@ jobs:
       - name: Build ${{ env.TARGET }} in a rust container
         run: |
           set -euo pipefail
+          cd "${GITHUB_WORKSPACE}"
+          echo "workspace: $GITHUB_WORKSPACE"
           docker volume create "$CARGO_REGISTRY_VOLUME" > /dev/null
           docker volume create "$CARGO_TARGET_VOLUME" > /dev/null
           docker rm -f "$BUILD_CONTAINER" > /dev/null 2>&1 || true
@@ -69,7 +71,7 @@ jobs:
       - name: Pack and checksum
         run: |
           set -euo pipefail
-          cd dist
+          cd "${GITHUB_WORKSPACE}/dist"
           file "onionwire-$TARGET"
           sha256sum "onionwire-$TARGET" > "onionwire-$TARGET.sha256"
           sha256sum -c "onionwire-$TARGET.sha256"
@@ -84,6 +86,7 @@ jobs:
           INPUT_TAG: ${{ github.event.inputs.tag }}
         run: |
           set -euo pipefail
+          cd "${GITHUB_WORKSPACE}"
           tag="${INPUT_TAG:-$REF}"
           echo "publishing $tag from $REPO_API"
           scripts/publish-release.sh \
diff --git a/tests/hs.rs b/tests/hs.rs
index cff7530..f1d9ef4 100644
--- a/tests/hs.rs
+++ b/tests/hs.rs
@@ -14,8 +14,9 @@ fn publish_wait_covers_hsdir_retries() {
 
 #[test]
 fn cbt_min_timeout_floor_is_at_least_10s() {
-    assert!(
-        hs::CBT_MIN_TIMEOUT_MS >= 10_000,
-        "learned CBT ~1s kills HsDir circuits"
-    );
+    // Drive the comparison through a runtime value: asserting on the constant
+    // directly is folded away by the compiler and clippy rejects it under
+    // -D warnings (clippy::assertions_on_constants).
+    let floor_ms = hs::CBT_MIN_TIMEOUT_MS;
+    assert!(floor_ms >= 10_000, "learned CBT ~1s kills HsDir circuits");
 }