ci: feed ci-surfaces NUL-delimited paths and pin its mapping in a test

The mapper read newline-delimited `git diff --name-only` output. In that
mode git C-quotes any path with non-ASCII, tab, double-quote or newline
characters, so crates/gl/src/é.rs arrived as "crates/gl/src/\303\251.rs",
matched no surface, and a PR whose only Rust change was such a file ran no
Rust job (Café.swift likewise skipped Swift CodeQL). Newline-delimited
input also cannot carry a path that contains a newline.

Both workflows now pass `git diff -z` output and the mapper reads it with
`read -r -d ''`; input that is not NUL-terminated is rejected (exit 2)
instead of being misread. Mapping output for every ASCII path is
unchanged (checked against the last 43 commit ranges).

scripts/test-ci-surfaces.sh pins one must-not-skip case per surface row,
the crate fan-out and widening rules, --all, the wiring rows, quoted
names, and rejection of newline-delimited input. PR Checks runs it in the
`changed surfaces` job before mapping, on every event, so a broken mapper
turns the run red rather than silently narrowing it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

.github/workflows/codeql.yml

@@ -0,0 +1,100 @@
+name: CodeQL
+
+# Advanced-setup replacement for CodeQL default setup. Default setup analyzes
+# every detected language on every PR, including Swift (macos-app/), which
+# autobuilds on a macOS runner for ~13 minutes per PR and has hung for 55 on
+# main; that single job was the longest check on most PRs. Here a PR analyzes
+# only the languages it touches (scripts/ci-surfaces.sh), while push to main
+# and the weekly schedule analyze every language, so main's code-scanning
+# baseline stays complete.
+#
+# Requires CodeQL default setup to be DISABLED (Settings -> Code security ->
+# Code scanning): GitHub rejects advanced-setup uploads while it is enabled.
+#
+# A PR that skips a language may show "configuration not found" on the CodeQL
+# check for that language; that is informational and expected.
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+  schedule:
+    - cron: "17 4 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  changes:
+    name: changed languages
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      codeql: ${{ steps.surfaces.outputs.codeql }}
+      matrix: ${{ steps.surfaces.outputs.codeql_matrix }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+          fetch-depth: 2
+
+      - name: Map changed paths to languages
+        id: surfaces
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+        run: |
+          set -euo pipefail
+          if [ "$EVENT_NAME" = "pull_request" ]; then
+            # -z: literal paths; plain --name-only C-quotes unusual names.
+            git diff -z --name-only --no-renames HEAD^1 HEAD > changed-paths
+            tr '\0' '\n' < changed-paths >&2
+            scripts/ci-surfaces.sh < changed-paths > surfaces.out
+          else
+            scripts/ci-surfaces.sh --all > surfaces.out
+          fi
+          cat surfaces.out
+          grep -E '^(codeql|codeql_matrix)=' surfaces.out >> "$GITHUB_OUTPUT"
+
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    needs: changes
+    if: needs.changes.outputs.codeql == 'true'
+    runs-on: ${{ matrix.runner }}
+    # Normal runs take <=14 min (Swift autobuild is the longest); cap a hung
+    # autobuild instead of letting it hold a runner for an hour.
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      security-events: write
+      actions: read
+      packages: read
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.changes.outputs.matrix) }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+
+      - name: Autobuild
+        if: matrix.build-mode == 'autobuild'
+        uses: github/codeql-action/autobuild@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/pr-checks.yml

@@ -30,8 +30,62 @@ env:
   RUST_BACKTRACE: 1
 
 jobs:
+  # Decide which checks this event needs. On pull_request, each job below runs
+  # only when the PR touches the surface it validates, and the cargo test /
+  # release-build jobs are scoped to the touched crates plus their reverse
+  # dependencies (scripts/ci-surfaces.sh). Every other event (push to main,
+  # merge_group, the release flow's workflow_dispatch) runs the full suite, so
+  # main and the merge queue keep whole-workspace coverage and main-red-alert
+  # still sees a complete run. A skipped job reports as "skipped", not green.
+  changes:
+    name: changed surfaces
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      rust: ${{ steps.surfaces.outputs.rust }}
+      rust_packages: ${{ steps.surfaces.outputs.rust_packages }}
+      windows: ${{ steps.surfaces.outputs.windows }}
+      windows_packages: ${{ steps.surfaces.outputs.windows_packages }}
+      docker: ${{ steps.surfaces.outputs.docker }}
+      audit: ${{ steps.surfaces.outputs.audit }}
+      core_deps: ${{ steps.surfaces.outputs.core_deps }}
+      release_versioning: ${{ steps.surfaces.outputs.release_versioning }}
+      release_tag: ${{ steps.surfaces.outputs.release_tag }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+          # The pull_request checkout is the test-merge commit; depth 2 brings
+          # its first parent (the base tip) so the diff is exactly this PR.
+          fetch-depth: 2
+
+      # Every job's gate comes from the mapper, so pin its mapping first; a
+      # failure here fails this job and the run is red, not silently narrowed.
+      - name: Test the surface mapper
+        run: scripts/test-ci-surfaces.sh
+
+      - name: Map changed paths to surfaces
+        id: surfaces
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+        run: |
+          set -euo pipefail
+          if [ "$EVENT_NAME" = "pull_request" ]; then
+            # -z: literal paths; plain --name-only C-quotes unusual names.
+            git diff -z --name-only --no-renames HEAD^1 HEAD > changed-paths
+            tr '\0' '\n' < changed-paths >&2
+            scripts/ci-surfaces.sh < changed-paths > surfaces.out
+          else
+            scripts/ci-surfaces.sh --all > surfaces.out
+          fi
+          cat surfaces.out
+          cat surfaces.out >> "$GITHUB_OUTPUT"
+
   fmt-clippy:
     name: fmt + clippy
+    needs: changes
+    if: needs.changes.outputs.rust == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
@@ -57,6 +111,8 @@ jobs:
 
   release-tag-validation:
     name: release tag validation
+    needs: changes
+    if: needs.changes.outputs.release_tag == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
@@ -70,6 +126,8 @@ jobs:
 
   test:
     name: test (${{ matrix.toolchain }})
+    needs: changes
+    if: needs.changes.outputs.rust == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 45
     strategy:
@@ -114,10 +172,17 @@ jobs:
       - name: cargo test
         env:
           DATABASE_URL: postgres://postgres:postgres@localhost:5432/gitlawb_test
-        run: cargo test --locked --workspace
+          # `--workspace`, or `-p <crate>...` for the crates a PR touches plus
+          # every crate that depends on them.
+          PACKAGES: ${{ needs.changes.outputs.rust_packages }}
+        run: |
+          # shellcheck disable=SC2086 # PACKAGES is a word list by design
+          cargo test --locked $PACKAGES
 
   build-release:
     name: build --release
+    needs: changes
+    if: needs.changes.outputs.rust == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
@@ -137,10 +202,20 @@ jobs:
           key: release
 
       - name: cargo build --release
-        run: cargo build --locked --release --workspace
+        env:
+          PACKAGES: ${{ needs.changes.outputs.rust_packages }}
+        run: |
+          # shellcheck disable=SC2086 # PACKAGES is a word list by design
+          cargo build --locked --release $PACKAGES
 
   audit:
     name: cargo audit
+    # cargo audit reads only Cargo.lock (+ .cargo/audit.toml), so a PR that
+    # leaves both unchanged cannot change its verdict; a newly published
+    # advisory against main is caught by the push-to-main run and the weekly
+    # Scheduled Audit instead of turning every unrelated PR red.
+    needs: changes
+    if: needs.changes.outputs.audit == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
@@ -200,6 +275,8 @@ jobs:
 
   msrv:
     name: MSRV (Rust 1.91)
+    needs: changes
+    if: needs.changes.outputs.rust == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
@@ -223,6 +300,12 @@ jobs:
 
   docker-build:
     name: Docker build smoke test
+    # Runs when the image's own inputs change: the Dockerfile, the manifests
+    # its dependency layer copies, the lockfile, bootstrap-peers.json. A
+    # source-only Rust change is already compiled by `build --release` (stable)
+    # and `MSRV` (1.91, the image's toolchain); push to main still runs this.
+    needs: changes
+    if: needs.changes.outputs.docker == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
@@ -239,6 +322,8 @@ jobs:
 
   test-windows:
     name: test (windows, non-blocking)
+    needs: changes
+    if: needs.changes.outputs.windows == 'true'
     runs-on: windows-latest
     timeout-minutes: 45
     # Non-blocking, mirroring the informational `beta` lane above. We ship `gl`
@@ -266,7 +351,13 @@ jobs:
           key: windows
 
       - name: cargo test (shipped Windows crates)
-        run: cargo test --locked -p gl -p git-remote-gitlawb
+        shell: bash
+        env:
+          # `-p gl -p git-remote-gitlawb`, or whichever of the two a PR affects.
+          PACKAGES: ${{ needs.changes.outputs.windows_packages }}
+        run: |
+          # shellcheck disable=SC2086 # PACKAGES is a word list by design
+          cargo test --locked $PACKAGES
 
   # gitlawb-core is embedded by every consumer (gl, git-remote-gitlawb, the node
   # daemon), so it must stay lean. This gate fails if gitlawb-core's normal
@@ -276,6 +367,8 @@ jobs:
   # cannot do. Regen instructions live in the allowlist header.
   core-deps-purity:
     name: gitlawb-core dependency purity
+    needs: changes
+    if: needs.changes.outputs.core_deps == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
@@ -308,6 +401,8 @@ jobs:
   # not its author knew this gate existed.
   release-versioning:
     name: release versioning coverage
+    needs: changes
+    if: needs.changes.outputs.release_versioning == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:

AGENTS.md

@@ -40,5 +40,5 @@ When a node denies a request, surface the denial to the user. Never render a den
 ## Toolchain and CI reality
 
 - MSRV is Rust 1.91 (`rust-version` in the workspace `Cargo.toml`). The MSRV CI job runs `cargo check --workspace --all-targets` on exactly 1.91, so check that an API you rely on is stable there; the full test suite runs on stable.
-- The PR workflow runs these jobs on every PR: `cargo fmt --check`, `cargo clippy --workspace --all-targets -- -D warnings`, `cargo test --workspace` (against Postgres), a release build, `cargo audit`, the MSRV check, and a Docker build. The `main` branch ruleset currently requires one approving review but does not require these checks to pass before merge; a failing job should block review approval in practice, but nothing enforces that mechanically today.
+- The PR workflow's jobs are `cargo fmt --check`, `cargo clippy --workspace --all-targets -- -D warnings`, `cargo test` (against Postgres), a release build, `cargo audit`, the MSRV check, and a Docker build. On a PR, `scripts/ci-surfaces.sh` runs each job only when the PR touches its inputs, and scopes `cargo test` and the release build to the touched crates plus every crate that depends on them. Root `Cargo.toml`/`Cargo.lock`/`.cargo/` changes run the Rust jobs (fmt, clippy, tests, release build, MSRV) on the whole workspace; every other job still runs only when its own inputs change. Edits to the CI wiring itself (`pr-checks.yml`, `codeql.yml`, `scripts/ci-surfaces.sh`), push to `main`, and the merge queue run every job on the whole workspace. Edits to any other workflow run none of these jobs on a PR; CodeQL only analyzes them as Actions code. Run `cargo test --workspace` locally regardless. The same script limits CodeQL (`codeql.yml`) to the languages a PR touches. The `main` branch ruleset currently requires one approving review but does not require these checks to pass before merge; a failing job should block review approval in practice, but nothing enforces that mechanically today.
 - Conventional commit titles (`feat:`, `fix:`, `docs:`, ...) are required by convention and drive releases, but no CI job checks them; a bad title fails review, not the pipeline.

scripts/ci-surfaces.sh

@@ -0,0 +1,221 @@
+#!/usr/bin/env bash
+#
+# Map a pull request's changed paths to the CI surfaces they touch, so each
+# check in pr-checks.yml and codeql.yml runs only when its inputs changed and
+# Rust jobs test only the affected crates.
+#
+# Usage:
+#   git diff -z --name-only --no-renames BASE HEAD | scripts/ci-surfaces.sh
+#   scripts/ci-surfaces.sh --all      # every surface, whole workspace
+#
+# Input is NUL-terminated paths (`git diff -z`). Without -z, git C-quotes any
+# path with non-ASCII, tab, quote or newline characters ("crates/gl/\303\251.rs"),
+# which would match no surface and skip every job; newline-delimited input
+# also cannot carry a path that contains a newline. Input that does not end in
+# NUL (e.g. a plain `git diff --name-only`) is rejected rather than misread.
+# scripts/test-ci-surfaces.sh pins the mapping.
+#
+# Prints GITHUB_OUTPUT lines (key=value). Each surface runs only for the paths
+# listed for it below, so a path no surface lists (docs, README, infra/, any
+# other workflow) runs no PR Checks job. Within the Rust surface, a change this
+# script cannot attribute to specific crates widens rather than narrows: a
+# global Rust input or an unknown crate directory runs the Rust jobs on the
+# whole workspace. The CI wiring itself (pr-checks.yml, codeql.yml, this
+# script) runs every surface.
+# Non-PR events (push to main, merge_group, workflow_dispatch, schedule) are
+# expected to pass --all, so main and the merge queue keep full coverage.
+#
+# Runnable from anywhere in the repo.
+set -euo pipefail
+
+ROOT="$(git rev-parse --show-toplevel)"
+
+all=false
+if [ "${1:-}" = "--all" ]; then
+  all=true
+elif [ "$#" -ne 0 ]; then
+  echo "usage: $0 [--all] < NUL-terminated-changed-paths" >&2
+  exit 2
+fi
+
+changed=()
+if [ "$all" = false ]; then
+  path=""
+  while IFS= read -r -d '' path; do
+    [ -n "$path" ] && changed+=("$path")
+  done
+  # read leaves any unterminated tail in $path.
+  if [ -n "$path" ]; then
+    echo "ci-surfaces.sh: input is not NUL-terminated; pipe \`git diff -z --name-only\`" >&2
+    exit 2
+  fi
+fi
+
+# Workspace crates, derived from crates/*/Cargo.toml so a new crate is picked
+# up without editing this script. dir -> package name, and dir -> the crate
+# dirs it depends on through `path = "../<dir>"` (normal, dev, or build deps).
+declare -A pkg_of=() deps_of=()
+for manifest in "$ROOT"/crates/*/Cargo.toml; do
+  dir="$(basename "$(dirname "$manifest")")"
+  pkg_of[$dir]="$(sed -n 's/^name *= *"\([^"]*\)".*/\1/p' "$manifest" | head -n1)"
+  deps_of[$dir]="$(sed -n 's#.*path *= *"\.\./\([^"/]*\)".*#\1#p' "$manifest" | tr '\n' ' ')"
+done
+
+# Files outside crates/ that a crate compiles in (include_str!/include_bytes!),
+# path -> crate dir. A change to one is a change to that crate, so its tests
+# run. Candidates (keep those that resolve outside crates/<dir>/):
+#   git grep -nE 'include_(str|bytes)!\("(\.\./){2,}' crates
+declare -A embedded_in=(
+  [bootstrap-peers.json]=gitlawb-node
+)
+
+# Mark a crate dir as touched; a dir this checkout does not know (removed or
+# renamed crate) widens the Rust jobs to the whole workspace.
+touch_crate() {
+  if [ -n "${pkg_of[$1]:-}" ]; then
+    touched[$1]=1
+  else
+    full_rust=true
+  fi
+}
+
+full_rust=false
+rust=false
+docker=false
+audit=false
+core_deps=false
+release_versioning=false
+release_tag=false
+cq_actions=false
+cq_js=false
+cq_rust=false
+cq_swift=false
+declare -A touched=()
+
+for path in "${changed[@]}"; do
+  case "$path" in
+    # The CI wiring itself: validate everything it gates.
+    .github/workflows/pr-checks.yml | .github/workflows/codeql.yml | scripts/ci-surfaces.sh)
+      all=true ;;
+    # Workspace-wide Rust inputs.
+    Cargo.toml | Cargo.lock | .cargo/* | rust-toolchain | rust-toolchain.toml \
+      | rustfmt.toml | .rustfmt.toml | clippy.toml | .clippy.toml)
+      full_rust=true ;;
+    crates/*/*)
+      dir="${path#crates/}"
+      touch_crate "${dir%%/*}" ;;
+    *)
+      if [ -n "${embedded_in[$path]:-}" ]; then
+        touch_crate "${embedded_in[$path]}"
+      fi ;;
+  esac
+
+  case "$path" in
+    Dockerfile | .dockerignore | bootstrap-peers.json | Cargo.toml | Cargo.lock \
+      | .cargo/* | rust-toolchain | rust-toolchain.toml | crates/*/Cargo.toml)
+      docker=true ;;
+  esac
+  case "$path" in
+    Cargo.lock | .cargo/audit.toml) audit=true ;;
+  esac
+  case "$path" in
+    Cargo.toml | Cargo.lock | crates/gitlawb-core/Cargo.toml \
+      | ci/gitlawb-core-allowed-deps.txt | scripts/check-gitlawb-core-deps.sh)
+      core_deps=true ;;
+  esac
+  case "$path" in
+    Cargo.toml | crates/*/Cargo.toml | release-please-config.json \
+      | .release-please-manifest.json | scripts/check-release-versioning.sh)
+      release_versioning=true ;;
+  esac
+  case "$path" in
+    scripts/resolve-release-tag.sh | scripts/test-resolve-release-tag.sh)
+      release_tag=true ;;
+  esac
+
+  case "$path" in
+    .github/workflows/* | .github/actions/*) cq_actions=true ;;
+  esac
+  case "$path" in
+    npm/* | *.js | *.mjs | *.cjs | *.jsx | *.ts | *.mts | *.cts | *.tsx) cq_js=true ;;
+  esac
+  case "$path" in
+    macos-app/* | *.swift) cq_swift=true ;;
+  esac
+done
+
+if [ "$all" = true ]; then
+  full_rust=true
+  docker=true
+  audit=true
+  core_deps=true
+  release_versioning=true
+  release_tag=true
+  cq_actions=true
+  cq_js=true
+  cq_swift=true
+fi
+
+# Affected crates: the touched ones plus everything that depends on them,
+# transitively, so a gitlawb-core change still tests every consumer.
+declare -A affected=()
+for dir in "${!touched[@]}"; do affected[$dir]=1; done
+grew=true
+while [ "$grew" = true ]; do
+  grew=false
+  for dir in "${!deps_of[@]}"; do
+    [ -n "${affected[$dir]:-}" ] && continue
+    for dep in ${deps_of[$dir]}; do
+      if [ -n "${affected[$dep]:-}" ]; then
+        affected[$dir]=1
+        grew=true
+        break
+      fi
+    done
+  done
+done
+
+if [ "$full_rust" = true ] || [ "${#affected[@]}" -gt 0 ]; then
+  rust=true
+  cq_rust=true
+fi
+
+rust_packages=""
+windows_packages=""
+if [ "$full_rust" = true ]; then
+  rust_packages="--workspace"
+  windows_packages="-p gl -p git-remote-gitlawb"
+elif [ "$rust" = true ]; then
+  for dir in $(printf '%s\n' "${!affected[@]}" | sort); do
+    rust_packages+="${rust_packages:+ }-p ${pkg_of[$dir]}"
+    case "${pkg_of[$dir]}" in
+      gl | git-remote-gitlawb) windows_packages+="${windows_packages:+ }-p ${pkg_of[$dir]}" ;;
+    esac
+  done
+fi
+
+windows=false
+[ -n "$windows_packages" ] && windows=true
+
+languages=()
+[ "$cq_actions" = true ] && languages+=('{"language":"actions","build-mode":"none","runner":"ubuntu-latest"}')
+[ "$cq_js" = true ] && languages+=('{"language":"javascript-typescript","build-mode":"none","runner":"ubuntu-latest"}')
+[ "$cq_rust" = true ] && languages+=('{"language":"rust","build-mode":"none","runner":"ubuntu-latest"}')
+[ "$cq_swift" = true ] && languages+=('{"language":"swift","build-mode":"autobuild","runner":"macos-latest"}')
+codeql_matrix="{\"include\":[$(IFS=,; echo "${languages[*]}")]}"
+codeql=false
+[ "${#languages[@]}" -gt 0 ] && codeql=true
+
+cat <<EOF
+rust=$rust
+rust_packages=$rust_packages
+windows=$windows
+windows_packages=$windows_packages
+docker=$docker
+audit=$audit
+core_deps=$core_deps
+release_versioning=$release_versioning
+release_tag=$release_tag
+codeql=$codeql
+codeql_matrix=$codeql_matrix
+EOF

scripts/test-ci-surfaces.sh

@@ -0,0 +1,121 @@
+#!/usr/bin/env bash
+# Fixture test for scripts/ci-surfaces.sh, which alone decides which PR Checks
+# jobs and CodeQL languages run. Pins at least one must-not-skip case per
+# surface row, the crate fan-out and widening rules, and paths that git would
+# C-quote without -z. Run from pr-checks.yml before the mapper is used.
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+mapper="$repo_root/scripts/ci-surfaces.sh"
+failures=0
+
+# map PATH... : run the mapper on the paths as `git diff -z` would emit them.
+map() {
+  if [ "$#" -gt 0 ]; then printf '%s\0' "$@"; fi | "$mapper"
+}
+
+# check CASE OUTPUT KEY=VALUE... : each KEY must have exactly VALUE.
+check() {
+  local name="$1" out="$2" want key
+  shift 2
+  for want in "$@"; do
+    key="${want%%=*}"
+    if ! grep -qxF -- "$want" <<<"$out"; then
+      printf 'FAIL %s: want %s, got %s\n' "$name" "$want" \
+        "$(grep -E "^${key}=" <<<"$out" || echo '<missing>')" >&2
+      failures=$((failures + 1))
+    fi
+  done
+}
+
+# has_packages CASE OUTPUT PKG... : rust_packages must include each -p PKG.
+has_packages() {
+  local name="$1" out="$2" pkgs pkg
+  shift 2
+  pkgs=" $(sed -n 's/^rust_packages=//p' <<<"$out") "
+  for pkg in "$@"; do
+    if [[ "$pkgs" != *" -p $pkg "* ]]; then
+      printf 'FAIL %s: rust_packages lacks -p %s (got%s)\n' "$name" "$pkg" "$pkgs" >&2
+      failures=$((failures + 1))
+    fi
+  done
+}
+
+nothing=(rust=false rust_packages= windows=false windows_packages= docker=false
+  audit=false core_deps=false release_versioning=false release_tag=false
+  codeql=false 'codeql_matrix={"include":[]}')
+everything=(rust=true rust_packages=--workspace windows=true
+  'windows_packages=-p gl -p git-remote-gitlawb' docker=true audit=true
+  core_deps=true release_versioning=true release_tag=true codeql=true)
+all_languages='codeql_matrix={"include":[{"language":"actions","build-mode":"none","runner":"ubuntu-latest"},{"language":"javascript-typescript","build-mode":"none","runner":"ubuntu-latest"},{"language":"rust","build-mode":"none","runner":"ubuntu-latest"},{"language":"swift","build-mode":"autobuild","runner":"macos-latest"}]}'
+rust_only='codeql_matrix={"include":[{"language":"rust","build-mode":"none","runner":"ubuntu-latest"}]}'
+
+# Docs-only and empty input run nothing.
+check "docs only" "$(map README.md docs/x.md infra/x.tf)" "${nothing[@]}"
+check "empty input" "$(map)" "${nothing[@]}"
+
+# A crate change tests that crate and its reverse deps, nothing else.
+check "gl source" "$(map crates/gl/src/main.rs)" \
+  rust=true 'rust_packages=-p gl' windows=true 'windows_packages=-p gl' \
+  docker=false audit=false "$rust_only"
+out="$(map crates/gitlawb-core/src/lib.rs)"
+check "gitlawb-core source" "$out" rust=true windows=true \
+  'windows_packages=-p git-remote-gitlawb -p gl' "$rust_only"
+has_packages "gitlawb-core fan-out" "$out" gitlawb-core icaptcha-client \
+  gitlawb-attest git-remote-gitlawb gl gitlawb-node
+check "icaptcha-client source" "$(map crates/icaptcha-client/src/lib.rs)" \
+  'rust_packages=-p gl -p icaptcha-client' 'windows_packages=-p gl'
+
+# Anything the Rust surface cannot attribute to known crates widens.
+check "unknown crate dir" "$(map crates/no-such-crate/src/lib.rs)" \
+  rust=true rust_packages=--workspace docker=false
+check "root Cargo.lock" "$(map Cargo.lock)" \
+  rust=true rust_packages=--workspace docker=true audit=true core_deps=true \
+  release_versioning=false
+check "toolchain file" "$(map rust-toolchain.toml)" rust=true rust_packages=--workspace
+
+# Files compiled into a crate from outside crates/.
+check "bootstrap-peers.json" "$(map bootstrap-peers.json)" \
+  rust=true 'rust_packages=-p gitlawb-node' windows=false docker=true
+
+# One must-not-skip trigger per non-Rust row.
+check "Dockerfile" "$(map Dockerfile)" docker=true rust=false
+check "crate manifest" "$(map crates/gl/Cargo.toml)" \
+  docker=true release_versioning=true 'rust_packages=-p gl'
+check "audit config" "$(map .cargo/audit.toml)" audit=true rust_packages=--workspace
+check "core allowlist" "$(map ci/gitlawb-core-allowed-deps.txt)" core_deps=true rust=false
+check "release-please config" "$(map release-please-config.json)" \
+  release_versioning=true rust=false
+check "release tag resolver" "$(map scripts/resolve-release-tag.sh)" release_tag=true rust=false
+check "other workflow" "$(map .github/workflows/release.yml)" "${nothing[@]:0:9}" \
+  codeql=true 'codeql_matrix={"include":[{"language":"actions","build-mode":"none","runner":"ubuntu-latest"}]}'
+check "npm" "$(map npm/package.json)" codeql=true \
+  'codeql_matrix={"include":[{"language":"javascript-typescript","build-mode":"none","runner":"ubuntu-latest"}]}'
+check "swift" "$(map macos-app/Sources/App.swift)" rust=false codeql=true \
+  'codeql_matrix={"include":[{"language":"swift","build-mode":"autobuild","runner":"macos-latest"}]}'
+
+# Editing the CI wiring runs every surface, exactly like --all.
+for wiring in .github/workflows/pr-checks.yml .github/workflows/codeql.yml scripts/ci-surfaces.sh; do
+  check "wiring $wiring" "$(map "$wiring")" "${everything[@]}" "$all_languages"
+done
+check "--all" "$("$mapper" --all </dev/null)" "${everything[@]}" "$all_languages"
+
+# Names git C-quotes without -z (non-ASCII, tab, quote, newline) still map.
+for name in $'\xc3\xa9.rs' $'a\tb.rs' 'a"b.rs' $'a\nb.rs'; do
+  check "quoted name $(printf %q "$name")" "$(map "crates/gl/src/$name")" \
+    rust=true 'rust_packages=-p gl'
+done
+check "non-ASCII swift" "$(map $'macos-app/Sources/Caf\xc3\xa9.swift')" codeql=true \
+  'codeql_matrix={"include":[{"language":"swift","build-mode":"autobuild","runner":"macos-latest"}]}'
+
+# Newline-delimited input (git diff without -z) is rejected, not misread.
+if printf 'crates/gl/src/main.rs\n' | "$mapper" >/dev/null 2>&1; then
+  echo "FAIL newline-delimited input: mapper accepted it" >&2
+  failures=$((failures + 1))
+fi
+
+if [ "$failures" -ne 0 ]; then
+  echo "$failures ci-surfaces mapping check(s) failed" >&2
+  exit 1
+fi
+echo "ci-surfaces mapping: all checks passed"