quest(tooling): Tooling: thin justfiles and CI that calls them

.github/actions/just/action.yml

@@ -0,0 +1,11 @@
+name: Install just
+description: Install the pinned just for jobs outside the nix dev shell, which already provides it.
+
+runs:
+  using: composite
+  steps:
+    # A checksum-verified prebuilt, so it costs seconds rather than a
+    # `cargo install`. Keep the version in step with nixpkgs' just in flake.lock.
+    - uses: taiki-e/install-action@9983c65e42da123ff25d1f78505eb6de315aa172 # v2.87.20
+      with:
+        tool: just@1.58.0

.github/justfile

@@ -1,13 +1,40 @@
-set fallback
+set working-directory := '..'
 
-# actionlint is skipped when absent locally; the root `_tools` preflight makes
-# it a hard requirement under MOQ_STRICT, so CI can't skip it.
-
-# Lint GitHub Actions workflows.
+# Lint GitHub Actions workflows, their alert coverage, and that every step runs a recipe.
 check:
-    python3 {{ source_directory() }}/scripts/install-formula.test.py
-    {{ source_directory() }}/scripts/release.test.sh
-    @if command -v nfpm >/dev/null 2>&1 && command -v envsubst >/dev/null 2>&1 && command -v dpkg-deb >/dev/null 2>&1 && command -v rpm >/dev/null 2>&1; then python3 {{ source_directory() }}/../rs/scripts/package-rename.test.py; fi
-    @if command -v actionlint >/dev/null 2>&1; then actionlint; fi
-    {{ source_directory() }}/scripts/alert.sh check-coverage
-    @if command -v rustc >/dev/null 2>&1; then {{ source_directory() }}/scripts/package-binary.test.sh; fi
+    actionlint
+    sh/gh/alert.sh check-coverage
+    bun sh/gh/check-runs.ts
+
+# Tests of the release tooling itself; nightly, not on every pull request.
+test:
+    python3 sh/gh/install-formula.test.py
+    sh/gh/release.test.sh
+    python3 sh/rs/package-rename.test.py
+    sh/go/publish-wrapper.test.sh
+    bash .claude/hooks/direnv.test.sh
+
+# Release workflow helpers, e.g. `just gh release parse-version moq-cli`.
+[positional-arguments]
+release *args:
+    sh/gh/release.sh "$@"
+
+# Post a failed run to Discord, or check that alert.yml covers every workflow.
+[positional-arguments]
+alert *args:
+    sh/gh/alert.sh "$@"
+
+# Render a Homebrew formula template for a release.
+[positional-arguments]
+formula *args:
+    sh/gh/render-formula.sh "$@"
+
+# Copy a rendered formula into a Homebrew tap checkout, migrating renamed formulae.
+[positional-arguments]
+install-formula *args:
+    python3 sh/gh/install-formula.py "$@"
+
+# Trigger the apt-repo and rpm-repo workflows for a release tag.
+[positional-arguments]
+trigger-repo-publish *args:
+    sh/gh/trigger-repo-publish.sh "$@"

.github/workflows/alert.yml

@@ -78,6 +78,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Post to Discord
         env:
           DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
@@ -88,4 +90,4 @@ jobs:
           RUN_REF: ${{ github.event.workflow_run.head_branch }}
           RUN_TITLE: ${{ github.event.workflow_run.display_title }}
           RUN_ACTOR: ${{ github.event.workflow_run.triggering_actor.login }}
-        run: .github/scripts/alert.sh discord
+        run: just gh alert discord

.github/workflows/android.yml

@@ -50,7 +50,6 @@ concurrency:
 
 env:
   CARGO_NDK_VERSION: 4.1.2
-  JUST_VERSION: 1.52.0
 
 jobs:
   android:
@@ -74,8 +73,10 @@ jobs:
 
       # No Rust cache: this workflow only runs on pull requests, which may not
       # save one, so it would have nothing to restore.
-      - name: Install just and cargo-ndk
-        run: cargo install --locked "just@$JUST_VERSION" "cargo-ndk@$CARGO_NDK_VERSION"
+      - uses: ./.github/actions/just
+
+      - name: Install cargo-ndk
+        run: cargo install --locked "cargo-ndk@$CARGO_NDK_VERSION"
 
       - name: Check
         run: just rs android

.github/workflows/apt-repo.yml

@@ -34,6 +34,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Set up packaging tools
         uses: ./.github/actions/setup-packaging
 
@@ -53,10 +55,9 @@ jobs:
       - name: Publish to R2
         shell: bash
         env:
-          ARTIFACTS_DIR: artifacts
           R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
           R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
           R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
           SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
           SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
-        run: ./infra/apt/publish.sh
+        run: just infra apt publish "$GITHUB_WORKSPACE/artifacts"

.github/workflows/check.yml

@@ -73,9 +73,6 @@ jobs:
       # Locally an absent formatter means less gets checked; here it would mean
       # a green run that checked nothing, which is the failure mode worth
       # spending a preflight on.
-      - name: Test direnv hook
-        run: bash .claude/hooks/direnv.test.sh
-
       - name: Check
         run: nix develop --command just ci check
         env:

.github/workflows/docker.yml

@@ -39,6 +39,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - id: parse
         env:
           CRATE: ${{ inputs.package }}
@@ -58,7 +60,7 @@ jobs:
             *) package="$crate" ;;
           esac
           echo "package=${package}" >> "$GITHUB_OUTPUT"
-          .github/scripts/release.sh parse-version "$crate"
+          just gh release parse-version "$crate"
 
   build:
     name: Build ${{ matrix.platform }}

.github/workflows/interop.yml

@@ -24,7 +24,7 @@ on:
       - "test/justfile"
       - "package.json"
       # The Go client builds against the modules this script stages.
-      - "go/scripts/**"
+      - "sh/go/**"
       - ".github/workflows/interop.yml"
 
 concurrency:

.github/workflows/libmoq.yml

@@ -40,6 +40,8 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Install Nix
         if: matrix.use_nix
         uses: DeterminateSystems/nix-installer-action@1d87d45818068401a10cf16bdc5f00b24994a83f # main
@@ -55,12 +57,12 @@ jobs:
       - name: Parse version
         id: parse
         shell: bash
-        run: .github/scripts/release.sh parse-version libmoq
+        run: just gh release parse-version libmoq
 
       - name: Build and package
         shell: bash
         run: |
-          ./rs/libmoq/build.sh \
+          just rs package-libmoq \
             --target ${{ matrix.target }} \
             --version ${{ steps.parse.outputs.version }} \
             --output dist
@@ -85,13 +87,15 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Parse version
         id: parse
-        run: .github/scripts/release.sh parse-version libmoq
+        run: just gh release parse-version libmoq
 
       - name: Find previous tag
         id: prev_tag
-        run: .github/scripts/release.sh prev-tag libmoq
+        run: just gh release prev-tag libmoq
 
       - name: Download artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
@@ -105,7 +109,7 @@ jobs:
           RELEASE_TAG: ${{ github.ref_name }}
           RELEASE_TITLE: "libmoq v${{ steps.parse.outputs.version }}"
           RELEASE_PREV_TAG: ${{ steps.prev_tag.outputs.tag }}
-        run: .github/scripts/release.sh create artifacts
+        run: just gh release create artifacts
 
   # The OBS plugin (cpp/obs) statically links libmoq, so it ships with every
   # libmoq release: rebuild it against the release we just published (no
@@ -137,10 +141,12 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Parse version
         id: parse
         shell: bash
-        run: .github/scripts/release.sh parse-version libmoq
+        run: just gh release parse-version libmoq
 
       # Native Xcode / Visual Studio; libobs/Qt6/ffmpeg come from the obs-deps
       # bundle and libmoq from the release we just published (--libmoq-release).
@@ -150,7 +156,7 @@ jobs:
           TARGET: ${{ matrix.target }}
           VERSION: ${{ steps.parse.outputs.version }}
         run: |
-          ./cpp/obs/build.sh --target "$TARGET" --libmoq-release "$VERSION" --output dist
+          just obs package --target "$TARGET" --libmoq-release "$VERSION" --output dist
 
       - name: Upload artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
@@ -171,9 +177,11 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Parse version
         id: parse
-        run: .github/scripts/release.sh parse-version libmoq
+        run: just gh release parse-version libmoq
 
       # Only the obs-moq archives: the libmoq-* artifacts from the build job
       # belong to the libmoq release, not this one.
@@ -208,4 +216,4 @@ jobs:
           RELEASE_TAG: "obs-moq-v${{ steps.parse.outputs.version }}"
           RELEASE_TITLE: "obs-moq v${{ steps.parse.outputs.version }}"
           RELEASE_PREV_TAG: ${{ steps.prev_tag.outputs.tag }}
-        run: .github/scripts/release.sh create artifacts
+        run: just gh release create artifacts