chore(ci): every workflow step runs a just recipe

.github/actions/just/action.yml

@@ -0,0 +1,11 @@
+name: Install just
+description: Install the pinned just for jobs outside the nix dev shell, which already provides it.
+
+runs:
+  using: composite
+  steps:
+    # A checksum-verified prebuilt, so it costs seconds rather than a
+    # `cargo install`. Keep the version in step with nixpkgs' just in flake.lock.
+    - uses: taiki-e/install-action@9983c65e42da123ff25d1f78505eb6de315aa172 # v2.87.20
+      with:
+        tool: just@1.58.0

.github/justfile

@@ -1,13 +1,40 @@
 set working-directory := '..'
 
-# Lint GitHub Actions workflows and their alert coverage.
+# Lint GitHub Actions workflows, their alert coverage, and that every step runs a recipe.
 check:
     actionlint
     sh/gh/alert.sh check-coverage
+    bun sh/gh/check-runs.ts
 
 # Tests of the release tooling itself; nightly, not on every pull request.
 test:
     python3 sh/gh/install-formula.test.py
     sh/gh/release.test.sh
     python3 sh/rs/package-rename.test.py
     sh/go/publish-wrapper.test.sh
+    bash .claude/hooks/direnv.test.sh
+
+# Release workflow helpers, e.g. `just gh release parse-version moq-cli`.
+[positional-arguments]
+release *args:
+    sh/gh/release.sh "$@"
+
+# Post a failed run to Discord, or check that alert.yml covers every workflow.
+[positional-arguments]
+alert *args:
+    sh/gh/alert.sh "$@"
+
+# Render a Homebrew formula template for a release.
+[positional-arguments]
+formula *args:
+    sh/gh/render-formula.sh "$@"
+
+# Copy a rendered formula into a Homebrew tap checkout, migrating renamed formulae.
+[positional-arguments]
+install-formula *args:
+    python3 sh/gh/install-formula.py "$@"
+
+# Trigger the apt-repo and rpm-repo workflows for a release tag.
+[positional-arguments]
+trigger-repo-publish *args:
+    sh/gh/trigger-repo-publish.sh "$@"

.github/workflows/alert.yml

@@ -78,6 +78,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Post to Discord
         env:
           DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
@@ -88,4 +90,4 @@ jobs:
           RUN_REF: ${{ github.event.workflow_run.head_branch }}
           RUN_TITLE: ${{ github.event.workflow_run.display_title }}
           RUN_ACTOR: ${{ github.event.workflow_run.triggering_actor.login }}
-        run: sh/gh/alert.sh discord
+        run: just gh alert discord

.github/workflows/android.yml

@@ -50,7 +50,6 @@ concurrency:
 
 env:
   CARGO_NDK_VERSION: 4.1.2
-  JUST_VERSION: 1.52.0
 
 jobs:
   android:
@@ -74,8 +73,10 @@ jobs:
 
       # No Rust cache: this workflow only runs on pull requests, which may not
       # save one, so it would have nothing to restore.
-      - name: Install just and cargo-ndk
-        run: cargo install --locked "just@$JUST_VERSION" "cargo-ndk@$CARGO_NDK_VERSION"
+      - uses: ./.github/actions/just
+
+      - name: Install cargo-ndk
+        run: cargo install --locked "cargo-ndk@$CARGO_NDK_VERSION"
 
       - name: Check
         run: just rs android

.github/workflows/apt-repo.yml

@@ -34,6 +34,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Set up packaging tools
         uses: ./.github/actions/setup-packaging
 
@@ -53,10 +55,9 @@ jobs:
       - name: Publish to R2
         shell: bash
         env:
-          ARTIFACTS_DIR: artifacts
           R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
           R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
           R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
           SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
           SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
-        run: ./infra/apt/publish.sh
+        run: just infra apt publish "$GITHUB_WORKSPACE/artifacts"

.github/workflows/check.yml

@@ -73,9 +73,6 @@ jobs:
       # Locally an absent formatter means less gets checked; here it would mean
       # a green run that checked nothing, which is the failure mode worth
       # spending a preflight on.
-      - name: Test direnv hook
-        run: bash .claude/hooks/direnv.test.sh
-
       - name: Check
         run: nix develop --command just ci check
         env:

.github/workflows/docker.yml

@@ -39,6 +39,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - id: parse
         env:
           CRATE: ${{ inputs.package }}
@@ -58,7 +60,7 @@ jobs:
             *) package="$crate" ;;
           esac
           echo "package=${package}" >> "$GITHUB_OUTPUT"
-          sh/gh/release.sh parse-version "$crate"
+          just gh release parse-version "$crate"
 
   build:
     name: Build ${{ matrix.platform }}

.github/workflows/libmoq.yml

@@ -40,6 +40,8 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Install Nix
         if: matrix.use_nix
         uses: DeterminateSystems/nix-installer-action@1d87d45818068401a10cf16bdc5f00b24994a83f # main
@@ -55,12 +57,12 @@ jobs:
       - name: Parse version
         id: parse
         shell: bash
-        run: sh/gh/release.sh parse-version libmoq
+        run: just gh release parse-version libmoq
 
       - name: Build and package
         shell: bash
         run: |
-          ./rs/libmoq/build.sh \
+          just rs package-libmoq \
             --target ${{ matrix.target }} \
             --version ${{ steps.parse.outputs.version }} \
             --output dist
@@ -85,13 +87,15 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Parse version
         id: parse
-        run: sh/gh/release.sh parse-version libmoq
+        run: just gh release parse-version libmoq
 
       - name: Find previous tag
         id: prev_tag
-        run: sh/gh/release.sh prev-tag libmoq
+        run: just gh release prev-tag libmoq
 
       - name: Download artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
@@ -105,7 +109,7 @@ jobs:
           RELEASE_TAG: ${{ github.ref_name }}
           RELEASE_TITLE: "libmoq v${{ steps.parse.outputs.version }}"
           RELEASE_PREV_TAG: ${{ steps.prev_tag.outputs.tag }}
-        run: sh/gh/release.sh create artifacts
+        run: just gh release create artifacts
 
   # The OBS plugin (cpp/obs) statically links libmoq, so it ships with every
   # libmoq release: rebuild it against the release we just published (no
@@ -137,10 +141,12 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Parse version
         id: parse
         shell: bash
-        run: sh/gh/release.sh parse-version libmoq
+        run: just gh release parse-version libmoq
 
       # Native Xcode / Visual Studio; libobs/Qt6/ffmpeg come from the obs-deps
       # bundle and libmoq from the release we just published (--libmoq-release).
@@ -150,7 +156,7 @@ jobs:
           TARGET: ${{ matrix.target }}
           VERSION: ${{ steps.parse.outputs.version }}
         run: |
-          ./cpp/obs/build.sh --target "$TARGET" --libmoq-release "$VERSION" --output dist
+          just obs package --target "$TARGET" --libmoq-release "$VERSION" --output dist
 
       - name: Upload artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
@@ -171,9 +177,11 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Parse version
         id: parse
-        run: sh/gh/release.sh parse-version libmoq
+        run: just gh release parse-version libmoq
 
       # Only the obs-moq archives: the libmoq-* artifacts from the build job
       # belong to the libmoq release, not this one.
@@ -208,4 +216,4 @@ jobs:
           RELEASE_TAG: "obs-moq-v${{ steps.parse.outputs.version }}"
           RELEASE_TITLE: "obs-moq v${{ steps.parse.outputs.version }}"
           RELEASE_PREV_TAG: ${{ steps.prev_tag.outputs.tag }}
-        run: sh/gh/release.sh create artifacts
+        run: just gh release create artifacts

.github/workflows/moq-cli.yml

@@ -39,6 +39,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
         with:
@@ -47,7 +49,7 @@ jobs:
       - name: Parse version
         id: parse
         shell: bash
-        run: sh/gh/release.sh parse-version moq-cli
+        run: just gh release parse-version moq-cli
 
       - name: Set up packaging tools
         uses: ./.github/actions/setup-packaging
@@ -64,7 +66,7 @@ jobs:
           VERSION: ${{ steps.parse.outputs.version }}
           TARGET: ${{ matrix.target }}
         run: |
-          ./sh/rs/package-binary.sh \
+          just rs package-binary \
             --crate moq-cli \
             --bin moq \
             --binary "target/${TARGET}/release/moq" \
@@ -80,16 +82,16 @@ jobs:
           ARCH: ${{ matrix.deb-arch }}
           BINARY_PATH: target/${{ matrix.target }}/release/moq
         run: |
-          sh/rs/package-nfpm.sh packaging/moq-cli/nfpm.yaml deb dist/
-          sh/rs/package-nfpm.sh packaging/moq-cli/transition.yaml deb dist/
+          just rs package-nfpm packaging/moq-cli/nfpm.yaml deb dist/
+          just rs package-nfpm packaging/moq-cli/transition.yaml deb dist/
 
       - name: Package .rpm
         shell: bash
         env:
           VERSION: ${{ steps.parse.outputs.version }}
           ARCH: ${{ matrix.rpm-arch }}
           BINARY_PATH: target/${{ matrix.target }}/release/moq
-        run: sh/rs/package-nfpm.sh packaging/moq-cli/nfpm.yaml rpm dist/
+        run: just rs package-nfpm packaging/moq-cli/nfpm.yaml rpm dist/
 
       - name: Upload artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
@@ -114,19 +116,21 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - uses: DeterminateSystems/nix-installer-action@1d87d45818068401a10cf16bdc5f00b24994a83f # main
         with:
           determinate: false
 
       - name: Parse version
         id: parse
         shell: bash
-        run: sh/gh/release.sh parse-version moq-cli
+        run: just gh release parse-version moq-cli
 
       - name: Build and package tarball
         shell: bash
         run: |
-          ./sh/rs/package-binary.sh \
+          just rs package-binary \
             --crate moq-cli \
             --bin moq \
             --target ${{ matrix.target }} \
@@ -154,6 +158,8 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
         with:
@@ -169,12 +175,12 @@ jobs:
       - name: Parse version
         id: parse
         shell: bash
-        run: sh/gh/release.sh parse-version moq-cli
+        run: just gh release parse-version moq-cli
 
       - name: Build and package zip
         shell: bash
         run: |
-          ./sh/rs/package-windows.sh \
+          just rs package-windows \
             --crate moq-cli \
             --bin moq \
             --target ${{ matrix.target }} \
@@ -202,13 +208,15 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - uses: ./.github/actions/just
+
       - name: Parse version
         id: parse
-        run: sh/gh/release.sh parse-version moq-cli
+        run: just gh release parse-version moq-cli
 
       - name: Find previous tag
         id: prev_tag
-        run: sh/gh/release.sh prev-tag moq-cli
+        run: just gh release prev-tag moq-cli
 
       - name: Download artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
@@ -222,10 +230,10 @@ jobs:
           RELEASE_TAG: ${{ github.ref_name }}
           RELEASE_TITLE: "moq-cli v${{ steps.parse.outputs.version }}"
           RELEASE_PREV_TAG: ${{ steps.prev_tag.outputs.tag }}
-        run: sh/gh/release.sh create artifacts
+        run: just gh release create artifacts
 
       - name: Trigger apt/rpm repo publish
         env:
           GH_TOKEN: ${{ github.token }}
           TAG: ${{ github.ref_name }}
-        run: sh/gh/trigger-repo-publish.sh
+        run: just gh trigger-repo-publish