Stop CI from skipping the gates it exists to run

The workflow installed neither cargo-deny nor cargo-nextest, and ci.sh treated
both as optional. A run therefore reported green having never checked the
licence closure that DISTRIBUTION.md depends on, and having run cargo test
where the repository believes it runs nextest. Both tools are installed here
from prebuilt binaries -- compiling cargo-deny on this runner would cost more
than the job it guards -- and both jobs set LUMBRIDGE_CI_STRICT=1, which makes
a missing tool a failure rather than a warning.

The toolchain version was also written here twice while rust-toolchain.toml
declared it a third time. It is now read from that file, because a skew
between the compiler CI uses and the one a developer uses is precisely the
kind of difference that is invisible until it is expensive.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SPYebLiN2w4TqnHUYGdECq

.gitea/workflows/ci.yml

@@ -12,10 +12,21 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Install pinned Rust toolchain
+      # The version is read from rust-toolchain.toml rather than written here.
+      # That file is the single declaration, and naming the version twice lets
+      # CI and a developer drift onto different compilers without either of
+      # them noticing -- which is the whole failure this indirection prevents.
+      - name: Read the pinned toolchain
+        id: toolchain
+        run: |
+          channel="$(sed -n 's/^channel = "\(.*\)"$/\1/p' rust-toolchain.toml)"
+          test -n "$channel" || { echo "no channel in rust-toolchain.toml" >&2; exit 1; }
+          echo "channel=$channel" >> "$GITHUB_OUTPUT"
+
+      - name: Install the pinned Rust toolchain
         uses: dtolnay/rust-toolchain@master
         with:
-          toolchain: 1.94.1
+          toolchain: ${{ steps.toolchain.outputs.channel }}
           components: rustfmt, clippy
 
       - name: Cache cargo
@@ -27,7 +38,30 @@ jobs:
             target
           key: headless-${{ hashFiles('Cargo.lock') }}
 
+
+      # The gates cannot be allowed to skip themselves. Both tools ship prebuilt
+      # binaries; building cargo-deny from source on this runner would cost more
+      # than the job it guards. LUMBRIDGE_CI_STRICT below turns a missing tool
+      # from a warning into a failure, so a silent skip cannot read as green.
+      - name: Install gate tooling
+        run: |
+          set -euo pipefail
+          mkdir -p "$HOME/.local/bin"
+          arch="$(uname -m)"
+          case "$arch" in
+            x86_64) nextest_arch=x86_64-unknown-linux-gnu; deny_arch=x86_64-unknown-linux-musl ;;
+            aarch64) nextest_arch=aarch64-unknown-linux-gnu; deny_arch=aarch64-unknown-linux-musl ;;
+            *) echo "unsupported runner architecture: $arch" >&2; exit 1 ;;
+          esac
+          curl -fsSL "https://get.nexte.st/latest/$nextest_arch" | tar zxf - -C "$HOME/.local/bin"
+          deny_version=0.18.6
+          curl -fsSL "https://github.com/EmbarkStudios/cargo-deny/releases/download/${deny_version}/cargo-deny-${deny_version}-${deny_arch}.tar.gz" \
+            | tar zxf - -C "$HOME/.local/bin" --strip-components=1 --wildcards '*/cargo-deny'
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
       - name: Headless checks
+        env:
+          LUMBRIDGE_CI_STRICT: "1"
         run: ./scripts/ci.sh --headless
 
   # The GPUI product. Kept separate because it pulls a window toolkit, several
@@ -46,10 +80,21 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Install pinned Rust toolchain
+      # The version is read from rust-toolchain.toml rather than written here.
+      # That file is the single declaration, and naming the version twice lets
+      # CI and a developer drift onto different compilers without either of
+      # them noticing -- which is the whole failure this indirection prevents.
+      - name: Read the pinned toolchain
+        id: toolchain
+        run: |
+          channel="$(sed -n 's/^channel = "\(.*\)"$/\1/p' rust-toolchain.toml)"
+          test -n "$channel" || { echo "no channel in rust-toolchain.toml" >&2; exit 1; }
+          echo "channel=$channel" >> "$GITHUB_OUTPUT"
+
+      - name: Install the pinned Rust toolchain
         uses: dtolnay/rust-toolchain@master
         with:
-          toolchain: 1.94.1
+          toolchain: ${{ steps.toolchain.outputs.channel }}
           components: rustfmt, clippy
 
       # GPUI's X11 backend links against these. libxkbcommon-x11-dev is the
@@ -73,7 +118,30 @@ jobs:
       - name: Report disk before build
         run: df -h .
 
+
+      # The gates cannot be allowed to skip themselves. Both tools ship prebuilt
+      # binaries; building cargo-deny from source on this runner would cost more
+      # than the job it guards. LUMBRIDGE_CI_STRICT below turns a missing tool
+      # from a warning into a failure, so a silent skip cannot read as green.
+      - name: Install gate tooling
+        run: |
+          set -euo pipefail
+          mkdir -p "$HOME/.local/bin"
+          arch="$(uname -m)"
+          case "$arch" in
+            x86_64) nextest_arch=x86_64-unknown-linux-gnu; deny_arch=x86_64-unknown-linux-musl ;;
+            aarch64) nextest_arch=aarch64-unknown-linux-gnu; deny_arch=aarch64-unknown-linux-musl ;;
+            *) echo "unsupported runner architecture: $arch" >&2; exit 1 ;;
+          esac
+          curl -fsSL "https://get.nexte.st/latest/$nextest_arch" | tar zxf - -C "$HOME/.local/bin"
+          deny_version=0.18.6
+          curl -fsSL "https://github.com/EmbarkStudios/cargo-deny/releases/download/${deny_version}/cargo-deny-${deny_version}-${deny_arch}.tar.gz" \
+            | tar zxf - -C "$HOME/.local/bin" --strip-components=1 --wildcards '*/cargo-deny'
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
       - name: UI checks
+        env:
+          LUMBRIDGE_CI_STRICT: "1"
         run: ./scripts/ci.sh --ui
 
       - name: Report disk after build