fix(anvil): scope doctests to library packages and authenticate tool installation

[Evgenii (Vaiz)]

🤖 Clawpilot here! Posted automatically by Clawpilot (an AI agent), not by a human. Please verify before acting.

Replaces #172. That PR was opened for a cargo-each Windows PATH fix that #153 landed independently while it was in review, and its branch predated #153, so its diff against current main had turned into a revert of that work. This is the remaining, genuinely unique half: the Anvil CI repairs, rebuilt from scratch on top of current main so the history is clean. The cargo-each change is gone entirely — main owns that behaviour and already has a regression test for it.

Scoped doctests skipped no packages

anvil-doc-test passed its affected --package selection straight to cargo test --doc, so a binary-only package in that selection failed the run — which is what happened to cargo-each itself, across four platforms.

The recipe now filters the selection to packages with a library target. It keeps every library kind including proc-macro, keeps version-qualified specs, and keeps both the --all-features and default-features runs. An all-binary selection now skips visibly. Unknown packages and metadata failures stay hard errors, with a recipe-specific diagnostic matching the convention its five sibling metadata consumers already use. The metadata probe is --locked, like the two doctest runs it feeds, so the check cannot quietly repair the lockfile it exists to enforce.

Tool installation was unauthenticated

The Linux ARM fast-checks job hit anonymous GitHub release-API 403s and fell back to a slow source build, which then failed on a missing system dependency.

The GitHub setup steps and the impact action's cargo-delta install now pass the built-in GITHUB_TOKEN, so release discovery is authenticated. The credential is kept out of third-party builds: it is removed from the environment before any source install, and binstall's compile strategy is disabled whenever it is set, so a release miss falls through to a tokenless cargo install. Token scopes remain the caller's decision — the generated implementation declares none of its own, which the existing zero-permissions: contract continues to assert.

Three cargo-gamma-lib doctests only ever compiled with --all-features

They import cargo_gamma_lib::internals, which is gated behind the feature that exposes it, so the recipe's default-features pass could not compile them. This was pre-existing and simply unreachable while the recipe was dying earlier on binary-only packages. The doctest bodies are now gated on that feature, and still compile and assert for real under --all-features.

One contract was passing for the wrong reason

justfile.rs asserted that the generated tools.just contains if ($sourcePrereq), under the name "compile strategy must only be disabled for tools with source prerequisites". The token work makes that guard if ($sourcePrereq -or $releaseToken), yet the assertion kept passing — an unrelated later block in the same file also matches that literal. It now pins the guard together with the body it controls, and was verified by weakening the guard and watching it fail.

Validation

Clippy on cargo-anvil, cargo-each and cargo-gamma-lib with --all-targets --all-features --locked -D warnings; the full cargo-anvil lib suite (491 tests); recipe_contracts (51 tests, which run real just); regeneration with a clean --dry-run; refreshed snapshots; just anvil-fmt and just anvil-spellcheck.

[Copilot]

🔵 Needs a closer look

The changes span CI behavior, authentication, generated artifacts, tests, and documentation, so final human review is warranted.

Pull request overview

This pull request repairs Anvil CI doctest scoping, authenticates GitHub tool installation, and synchronizes generated artifacts and documentation.

Changes:

• Filters doctests to library-capable packages and gates feature-dependent examples.
• Authenticates tool installation while keeping tokens out of source builds.
• Updates contracts, snapshots, templates, actions, documentation, and checksums.

File summaries

File	Summary
justfiles/anvil/tools.just	Adds token-aware tool installation.
justfiles/anvil/checks/doc-test.just	Filters doctest selections to library targets.
crates/cargo-gamma-lib/src/cfg/mod.rs	Gates internal-only doctest bodies.
crates/cargo-gamma-lib/src/cfg/features.rs	Gates the internal API doctest.
crates/cargo-anvil/tests/snapshots/snapshots__local_only.snap	Refreshes local generated output.
crates/cargo-anvil/tests/snapshots/snapshots__github_backend.snap	Refreshes GitHub generated output.
crates/cargo-anvil/tests/snapshots/snapshots__ado_backend.snap	Refreshes ADO generated output.
crates/cargo-anvil/tests/recipe_contracts.rs	Adds doctest and installation regression coverage.
crates/cargo-anvil/templates/justfiles/anvil/tools.just	Updates the installer template.
crates/cargo-anvil/templates/justfiles/anvil/checks/doc-test.just	Updates the doctest template.
crates/cargo-anvil/templates/github/setup-action.yml	Updates authenticated setup actions.
crates/cargo-anvil/templates/github/impact-action.yml	Updates authenticated impact installation.
crates/cargo-anvil/src/anvil/artifacts/justfile.rs	Strengthens installer guard contracts.
crates/cargo-anvil/src/anvil/artifacts/github.rs	Strengthens generated action assertions.
crates/cargo-anvil/docs/design/README.md	Documents token handling and installation policy.
crates/cargo-anvil/docs/design/local.md	Documents local installer behavior.
crates/cargo-anvil/docs/design/github.md	Documents GitHub token usage.
crates/cargo-anvil/docs/design/checks.md	Documents doctest package filtering.
.github/actions/anvil-setup/action.yml	Applies authenticated tool setup.
.github/actions/anvil-impact/action.yml	Applies authenticated cargo-delta installation.
.anvil.lock	Updates generated artifact checksums.

Review details

• Files reviewed: 20/21 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Codecov Comments Bot (codecov-commenter)]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.6%. Comparing base (7986dd4) to head (1c87857).
⚠️ Report is 1 commits behind head on main.

❌ Your project status has failed because the head coverage (97.6%) is below the target coverage (100.0%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@          Coverage Diff           @@
##            main    #174    +/-   ##
======================================
  Coverage   97.5%   97.6%            
======================================
  Files        300     300            
  Lines      69048   69314   +266     
======================================
+ Hits       67387   67651   +264     
- Misses      1661    1663     +2     

Flag	Coverage Δ
linux	97.5% <ø> (+<0.1%)	⬆️
linux-arm	97.5% <ø> (+<0.1%)	⬆️
scheduled	?
windows	97.7% <ø> (+<0.1%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.