feat!: port every widget to Rust and remove the Python

.github/changelog.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+# Build a changelog for one release, from the commit subjects between two
+# tags.
+#
+# The subjects here are prose, not conventional commits - "netwatch: every
+# rate read a quarter too high" rather than "fix(netwatch): ...". There is no
+# type to group by and inventing one would mean rewriting three hundred
+# subjects. What every subject does carry is the part before the first colon,
+# which is the widget or the area it touched, so that is the grouping: a
+# reader asking "what changed in ports" gets an answer, which is the question
+# a changelog for fourteen separate binaries is actually asked.
+#
+# A prefix only counts as a scope if it names something real - a widget in
+# widgets/src/bin, or one of the areas below. Early history has subjects like
+# "Add agents.py: every coding agent", where the part before the colon is the
+# start of a sentence rather than a scope; taken at face value those made
+# forty-seven sections out of three hundred commits. The widget list is read
+# from the tree rather than written down here, so a new widget is a scope the
+# day it lands.
+#
+# Usage: changelog.sh <tag> [previous-tag]
+# With no previous tag it takes the whole history, which is what the first
+# release needs and what it will get, there being no tags yet.
+set -euo pipefail
+
+here=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+tag="${1:?usage: changelog.sh <tag> [previous-tag]}"
+prev="${2:-}"
+
+if [ -z "$prev" ]; then
+    prev=$(git describe --tags --abbrev=0 "${tag}^" 2>/dev/null || true)
+fi
+if [ -n "$prev" ]; then
+    range="${prev}..${tag}"
+    since="since ${prev}"
+else
+    range="$tag"
+    since="everything so far"
+fi
+
+# Every widget, plus the places that are not one.
+scopes=$(
+    { ls "$here/widgets/src/bin" 2>/dev/null | sed -n 's/\.rs$//p'
+      printf '%s\n' core widgets docs tests ci rust release
+    } | sort -u
+)
+
+printf '## %s\n\n' "$tag"
+printf '%s commits, %s.\n\n' "$(git log --oneline "$range" | wc -l | tr -d ' ')" "$since"
+
+git log --format='%s' "$range" | awk -v known="$scopes" -F': ' '
+    BEGIN { n = split(known, k, "\n"); for (i = 1; i <= n; i++) if (k[i] != "") is[k[i]] = 1 }
+    {
+        if (NF < 2) { print "everything else\t" $0; next }
+        scope = $1
+        rest  = substr($0, length(scope) + 3)
+        n = split(scope, parts, /, */)
+        # Every part has to be a real scope. "linear, netwatch" is two
+        # widgets; "Add agents.py" is a sentence that happens to contain a
+        # comma-free prefix and belongs whole, under everything else.
+        good = (n > 0)
+        for (i = 1; i <= n; i++) if (!(parts[i] in is)) good = 0
+        if (!good) { print "everything else\t" $0; next }
+        for (i = 1; i <= n; i++) print parts[i] "\t" rest
+    }
+' | sort -f -s -t"$(printf '\t')" -k1,1 | awk -F'\t' '
+    $1 != seen { if (seen != "") printf "\n"; printf "### %s\n\n", $1; seen = $1 }
+    { printf "- %s\n", $2 }
+'

.github/workflows/codeql.yml

@@ -0,0 +1,87 @@
+# CodeQL, in advanced setup rather than default.
+#
+# Default setup cannot do this. Its API accepts only actions, c-cpp, csharp,
+# go, java-kotlin, javascript-typescript, python, ruby and swift - `rust` is
+# refused with a 422 - so the repository was still scanning `python` months
+# after the last .py file was deleted, which is to say scanning nothing.
+#
+# Rust support is public preview, from CodeQL 2.22.1. It needs no build step:
+# the extractor reads the sources, so there is no `autobuild` here and no
+# `build-mode`, which is how github/codeql-action's own Rust check runs.
+#
+# `actions` is scanned alongside it, and is not padding - this repository
+# publishes a release workflow that handles a tag and writes to the releases
+# API, and that file is exactly the kind of thing the actions queries read.
+#
+# THIS FILE DOES NOT RUN YET, and that is not a mistake in it. GitHub disables
+# advanced workflows while default setup is on, and default setup here is
+# pinned by an enforced organisation configuration ("GitHub recommended"),
+# so the repository cannot turn it off: the API answers 422, "controlled by
+# organization administrators".
+#
+# The fix is not to detach this repository from that configuration. The same
+# configuration enforces secret scanning, push protection, Dependabot alerts
+# and private vulnerability reporting, and this repository is public with
+# "secrets never enter the tree" as its first rule - trading push protection
+# for Rust analysis would be a bad bargain. What is needed is a sibling
+# configuration, identical but with code_scanning_default_setup disabled,
+# attached to this repository alone. Then this file starts working and
+# nothing else is given up.
+name: CodeQL
+
+# Manual only, until the organisation configuration above is sorted.
+#
+# This ran once on push and did exactly what it should: the Rust extractor
+# read the whole crate and produced a database, and then the upload was
+# refused - "CodeQL analyses from advanced configurations cannot be
+# processed when the default setup is enabled". The analysis is fine; the
+# submission is what is blocked.
+#
+# A check that can only ever be red teaches nothing, and would be red on
+# every push to main after the port lands. So the automatic triggers are
+# parked here, in the order they should be restored:
+#
+#   push:         { branches: [main] }
+#   pull_request: { branches: [main] }
+#   schedule:     [ { cron: "17 4 * * 1" } ]     # weekly, as default setup had
+#
+# Put those back the moment the repository is attached to a configuration
+# with code_scanning_default_setup disabled, and delete this comment.
+on:
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  analyze:
+    name: Analyze ${{ matrix.language }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    permissions:
+      # The three this needs and nothing else: read the code, write the
+      # findings, and read Actions metadata for the workflow scan.
+      contents: read
+      security-events: write
+      actions: read
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [rust, actions]
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+
+      - name: Initialise CodeQL
+        uses: github/codeql-action/init@486fec2a3ea2626afcd8c7e9208b4f515078dd7e # codeql-bundle-v2.26.4
+        with:
+          languages: ${{ matrix.language }}
+          # security-extended over the default suite. This is fourteen
+          # binaries that read a machine's own state and hold three API
+          # tokens; the extra queries are the point of running this at all.
+          queries: security-extended
+
+      - name: Analyse
+        uses: github/codeql-action/analyze@486fec2a3ea2626afcd8c7e9208b4f515078dd7e # codeql-bundle-v2.26.4
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/release.yml

@@ -0,0 +1,119 @@
+# A tag produces a release: fourteen Linux binaries, their checksums, and a
+# changelog built from the commit subjects since the last tag.
+#
+# Nothing here rewrites the source it is building. The version in Cargo.toml
+# and the tag are checked against each other and the build stops if they
+# disagree, rather than the workflow editing the manifest to make them match
+# - a build that edits its own source produces a binary no checkout can
+# reproduce, which is a strange thing to hand somebody.
+name: release
+
+on:
+  push:
+    tags: ['v*']
+
+permissions:
+  contents: write
+
+jobs:
+  linux:
+    # Pinned, not `-latest`. The oldest glibc a binary runs on is the one it
+    # was built against, so that is a decision rather than something to
+    # inherit from whatever the runner image became this month. 22.04 is
+    # glibc 2.35.
+    runs-on: ubuntu-22.04
+    steps:
+      # Pinned to a commit, not a tag. A tag is mutable: re-running this
+      # workflow on the same release tag could execute different action code
+      # than the release was built with, which makes "reproducible" a word
+      # rather than a property. Comments carry the human-readable version so
+      # a reader can tell what these are without resolving them.
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          # The changelog reads the history between two tags, and the build
+          # stamps the commit into --version. A shallow clone has neither.
+          fetch-depth: 0
+
+      - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
+        with:
+          # An exact version, for the same reason. `stable` moves, and two
+          # builds of one tag compiled by different compilers are two
+          # different binaries wearing one version number.
+          toolchain: "1.98.0"
+
+      - name: The tag and the manifest must agree
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          manifest=$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -1)
+          if [ "$tag" != "$manifest" ]; then
+            echo "tag v$tag but Cargo.toml says $manifest" >&2
+            echo "bump the manifest and tag that commit, rather than having" >&2
+            echo "this workflow rewrite the source it is building" >&2
+            exit 1
+          fi
+          echo "v$tag"
+
+      - name: The release profile still unwinds
+        run: |
+          # Three widgets wrap their poll thread in catch_unwind and record
+          # why it stopped. Under panic = "abort" those arms are unreachable
+          # and the source reads as protected while the binary is not - it
+          # was shipped that way once. Costs about 4.5% of the total size,
+          # measured.
+          grep -q '^panic = "unwind"$' Cargo.toml || {
+            echo "Cargo.toml no longer sets panic = unwind" >&2; exit 1; }
+          # And nothing here may quietly override it.
+          if [ -n "${RUSTFLAGS:-}" ]; then
+            echo "RUSTFLAGS is set ($RUSTFLAGS) and could undo the profile" >&2
+            exit 1
+          fi
+
+      - run: cargo test --release
+
+      - run: cargo build --release
+
+      - name: Nothing dynamic beyond the C runtime
+        run: |
+          # rusqlite is taken with `bundled` so SQLite is compiled in, and
+          # the promise on the tin is that a binary needs nothing installed
+          # alongside it. Checked rather than asserted: a crate that starts
+          # wanting a system library would otherwise ship quietly.
+          allowed='linux-vdso|libc\.so|libm\.so|libgcc_s\.so|ld-linux'
+          bad=0
+          for b in $(cargo metadata --no-deps --format-version 1 \
+                     | grep -o '"name":"[a-z-]*","src_path":"[^"]*bin/[a-z-]*\.rs"' \
+                     | sed 's/.*bin\///; s/\.rs"//'); do
+            [ -x "target/release/$b" ] || continue
+            leaked=$(ldd "target/release/$b" | grep -vE "$allowed" | grep -v '^\s*$' || true)
+            if [ -n "$leaked" ]; then
+              echo "$b links something it should carry:" >&2
+              echo "$leaked" >&2
+              bad=1
+            fi
+          done
+          [ "$bad" = 0 ]
+
+      - name: Changelog
+        run: ./.github/changelog.sh "$GITHUB_REF_NAME" > CHANGELOG-release.md
+
+      - name: One tarball, and its checksum
+        run: |
+          name="terminal-toys-${GITHUB_REF_NAME}-x86_64-unknown-linux-gnu"
+          mkdir -p "dist/$name"
+          # The binaries, and the docs that explain them - `start` embeds
+          # them but a person reading the tarball has no other copy.
+          find target/release -maxdepth 1 -type f -executable ! -name '*.*' \
+            -exec cp {} "dist/$name/" \;
+          cp -r docs README.md LICENSE config.example.json "dist/$name/"
+          tar -C dist -czf "$name.tar.gz" "$name"
+          sha256sum "$name.tar.gz" > "$name.tar.gz.sha256"
+          ls -la "$name.tar.gz"
+
+      - name: Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release create "$GITHUB_REF_NAME" \
+            --title "$GITHUB_REF_NAME" \
+            --notes-file CHANGELOG-release.md \
+            terminal-toys-*.tar.gz terminal-toys-*.tar.gz.sha256

.gitignore

@@ -1,9 +1,12 @@
-__pycache__/
-*.py[cod]
-.venv/
-venv/
+target/
 .DS_Store
 
+# What a release build leaves behind, if one is run by hand.
+dist/
+terminal-toys-*.tar.gz
+terminal-toys-*.tar.gz.sha256
+CHANGELOG-release.md
+
 # Personal settings, and now secrets: config.json holds the Vercel token.
 # Variants are covered too, so a config.local.json or a stray .env cannot be
 # committed by accident.