Merge branch 'feat/rust-support' into 'main'

Matthew · Matthew · commit 06f99df388c6 · 2026-03-04T21:08:07.000Z
feat(standards): add Rust language ecosystem standards

See merge request orgdocs/development-standards!19
diff --git a/.cursorrules b/.cursorrules
@@ -19,6 +19,10 @@ Critical Rules:
 6. Use the shared logging library. No raw `echo` for status messages. Use
    `log_info`, `log_warn`, `log_error`, `log_debug`, and `die` from
    `lib/log.sh`.
+7. Never suppress failing checks. When a lint, format, security, or test
+   check fails, fix the underlying issue. Never comment out code, add
+   suppression annotations, disable rules, or mark CI jobs as
+   allowed-to-fail to bypass a failing check.
 
 Quick Reference:
 
diff --git a/.opencode/agents.yaml b/.opencode/agents.yaml
@@ -24,6 +24,10 @@ agents:
       6. Use the shared logging library. No raw `echo` for status messages. Use
          `log_info`, `log_warn`, `log_error`, `log_debug`, and `die` from
          `lib/log.sh`.
+      7. Never suppress failing checks. When a lint, format, security, or test
+         check fails, fix the underlying issue. Never comment out code, add
+         suppression annotations, disable rules, or mark CI jobs as
+         allowed-to-fail to bypass a failing check.
 
       Quick Reference:
 
diff --git a/AGENTS.md b/AGENTS.md
@@ -11,6 +11,7 @@ See DEVELOPMENT.md for the complete reference.
 4. **Respect `.editorconfig`.** Never override formatting rules (indent style, line endings, trailing whitespace) without explicit instruction.
 5. **Write idempotent scripts.** Every script must be safe to re-run. Check before acting: `command -v tool || install_tool`, `mkdir -p`, guard file writes with existence checks.
 6. **Use the shared logging library.** No raw `echo` for status messages. Use `log_info`, `log_warn`, `log_error`, `log_debug`, and `die` from `lib/log.sh`.
+7. **Never suppress failing checks.** When a lint, format, security, or test check fails, fix the underlying issue. Never comment out code, add suppression annotations, disable rules, or mark CI jobs as allowed-to-fail to bypass a failing check.
 
 ## Quick Reference
 
diff --git a/CLAUDE.md b/CLAUDE.md
@@ -11,6 +11,7 @@ See DEVELOPMENT.md for the complete reference.
 4. **Respect `.editorconfig`.** Never override formatting rules (indent style, line endings, trailing whitespace) without explicit instruction.
 5. **Write idempotent scripts.** Every script must be safe to re-run. Check before acting: `command -v tool || install_tool`, `mkdir -p`, guard file writes with existence checks.
 6. **Use the shared logging library.** No raw `echo` for status messages. Use `log_info`, `log_warn`, `log_error`, `log_debug`, and `die` from `lib/log.sh`.
+7. **Never suppress failing checks.** When a lint, format, security, or test check fails, fix the underlying issue. Never comment out code, add suppression annotations, disable rules, or mark CI jobs as allowed-to-fail to bypass a failing check.
 
 ## Quick Reference
 
diff --git a/DEVELOPMENT.md b/DEVELOPMENT.md
@@ -10,7 +10,7 @@ Sections are wrapped in HTML comment markers (`<!-- devrail:section-name -->` /
 
 ## Critical Rules
 
-These six rules are non-negotiable. Every developer and every AI agent must follow them without exception.
+These seven rules are non-negotiable. Every developer and every AI agent must follow them without exception.
 
 1. **Run `make check` before completing any story or task.** Never mark work done without passing checks. This is the single gate for all linting, formatting, security, and test validation.
 
@@ -24,6 +24,8 @@ These six rules are non-negotiable. Every developer and every AI agent must foll
 
 6. **Use the shared logging library.** No raw `echo` for status messages. Use `log_info`, `log_warn`, `log_error`, `log_debug`, and `die` from `lib/log.sh`.
 
+7. **Never suppress failing checks.** When a lint, format, security, or test check fails, fix the underlying issue. Never comment out code, add suppression annotations (`# noqa`, `# nosec`, `#tfsec:ignore`, `// nolint`), disable rules, or mark CI jobs as allowed-to-fail to bypass a failing check. If a finding is a confirmed false positive, document the justification inline alongside the tool's designated suppression mechanism.
+
 <!-- /devrail:critical-rules -->
 
 <!-- devrail:makefile-contract -->
diff --git a/README.md b/README.md
@@ -48,6 +48,7 @@ The `standards/` directory contains the canonical reference documents for all De
 | [ruby.md](standards/ruby.md) | Ruby tooling standards (rubocop, brakeman, bundler-audit, rspec, reek, sorbet) |
 | [go.md](standards/go.md) | Go tooling standards (golangci-lint, gofumpt, govulncheck, go test) |
 | [javascript.md](standards/javascript.md) | JavaScript/TypeScript tooling standards (eslint, prettier, npm audit, vitest, tsc) |
+| [rust.md](standards/rust.md) | Rust tooling standards (clippy, rustfmt, cargo-audit, cargo-deny, cargo test) |
 | [universal.md](standards/universal.md) | Universal security tools (trivy, gitleaks) |
 | [coding-practices.md](standards/coding-practices.md) | General coding principles, naming, error handling, testing, and dependencies |
 | [git-workflow.md](standards/git-workflow.md) | Branch strategy, pull requests, code review, merge policy, and git security |
diff --git a/dev-toolchain/.cursorrules b/dev-toolchain/.cursorrules
@@ -19,6 +19,10 @@ Critical Rules:
 6. Use the shared logging library. No raw `echo` for status messages. Use
    `log_info`, `log_warn`, `log_error`, `log_debug`, and `die` from
    `lib/log.sh`.
+7. Never suppress failing checks. When a lint, format, security, or test
+   check fails, fix the underlying issue. Never comment out code, add
+   suppression annotations, disable rules, or mark CI jobs as
+   allowed-to-fail to bypass a failing check.
 
 Quick Reference:
 
diff --git a/dev-toolchain/.opencode/agents.yaml b/dev-toolchain/.opencode/agents.yaml
@@ -24,6 +24,10 @@ agents:
       6. Use the shared logging library. No raw `echo` for status messages. Use
          `log_info`, `log_warn`, `log_error`, `log_debug`, and `die` from
          `lib/log.sh`.
+      7. Never suppress failing checks. When a lint, format, security, or test
+         check fails, fix the underlying issue. Never comment out code, add
+         suppression annotations, disable rules, or mark CI jobs as
+         allowed-to-fail to bypass a failing check.
 
       Quick Reference:
 
diff --git a/dev-toolchain/AGENTS.md b/dev-toolchain/AGENTS.md
@@ -11,6 +11,7 @@ See DEVELOPMENT.md for the complete reference.
 4. **Respect `.editorconfig`.** Never override formatting rules (indent style, line endings, trailing whitespace) without explicit instruction.
 5. **Write idempotent scripts.** Every script must be safe to re-run. Check before acting: `command -v tool || install_tool`, `mkdir -p`, guard file writes with existence checks.
 6. **Use the shared logging library.** No raw `echo` for status messages. Use `log_info`, `log_warn`, `log_error`, `log_debug`, and `die` from `lib/log.sh`.
+7. **Never suppress failing checks.** When a lint, format, security, or test check fails, fix the underlying issue. Never comment out code, add suppression annotations, disable rules, or mark CI jobs as allowed-to-fail to bypass a failing check.
 
 ## Quick Reference
 
diff --git a/dev-toolchain/CLAUDE.md b/dev-toolchain/CLAUDE.md
@@ -11,6 +11,7 @@ See DEVELOPMENT.md for the complete reference.
 4. **Respect `.editorconfig`.** Never override formatting rules (indent style, line endings, trailing whitespace) without explicit instruction.
 5. **Write idempotent scripts.** Every script must be safe to re-run. Check before acting: `command -v tool || install_tool`, `mkdir -p`, guard file writes with existence checks.
 6. **Use the shared logging library.** No raw `echo` for status messages. Use `log_info`, `log_warn`, `log_error`, `log_debug`, and `die` from `lib/log.sh`.
+7. **Never suppress failing checks.** When a lint, format, security, or test check fails, fix the underlying issue. Never comment out code, add suppression annotations, disable rules, or mark CI jobs as allowed-to-fail to bypass a failing check.
 
 ## Quick Reference
 
diff --git a/devrail.dev/.cursorrules b/devrail.dev/.cursorrules
@@ -19,6 +19,10 @@ Critical Rules:
 6. Use the shared logging library. No raw `echo` for status messages. Use
    `log_info`, `log_warn`, `log_error`, `log_debug`, and `die` from
    `lib/log.sh`.
+7. Never suppress failing checks. When a lint, format, security, or test
+   check fails, fix the underlying issue. Never comment out code, add
+   suppression annotations, disable rules, or mark CI jobs as
+   allowed-to-fail to bypass a failing check.
 
 Quick Reference:
 
diff --git a/devrail.dev/.opencode/agents.yaml b/devrail.dev/.opencode/agents.yaml
@@ -24,6 +24,10 @@ agents:
       6. Use the shared logging library. No raw `echo` for status messages. Use
          `log_info`, `log_warn`, `log_error`, `log_debug`, and `die` from
          `lib/log.sh`.
+      7. Never suppress failing checks. When a lint, format, security, or test
+         check fails, fix the underlying issue. Never comment out code, add
+         suppression annotations, disable rules, or mark CI jobs as
+         allowed-to-fail to bypass a failing check.
 
       Quick Reference:
 
diff --git a/devrail.dev/AGENTS.md b/devrail.dev/AGENTS.md
@@ -11,6 +11,7 @@ See DEVELOPMENT.md for the complete reference.
 4. **Respect `.editorconfig`.** Never override formatting rules (indent style, line endings, trailing whitespace) without explicit instruction.
 5. **Write idempotent scripts.** Every script must be safe to re-run. Check before acting: `command -v tool || install_tool`, `mkdir -p`, guard file writes with existence checks.
 6. **Use the shared logging library.** No raw `echo` for status messages. Use `log_info`, `log_warn`, `log_error`, `log_debug`, and `die` from `lib/log.sh`.
+7. **Never suppress failing checks.** When a lint, format, security, or test check fails, fix the underlying issue. Never comment out code, add suppression annotations, disable rules, or mark CI jobs as allowed-to-fail to bypass a failing check.
 
 ## Quick Reference
 
diff --git a/devrail.dev/CLAUDE.md b/devrail.dev/CLAUDE.md
@@ -11,6 +11,7 @@ See DEVELOPMENT.md for the complete reference.
 4. **Respect `.editorconfig`.** Never override formatting rules (indent style, line endings, trailing whitespace) without explicit instruction.
 5. **Write idempotent scripts.** Every script must be safe to re-run. Check before acting: `command -v tool || install_tool`, `mkdir -p`, guard file writes with existence checks.
 6. **Use the shared logging library.** No raw `echo` for status messages. Use `log_info`, `log_warn`, `log_error`, `log_debug`, and `die` from `lib/log.sh`.
+7. **Never suppress failing checks.** When a lint, format, security, or test check fails, fix the underlying issue. Never comment out code, add suppression annotations, disable rules, or mark CI jobs as allowed-to-fail to bypass a failing check.
 
 ## Quick Reference
 
diff --git a/github-repo-template/.cursorrules b/github-repo-template/.cursorrules
@@ -19,6 +19,10 @@ Critical Rules:
 6. Use the shared logging library. No raw `echo` for status messages. Use
    `log_info`, `log_warn`, `log_error`, `log_debug`, and `die` from
    `lib/log.sh`.
+7. Never suppress failing checks. When a lint, format, security, or test
+   check fails, fix the underlying issue. Never comment out code, add
+   suppression annotations, disable rules, or mark CI jobs as
+   allowed-to-fail to bypass a failing check.
 
 Quick Reference:
 
diff --git a/github-repo-template/.devrail.yml b/github-repo-template/.devrail.yml
@@ -9,6 +9,7 @@ languages:
   # - ruby
   # - go
   # - javascript
+  # - rust
 
 # fail_fast: false          # default: false (run-all-report-all)
 # log_format: json          # default: json | options: json, human
diff --git a/github-repo-template/.opencode/agents.yaml b/github-repo-template/.opencode/agents.yaml
@@ -24,6 +24,10 @@ agents:
       6. Use the shared logging library. No raw `echo` for status messages. Use
          `log_info`, `log_warn`, `log_error`, `log_debug`, and `die` from
          `lib/log.sh`.
+      7. Never suppress failing checks. When a lint, format, security, or test
+         check fails, fix the underlying issue. Never comment out code, add
+         suppression annotations, disable rules, or mark CI jobs as
+         allowed-to-fail to bypass a failing check.
 
       Quick Reference:
 
diff --git a/github-repo-template/.pre-commit-config.yaml b/github-repo-template/.pre-commit-config.yaml
@@ -71,6 +71,16 @@ repos:
   #   hooks:
   #     - id: prettier
 
+  # --- Rust (uncomment if languages includes rust) ---
+  # Formatting and linting with cargo
+  # - repo: https://github.com/AndrejOrsula/pre-commit-cargo
+  #   rev: v0.4.0
+  #   hooks:
+  #     - id: cargo-fmt
+  #       args: ["--all", "--", "--check"]
+  #     - id: cargo-clippy
+  #       args: ["--all-targets", "--all-features", "--workspace", "--", "-D", "warnings"]
+
   # --- Secret Detection ---
   # Detects hardcoded secrets, API keys, and credentials in code
   - repo: https://github.com/gitleaks/gitleaks
diff --git a/github-repo-template/AGENTS.md b/github-repo-template/AGENTS.md
@@ -11,6 +11,7 @@ See DEVELOPMENT.md for the complete reference.
 4. **Respect `.editorconfig`.** Never override formatting rules (indent style, line endings, trailing whitespace) without explicit instruction.
 5. **Write idempotent scripts.** Every script must be safe to re-run. Check before acting: `command -v tool || install_tool`, `mkdir -p`, guard file writes with existence checks.
 6. **Use the shared logging library.** No raw `echo` for status messages. Use `log_info`, `log_warn`, `log_error`, `log_debug`, and `die` from `lib/log.sh`.
+7. **Never suppress failing checks.** When a lint, format, security, or test check fails, fix the underlying issue. Never comment out code, add suppression annotations, disable rules, or mark CI jobs as allowed-to-fail to bypass a failing check.
 
 ## Quick Reference
 
diff --git a/github-repo-template/CLAUDE.md b/github-repo-template/CLAUDE.md
@@ -11,6 +11,7 @@ See DEVELOPMENT.md for the complete reference.
 4. **Respect `.editorconfig`.** Never override formatting rules (indent style, line endings, trailing whitespace) without explicit instruction.
 5. **Write idempotent scripts.** Every script must be safe to re-run. Check before acting: `command -v tool || install_tool`, `mkdir -p`, guard file writes with existence checks.
 6. **Use the shared logging library.** No raw `echo` for status messages. Use `log_info`, `log_warn`, `log_error`, `log_debug`, and `die` from `lib/log.sh`.
+7. **Never suppress failing checks.** When a lint, format, security, or test check fails, fix the underlying issue. Never comment out code, add suppression annotations, disable rules, or mark CI jobs as allowed-to-fail to bypass a failing check.
 
 ## Quick Reference
 
diff --git a/gitlab-repo-template/.cursorrules b/gitlab-repo-template/.cursorrules
@@ -19,6 +19,10 @@ Critical Rules:
 6. Use the shared logging library. No raw `echo` for status messages. Use
    `log_info`, `log_warn`, `log_error`, `log_debug`, and `die` from
    `lib/log.sh`.
+7. Never suppress failing checks. When a lint, format, security, or test
+   check fails, fix the underlying issue. Never comment out code, add
+   suppression annotations, disable rules, or mark CI jobs as
+   allowed-to-fail to bypass a failing check.
 
 Quick Reference:
 
diff --git a/gitlab-repo-template/.devrail.yml b/gitlab-repo-template/.devrail.yml
@@ -9,6 +9,7 @@ languages:
   # - ruby
   # - go
   # - javascript
+  # - rust
 
 # fail_fast: false          # default: false (run-all-report-all)
 # log_format: json          # default: json | options: json, human
diff --git a/gitlab-repo-template/.opencode/agents.yaml b/gitlab-repo-template/.opencode/agents.yaml
@@ -24,6 +24,10 @@ agents:
       6. Use the shared logging library. No raw `echo` for status messages. Use
          `log_info`, `log_warn`, `log_error`, `log_debug`, and `die` from
          `lib/log.sh`.
+      7. Never suppress failing checks. When a lint, format, security, or test
+         check fails, fix the underlying issue. Never comment out code, add
+         suppression annotations, disable rules, or mark CI jobs as
+         allowed-to-fail to bypass a failing check.
 
       Quick Reference:
 
diff --git a/gitlab-repo-template/.pre-commit-config.yaml b/gitlab-repo-template/.pre-commit-config.yaml
@@ -71,6 +71,16 @@ repos:
   #   hooks:
   #     - id: prettier
 
+  # --- Rust (uncomment if languages includes rust) ---
+  # Formatting and linting with cargo
+  # - repo: https://github.com/AndrejOrsula/pre-commit-cargo
+  #   rev: v0.4.0
+  #   hooks:
+  #     - id: cargo-fmt
+  #       args: ["--all", "--", "--check"]
+  #     - id: cargo-clippy
+  #       args: ["--all-targets", "--all-features", "--workspace", "--", "-D", "warnings"]
+
   # --- Secret Detection ---
   # Detects hardcoded secrets, API keys, and credentials in code
   - repo: https://github.com/gitleaks/gitleaks
diff --git a/gitlab-repo-template/AGENTS.md b/gitlab-repo-template/AGENTS.md
@@ -11,6 +11,7 @@ See DEVELOPMENT.md for the complete reference.
 4. **Respect `.editorconfig`.** Never override formatting rules (indent style, line endings, trailing whitespace) without explicit instruction.
 5. **Write idempotent scripts.** Every script must be safe to re-run. Check before acting: `command -v tool || install_tool`, `mkdir -p`, guard file writes with existence checks.
 6. **Use the shared logging library.** No raw `echo` for status messages. Use `log_info`, `log_warn`, `log_error`, `log_debug`, and `die` from `lib/log.sh`.
+7. **Never suppress failing checks.** When a lint, format, security, or test check fails, fix the underlying issue. Never comment out code, add suppression annotations, disable rules, or mark CI jobs as allowed-to-fail to bypass a failing check.
 
 ## Quick Reference
 
diff --git a/gitlab-repo-template/CLAUDE.md b/gitlab-repo-template/CLAUDE.md
@@ -11,6 +11,7 @@ See DEVELOPMENT.md for the complete reference.
 4. **Respect `.editorconfig`.** Never override formatting rules (indent style, line endings, trailing whitespace) without explicit instruction.
 5. **Write idempotent scripts.** Every script must be safe to re-run. Check before acting: `command -v tool || install_tool`, `mkdir -p`, guard file writes with existence checks.
 6. **Use the shared logging library.** No raw `echo` for status messages. Use `log_info`, `log_warn`, `log_error`, `log_debug`, and `die` from `lib/log.sh`.
+7. **Never suppress failing checks.** When a lint, format, security, or test check fails, fix the underlying issue. Never comment out code, add suppression annotations, disable rules, or mark CI jobs as allowed-to-fail to bypass a failing check.
 
 ## Quick Reference
 
diff --git a/pre-commit-conventional-commits/.cursorrules b/pre-commit-conventional-commits/.cursorrules
@@ -19,6 +19,10 @@ Critical Rules:
 6. Use the shared logging library. No raw `echo` for status messages. Use
    `log_info`, `log_warn`, `log_error`, `log_debug`, and `die` from
    `lib/log.sh`.
+7. Never suppress failing checks. When a lint, format, security, or test
+   check fails, fix the underlying issue. Never comment out code, add
+   suppression annotations, disable rules, or mark CI jobs as
+   allowed-to-fail to bypass a failing check.
 
 Quick Reference:
 
diff --git a/pre-commit-conventional-commits/.opencode/agents.yaml b/pre-commit-conventional-commits/.opencode/agents.yaml
@@ -24,6 +24,10 @@ agents:
       6. Use the shared logging library. No raw `echo` for status messages. Use
          `log_info`, `log_warn`, `log_error`, `log_debug`, and `die` from
          `lib/log.sh`.
+      7. Never suppress failing checks. When a lint, format, security, or test
+         check fails, fix the underlying issue. Never comment out code, add
+         suppression annotations, disable rules, or mark CI jobs as
+         allowed-to-fail to bypass a failing check.
 
       Quick Reference:
 
diff --git a/pre-commit-conventional-commits/AGENTS.md b/pre-commit-conventional-commits/AGENTS.md
@@ -11,6 +11,7 @@ See DEVELOPMENT.md for the complete reference.
 4. **Respect `.editorconfig`.** Never override formatting rules (indent style, line endings, trailing whitespace) without explicit instruction.
 5. **Write idempotent scripts.** Every script must be safe to re-run. Check before acting: `command -v tool || install_tool`, `mkdir -p`, guard file writes with existence checks.
 6. **Use the shared logging library.** No raw `echo` for status messages. Use `log_info`, `log_warn`, `log_error`, `log_debug`, and `die` from `lib/log.sh`.
+7. **Never suppress failing checks.** When a lint, format, security, or test check fails, fix the underlying issue. Never comment out code, add suppression annotations, disable rules, or mark CI jobs as allowed-to-fail to bypass a failing check.
 
 ## Quick Reference
 
diff --git a/pre-commit-conventional-commits/CLAUDE.md b/pre-commit-conventional-commits/CLAUDE.md
@@ -11,6 +11,7 @@ See DEVELOPMENT.md for the complete reference.
 4. **Respect `.editorconfig`.** Never override formatting rules (indent style, line endings, trailing whitespace) without explicit instruction.
 5. **Write idempotent scripts.** Every script must be safe to re-run. Check before acting: `command -v tool || install_tool`, `mkdir -p`, guard file writes with existence checks.
 6. **Use the shared logging library.** No raw `echo` for status messages. Use `log_info`, `log_warn`, `log_error`, `log_debug`, and `die` from `lib/log.sh`.
+7. **Never suppress failing checks.** When a lint, format, security, or test check fails, fix the underlying issue. Never comment out code, add suppression annotations, disable rules, or mark CI jobs as allowed-to-fail to bypass a failing check.
 
 ## Quick Reference
 
diff --git a/standards/agent-instructions.md b/standards/agent-instructions.md
diff --git a/standards/coding-practices.md b/standards/coding-practices.md
diff --git a/standards/devrail-yml-schema.md b/standards/devrail-yml-schema.md
diff --git a/standards/rust.md b/standards/rust.md
