feat(rust): Phase 1 foundation — workspace, crates, config parity, CI

.changeset/rust-foundation-005.md

@@ -0,0 +1,11 @@
+---
+---
+
+fix(config): name the field whose number does not fit, not a valid neighbour
+
+The loader's numeric walk read a field's type off the serialized defaults, where
+`serialize_js_number` writes an integral `f64` as an integer because that is how
+JavaScript represents it. So a valid `targetEventsPerSecond: 10.5` beside a
+fractional `periodMs` was refused as "must be a whole number" while the actual
+bad field went unreported. Every `f64` the schema declares is now restored to its
+declared type before the walk runs, and a guard test keeps that list complete.

.dockerignore

@@ -18,3 +18,7 @@ postgresql.conf
 test/integration/docker-compose.yml
 # website tooling (not part of the relay image)
 website
+
+# Rust workspace (not part of the relay image)
+crates
+target

.github/workflows/checks.yml

@@ -6,6 +6,7 @@ on:
   push:
     branches:
       - main
+      - rewrite/main
 
 concurrency:
   group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'
@@ -20,6 +21,7 @@ jobs:
       pull-requests: read
     outputs:
       src: ${{ steps.filter.outputs.src }}
+      rust: ${{ steps.filter.outputs.rust }}
     steps:
       - uses: actions/checkout@v4
         with:
@@ -39,6 +41,15 @@ jobs:
               - 'Dockerfile*'
               - 'docker-compose*.yml'
               - '.nvmrc'
+              - 'resources/default-settings.yaml'
+              - '.github/workflows/checks.yml'
+            rust:
+              - 'crates/**'
+              - 'Cargo.toml'
+              - 'Cargo.lock'
+              - 'rust-toolchain.toml'
+              - 'resources/default-settings.yaml'
+              - 'scripts/rust.sh'
               - '.github/workflows/checks.yml'
 
   commit-lint:
@@ -207,6 +218,42 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           parallel-finished: true
 
+  rust-checks:
+    name: Rust Checks
+    runs-on: ubuntu-latest
+    needs: changes
+    if: needs.changes.outputs.rust == 'true'
+    permissions:
+      contents: read
+    steps:
+      # SHA-pinned (v4.4.0) with the workflow token not persisted into the clone — the
+      # other two Rust actions are pinned the same way; the pre-existing Node jobs keep
+      # their own checkout lines.
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      # rust-toolchain.toml is read automatically by the action's discovery (no toolchain-file
+      # input exists; passing one only warns). Both actions are SHA-pinned per the house
+      # convention the docker/* actions below already follow.
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - name: Check formatting
+        run: cargo fmt --all --check
+      - name: Clippy (all targets)
+        run: cargo clippy --workspace --all-targets --all-features -- -D warnings
+      - name: Clippy (strict, lib+bins)
+        run: >-
+          cargo clippy --workspace --lib --bins --all-features --
+          -D warnings -D clippy::unwrap_used -D clippy::expect_used
+          -D clippy::todo -D clippy::unimplemented -D clippy::panic
+      - name: Tests
+        run: cargo test --workspace --all-features
+      - name: Release build
+        run: cargo build --workspace --all-features --release
+
   changeset-check:
     name: Changeset Required
     runs-on: ubuntu-latest

.gitignore

@@ -52,3 +52,6 @@ docker-compose.overrides.yml
 
 # Code coverage report output
 coverage-report/
+
+# Rust
+/target/