From 6066fe65615db94c441f12f369ca40537a4ea621 Mon Sep 17 00:00:00 2001
From: Alex Plotnick <alex@oxidecomputer.com>
Date: Sat, 15 Aug 2026 20:27:16 +0000
Subject: [PATCH] Add a justfile

`just ci` runs what GitHub CI runs, --locked included, so stale
lockfiles and OpenAPI drift fail locally first.

Co-Authored-By: Claude Mythos 5 <noreply@anthropic.com>
---
 .github/workflows/test.yml | 30 +++++++++++-------------------
 justfile                   | 26 ++++++++++++++++++++++++++
 2 files changed, 37 insertions(+), 19 deletions(-)
 create mode 100644 justfile

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 8bedb0b..0ad486e 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -31,22 +31,14 @@ jobs:
         permissions: contents:read
         configure-git: true
 
-    - name: Lint
-      run: |
-        cargo fmt -- --check &&
-        cargo clippy -- --no-deps --deny warnings &&
-        cargo clippy --tests -- --no-deps --deny warnings
-
-    - name: Build
-      run: cargo build --locked
-
-    - name: Install nextest
-      uses: taiki-e/install-action@nextest
+    - name: Install just and nextest
+      uses: taiki-e/install-action@v2
+      with:
+        tool: just,nextest
 
-    - name: Test
-      run: |
-        cargo nextest run --run-ignored all &&
-        cargo test --doc
+    # The recipe is the source of truth shared with local runs.
+    - name: CI
+      run: just ci
 
   # The permslip feature pulls in permission-slip, which is private,
   # so this job only runs where the OIDC exchange can succeed.
@@ -74,8 +66,8 @@ jobs:
         permissions: contents:read
         configure-git: true
 
-    - name: Lint
-      run: cargo clippy --package sush-client --features permslip -- --no-deps --deny warnings
+    - name: Install just
+      uses: taiki-e/install-action@just
 
-    - name: Build
-      run: cargo build --locked --package sush-client --features permslip
+    - name: CI
+      run: just ci-client
diff --git a/justfile b/justfile
new file mode 100644
index 0000000..862a860
--- /dev/null
+++ b/justfile
@@ -0,0 +1,26 @@
+set shell := ["bash", "-euo", "pipefail", "-c"]
+
+check:
+    cargo check --workspace --all-targets
+
+lint:
+    cargo fmt --check && cargo clippy --tests
+
+test *FILTER:
+    cargo nextest run --workspace {{FILTER}}
+
+openapi:
+    cargo xtask openapi
+
+ci:
+    cargo fmt --check
+    cargo clippy -- --no-deps --deny warnings
+    cargo clippy --tests -- --no-deps --deny warnings
+    cargo build --locked
+    cargo nextest run --run-ignored all
+    cargo test --doc
+    cargo xtask openapi && git diff --exit-code sush.json
+
+ci-client:
+    cargo clippy --package sush-client --features permslip -- --no-deps --deny warnings
+    cargo build --locked --package sush-client --features permslip