Harden core workflows and accelerate indexing

.cargo/audit.toml

@@ -0,0 +1,4 @@
+[advisories]
+# bincode remains read-only for v0.9 graph compatibility. New snapshots use
+# postcard; remove this exception when legacy graph support is dropped.
+ignore = ["RUSTSEC-2025-0141"]

.github/workflows/release.yml

@@ -22,17 +22,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
         with:
           components: rustfmt, clippy
 
       - name: Cache cargo
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.cargo/registry/index
@@ -53,8 +53,52 @@ jobs:
       - name: Verify generated docs are in sync
         run: cargo run -p xtask -- gen-skill --check
 
+      - name: Enforce v0.9 performance gates
+        run: cargo run -p xtask -- perf-gate
+
+      - name: Audit Rust dependencies
+        uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
+        with:
+          version: 10
+
+      - name: Set up Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: www/pnpm-lock.yaml
+
+      - name: Build website
+        working-directory: www
+        run: |
+          pnpm install --frozen-lockfile
+          pnpm build
+          pnpm audit --audit-level moderate
+
       - name: Check installer syntax
-        run: sh -n install.sh
+        run: |
+          sh -n install.sh
+          shellcheck install.sh
+
+      - name: Check PowerShell installer syntax
+        shell: pwsh
+        run: |
+          $tokens = $null
+          $errors = $null
+          [System.Management.Automation.Language.Parser]::ParseFile(
+            (Resolve-Path install.ps1),
+            [ref]$tokens,
+            [ref]$errors
+          ) | Out-Null
+          if ($errors.Count -gt 0) {
+            $errors | Format-List | Out-String | Write-Error
+            exit 1
+          }
 
       - name: Verify release tag is on main
         if: startsWith(github.ref, 'refs/tags/v')
@@ -67,10 +111,29 @@ jobs:
             exit 1
           fi
 
+  test-platforms:
+    name: Test ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, windows-latest]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
+
+      - name: Test
+        run: cargo test --locked
+
   build:
     name: Build ${{ matrix.name }}
     if: startsWith(github.ref, 'refs/tags/v')
-    needs: check
+    needs: [check, test-platforms]
     strategy:
       fail-fast: false
       matrix:
@@ -99,15 +162,15 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
         with:
           targets: ${{ matrix.target }}
 
       - name: Cache cargo
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.cargo/registry/index
@@ -141,7 +204,7 @@ jobs:
           fi
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{ matrix.archive }}
           path: |
@@ -157,12 +220,27 @@ jobs:
       contents: write
     runs-on: ubuntu-latest
     steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+
       - name: Download release artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           path: release-assets
           merge-multiple: true
 
+      - name: Add installers and checksums
+        run: |
+          cp install.sh install.ps1 release-assets/
+          cd release-assets
+          for asset in *; do
+            if [ "$asset" != "SHA256SUMS" ]; then
+              sha256sum "$asset"
+            fi
+          done > SHA256SUMS
+
       - name: Create or update release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## Unreleased
+
+### Added
+
+- Added v3 graph snapshots with full BLAKE3 payload identities, hydrated search and dependency indexes, and transparent v0.9-v2 loading.
+- Added a reproducible performance gate requiring 20% faster 500-file indexing and warm exact search than v0.9.0.
+- Added release-asset checksum verification to the Unix and Windows installers.
+- Added cross-platform, website, dependency-audit, and installer checks to CI.
+
+### Fixed
+
+- Detect same-size source changes even when file modification times are preserved.
+- Preserve line endings and executable permissions during atomic line edits.
+- Bound newline-delimited MCP messages, headers, and agent-facing result counts.
+- Report one deterministic finding per dependency cycle and downgrade cycles contained within one Rust module family.
+
+### Changed
+
+- Centralized shared CLI/MCP read, patch, create, and audit workflows plus MCP graph lifecycle persistence.
+- Reduced index memory and CPU overhead by removing duplicate content caching and deduplicating word and trigram data.
+- Parallelized parsing and search-index preparation for projects with at least 64 files.
+- Limited exact-word hit materialization to the requested result count.
+- Pinned every external GitHub Action to an immutable full-length commit SHA.
+
 ## v0.9.0 - 2026-06-30
 
 ### Added

Cargo.toml

@@ -18,13 +18,16 @@ serde_json = "1"
 toon-format = { version = "0.5.0", default-features = false }
 toml = "0.8"
 bincode = "1.3"
+postcard = { version = "1", default-features = false, features = ["alloc"] }
+blake3 = "1"
 hashbrown = "0.15"
 walkdir = "2"
 ignore = "0.4"
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["fmt", "env-filter"] }
 anyhow = "1"
 regex = "1"
+rayon = "1"
 notify = "6"
 tree-sitter = "0.24"
 tree-sitter-zig = "1.1"

benches/engine.rs

@@ -1,5 +1,6 @@
 use criterion::{black_box, criterion_group, criterion_main, BatchSize, BenchmarkId, Criterion};
 use lexa::engine::{Engine, SearchOptions};
+use lexa::freshness;
 use lexa::snapshot;
 use lexa::store::Op;
 use std::fs;
@@ -219,6 +220,19 @@ fn bench_snapshot(c: &mut Criterion) {
         });
     });
 
+    group.bench_function("strict_refresh_unchanged", |b| {
+        b.iter_batched(
+            || build_engine_from_project(project.path()),
+            |mut engine| {
+                black_box(
+                    freshness::refresh_project(&mut engine, project.path())
+                        .expect("refresh project"),
+                );
+            },
+            BatchSize::LargeInput,
+        );
+    });
+
     group.finish();
 }
 

docs/install.md

@@ -32,6 +32,8 @@ By default, `upgrade` installs into the directory containing the running `lexa`
 
 `lexa upgrade` updates the binary, not a project index. Use `lexa index .` to refresh a project's graph.
 
+Release installers verify the selected archive against the release's `SHA256SUMS` file before extraction. If checksum verification fails, installation stops without replacing the existing binary.
+
 ## Troubleshooting
 
 If `lexa --version` is unavailable after install, verify that the install directory is on `PATH`.