✨ Build an importable election event from a workbook, in the shared core

.github/workflows/tests.yml

@@ -10,6 +10,70 @@ on:
     branches: [ 'main', 'release/[0-9]+.[0-9]+' ]
 
 jobs:
+  # sequent-core is compiled against a different feature set by nearly every
+  # consumer, and a module gated one way with its re-export gated another only
+  # fails for the sets nobody happens to build locally: `cargo build --workspace`
+  # unifies features across the graph and hides it entirely. That is exactly how
+  # an ungated `pub use build::{…}` reached CI and reddened fourteen jobs in the
+  # slow suites below, each of which reports it as its own failure.
+  #
+  # `--lib` rather than `--all-targets`: the question is whether the library
+  # compiles for a consumer that asked for this much and no more. The test
+  # modules need `default_features` and are covered by the suites below.
+  #
+  # This job is `cargo check` only, so it finishes in a couple of minutes and
+  # names the gate that broke.
+  feature-gates:
+    name: sequent-core at ${{ matrix.gate }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    # This job reads code and runs `cargo check`. Without a block it inherits the
+    # repository default, which can include write scopes.
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - gate: no features
+            cache: none
+            features: ""
+          - gate: default_features
+            cache: default
+            features: --features default_features
+          - gate: keycloak,default_features
+            cache: keycloak
+            features: --features keycloak,default_features
+          - gate: election_config_templates
+            cache: templates
+            features: --features election_config_templates
+          - gate: election_config_archive
+            cache: archive
+            features: --features election_config_archive
+          - gate: election_config_xlsx
+            cache: xlsx
+            features: --features election_config_xlsx
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+        with:
+          # Or the job token stays in .git/config, readable by every later step.
+          persist-credentials: false
+
+      - name: Set up Rust tests
+        uses: ./.github/actions/setup-rust-tests
+        with:
+          # Per gate, or six jobs would evict each other's artifacts all day.
+          cargo-build-name: sequent-core-${{ matrix.cache }}
+          cargo-build-path: packages/target
+          cargo-lock-path: packages/Cargo.lock
+
+      - name: cargo check ${{ matrix.gate }}
+        env:
+          PROTOC: "/usr/bin/protoc"
+        run: cargo check -p sequent-core --lib ${{ matrix.features }}
+        working-directory: packages
+
   run-tests:
     name: Run Rust tests
     runs-on: ubuntu-24.04

packages/sequent-core/Cargo.toml

@@ -124,6 +124,20 @@ kuchiki = { version = "0.8", optional = true }
 rusqlite = { version = "0.32", features = ["bundled"], optional = true }
 csv = "1.3.0"
 
+# reading authoring spreadsheets; optional so front ends with no workbook to read
+# do not carry it into their WASM bundle
+calamine = { version = "0.26", features = ["dates"], optional = true }
+
+# uuid5 for the deterministic ids a generated bundle uses. The `uuid` crate is not
+# used for this: its v4 feature pulls getrandom, whose WASM support is version
+# specific and already pinned elsewhere in this workspace, and nothing here needs
+# randomness.
+sha1 = { version = "0.10", optional = true }
+
+# writing the importable archive; optional so a front end that only validates a
+# bundle carries no zip writer
+zip = { version = "2.1", optional = true }
+
 
 # WASM plugin management
 wasmtime = {version = "41.0.2", optional = true}
@@ -150,7 +164,17 @@ lambda_inplace = []
 lambda_openwhisk = []
 lambda_aws_lambda = []
 plugins_wit = ["dep:wasmtime", "dep:wasmtime-wasi"]
-default_features = ["dep:strand", "dep:num-bigint", "dep:tempfile", "dep:ammonia"]
+default_features = ["dep:strand", "dep:num-bigint", "dep:tempfile", "dep:ammonia", "dep:sha1"]
+# Reading .xlsx into an election_config::sheet::Workbook. Separate from
+# default_features because admin-portal and voting-portal have no workbook to
+# read and should not pay for a spreadsheet parser in their bundle.
+election_config_xlsx = ["default_features", "dep:calamine", "dep:zip"]
+# Rendering the base entity templates. Separate from `reports`, which also brings
+# a headless browser and three AWS SDKs; this needs only the template engine.
+election_config_templates = ["default_features", "dep:handlebars"]
+# Writing the importable zip. Separate again: a front end that only validates an
+# existing bundle has nothing to write.
+election_config_archive = ["election_config_templates", "dep:zip"]
 
 sqlite = ["dep:tokio", "dep:rusqlite"]
 time = ["dep:time"]

packages/sequent-core/examples/validate_bundle.rs

@@ -0,0 +1,32 @@
+// SPDX-FileCopyrightText: 2026 Sequent Tech Inc <legal@sequentech.io>
+//
+// SPDX-License-Identifier: AGPL-3.0-only
+
+//! Validate an election event bundle from a file.
+//!
+//! `cargo run -p sequent-core --features default_features --example validate_bundle -- <path>`
+//!
+//! A thin harness for checking a real export against the shared rules; the same
+//! call step-cli and the browser make.
+
+use sequent_core::election_config::{validate, ImportElectionEventSchema};
+
+fn main() -> Result<(), Box<dyn std::error::Error>> {
+    let path = std::env::args()
+        .nth(1)
+        .ok_or("usage: validate_bundle <path>")?;
+    let text = std::fs::read_to_string(&path)?;
+    let bundle: ImportElectionEventSchema = serde_json::from_str(&text)?;
+
+    let report = validate(&bundle);
+    print!("{report}");
+    println!(
+        "{} error(s), {} warning(s)",
+        report.errors().count(),
+        report.warnings().count()
+    );
+    if report.has_errors() {
+        std::process::exit(1);
+    }
+    Ok(())
+}