ci: run the affordable gate set on push and publish at the tag

Assisted-by: DeepSeek V4.1 Flash

justfile

@@ -1,8 +1,9 @@
-# gasm-sdk.
+# gasm-sdk: Go's Plan 9 assembler and the tooling around it.
 #
-# Replace gasm-sdk here and the values in the variable block. Everything below the block
-# is the standard recipe set: the names and their meanings are fixed, identical in every
-# repository, and `gates` is the definition of done.
+# A binary: `just install` copies gasm into bindir. Everything below the variable block
+# is the standard recipe set: the names and their meanings are fixed, and `gates` is the
+# definition of done. link-parity, install-man, uninstall-man and gen are the project
+# extensions.
 binary := "gasm"
 package := "./cmd/gasm"
 
@@ -12,6 +13,16 @@ package := "./cmd/gasm"
 # failure, not an empty run.
 packages := "./arch/... ./asm/... ./ast/... ./disasm/... ./format/... ./lexer/... ./lint/... ./lsp/... ./parser/... ./token/... ./verify/..."
 
+# The memory fence for the test recipes: a cgroup ceiling with swap off, so a
+# runaway run dies at the ceiling as a failed run and never eats the machine. 4G is the
+# default; raise it only with a reason recorded here.
+memlimit := "4G"
+
+# The race recipe's own fence: with the logic packages run in parallel the race
+# footprint peaks over 8G (8G died in the parser package, 16G passed, measured
+# 2026-10-02), and the wide machine at the keyboard can carry it.
+racememlimit := "16G"
+
 bindir := env_var_or_default("BINDIR", env_var("HOME") / ".local" / "bin")
 
 # Where `install-man` puts the gzip-compressed pages (man1 below it). Exported because
@@ -21,22 +32,23 @@ export MANDIR := env_var_or_default("MANDIR", env_var("HOME") / ".local" / "shar
 default:
     @just --list
 
-# Compile. Zero errors, zero warnings.
+# Compile. Zero errors, zero warnings; -trimpath and -buildvcs=true make the binary place-independent and version-stamped.
 build:
-    CGO_ENABLED=0 go build -ldflags "-s -w" -o bin/{{binary}} {{package}}
+    CGO_ENABLED=0 go build -trimpath -buildvcs=true -ldflags "-s -w" -o bin/{{binary}} {{package}}
 
-# The test gate: the suite, no cache, the coverage floor.
+# The test gate: the full suite, no cache, the coverage floor, under the memory fence.
 test:
     #!/usr/bin/env perl
-    my @fence = qw{systemd-run --user --scope -p MemoryMax=4G -p MemorySwapMax=0};
-    system(@fence, q{go}, q{test}, q{-count=1}, q{-timeout}, q{10m},
+    my @fence = (q{systemd-run}, q{--user}, q{--scope},
+                 q{-p}, q{MemoryMax={{memlimit}}}, q{-p}, q{MemorySwapMax=0});
+    system(@fence, q{go}, q{test}, q{-count=1}, q{-timeout}, q{0},
       q{-coverprofile}, q{coverage.out}, qw({{packages}})) == 0
       or die qq{the test suite failed\n};
     # The packages outside the coverage set carry tests of their own: the CLI's
     # exit codes and manual-page guard, and the debugger's architecture-neutral
     # units.  They run without a profile, because a thin main and a ptrace-bound
     # package would drag the floor down rather than measure the product.
-    system(@fence, q{go}, q{test}, q{-count=1}, q{-timeout}, q{10m},
+    system(@fence, q{go}, q{test}, q{-count=1}, q{-timeout}, q{0},
       q{./cmd/...}, q{./debug/...}) == 0
       or die qq{the tests outside the coverage set failed\n};
     open(my $c, q{-|}, q{go}, q{tool}, q{cover}, q{-func=coverage.out}) or die qq{cover: $!};
@@ -47,28 +59,25 @@ test:
     printf qq{Total coverage: %s%%\n}, $total;
     exit($total < 80 ? 1 : 0);
 
-# The same suite under the race detector. The expensive one.
+# The same suite under the race detector. The expensive one, still fenced.
 race:
-    # Ceiling 16G, not the default 4G: with every package in parallel the race
-    # footprint peaks over 8G (8G died in the parser package, 16G passed,
-    # measured 2026-10-02), and the wide machine at the keyboard can carry it.
-    systemd-run --user --scope -p MemoryMax=16G -p MemorySwapMax=0 go test -race -count=1 -timeout 10m {{packages}}
+    systemd-run --user --scope -p MemoryMax={{racememlimit}} -p MemorySwapMax=0 go test -race -count=1 -timeout 0 {{packages}}
 
 # Fast scoped run for iterating. This is the one that runs after every edit.
 unit pkgs=packages run=".*":
-    systemd-run --user --scope -p MemoryMax=4G -p MemorySwapMax=0 go test {{pkgs}} -run '{{run}}'
+    systemd-run --user --scope -p MemoryMax={{memlimit}} -p MemorySwapMax=0 go test -timeout 0 {{pkgs}} -run '{{run}}'
 
 # Time-boxed fuzz of one target in one package. The package is required; never a gate.
 fuzz target pkg fuzztime="60s":
-    systemd-run --user --scope -p MemoryMax=4G -p MemorySwapMax=0 go test -run '^$' -fuzz '{{target}}' -fuzztime={{fuzztime}} {{pkg}}
+    systemd-run --user --scope -p MemoryMax={{memlimit}} -p MemorySwapMax=0 go test -timeout 0 -run '^$' -fuzz '{{target}}' -fuzztime={{fuzztime}} {{pkg}}
 
-# The cmd/link GOOBJ parity gate, opt-in: the per-push pipeline cannot afford it.
+# The cmd/link GOOBJ parity gate, opt-in: it costs minutes no pipeline can afford.
 link-parity:
-    systemd-run --user --scope -p MemoryMax=4G -p MemorySwapMax=0 env GASM_LINK_PARITY=1 go test -count=1 -timeout 10m -run 'TestGOOBJLinkRegression' ./verify/
+    systemd-run --user --scope -p MemoryMax={{memlimit}} -p MemorySwapMax=0 env GASM_LINK_PARITY=1 go test -count=1 -timeout 0 -run 'TestGOOBJLinkRegression' ./verify/
 
-# Benchmarks. On an idle machine only.
+# Benchmarks. On an idle machine only, and deliberately unfenced.
 bench pkgs=packages:
-    go test -run '^$' -bench=. -benchmem -count=5 {{pkgs}}
+    go test -timeout 0 -run '^$' -bench=. -benchmem -count=5 {{pkgs}}
 
 # Format in place.
 fmt: