ci(buildkite): actually ship the step scripts

The previous commit added .buildkite/pipeline.yml but not the scripts it
invokes. `.gitignore` line 59 ignores `*.sh` repo-wide, with negations for
`!scripts/**` and `!.github/scripts/**`; `.buildkite/**` had none, so
`git add .buildkite` staged the YAML and silently dropped all three scripts.
Buildkite proved it:

  $ .buildkite/steps/lint.sh
  /bin/bash: line 1: .buildkite/steps/lint.sh: No such file or directory
  🚨 Error: The command exited with status 127

Add the negation in the same shape as the existing two rather than inlining
the commands into YAML: kept as scripts they stay `bash -n`-checkable and
shellcheck-able, which is how the `Workflow lint` job already treats
`.github/workflows`.

Signed-off-by: CodeWhale Bot <bot@codewhale.net>

.buildkite/steps/common.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Shared setup for Buildkite steps. Sourced, not executed.
+set -euo pipefail
+
+# Hosted Linux agents are bare containers; macOS agents ship Xcode and brew.
+# Only install what the workspace actually links against (dbus, via the
+# keyring/secret-store path) so a step failure is about the code, not apt.
+if [ "$(uname -s)" = "Linux" ]; then
+  SUDO=""
+  command -v sudo >/dev/null 2>&1 && SUDO="sudo"
+  for i in 1 2 3 4 5; do
+    $SUDO apt-get update && break
+    echo "apt-get update failed (attempt $i); retrying in 15s" >&2
+    sleep 15
+  done
+  $SUDO apt-get install -y --no-install-recommends \
+    ca-certificates curl pkg-config libdbus-1-dev build-essential
+fi
+
+# rust-toolchain.toml pins `stable`; rustup honours it on first cargo call.
+if ! command -v cargo >/dev/null 2>&1; then
+  curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
+    | sh -s -- -y --profile minimal --default-toolchain stable
+fi
+# shellcheck disable=SC1091
+[ -f "$HOME/.cargo/env" ] && . "$HOME/.cargo/env"
+
+cargo --version
+rustc --version

.buildkite/steps/lint.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -euo pipefail
+cd "$(dirname "$0")/../.."
+# shellcheck source=/dev/null
+. .buildkite/steps/common.sh
+
+rustup component add rustfmt clippy
+
+echo "--- cargo fmt"
+cargo fmt --all -- --check
+
+# The allow list is copied verbatim from .github/workflows/ci.yml. Keep the two
+# in step: a lint that is denied there and allowed here makes this pipeline a
+# weaker gate that still reports green.
+echo "--- cargo clippy"
+cargo clippy --workspace --all-targets --all-features --locked -- \
+  -D warnings \
+  -A clippy::uninlined_format_args \
+  -A clippy::too_many_arguments \
+  -A clippy::unnecessary_map_or

.buildkite/steps/test.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+set -euo pipefail
+cd "$(dirname "$0")/../.."
+# shellcheck source=/dev/null
+. .buildkite/steps/common.sh
+
+# nextest profile `ci` lives in .config/nextest.toml alongside the test-group
+# bounds that serialize the binary-spawning integration suites.
+if ! command -v cargo-nextest >/dev/null 2>&1; then
+  cargo install cargo-nextest --locked --version 0.9.* || cargo install cargo-nextest --locked
+fi
+
+echo "--- workspace tests"
+cargo nextest run --workspace --all-features --locked --profile ci
+
+echo "--- doctests"
+cargo test --workspace --all-features --locked --doc

.gitignore

@@ -60,6 +60,7 @@ docs/*.pdf
 *.cmd
 !scripts/**
 !.github/scripts/**
+!.buildkite/**
 !web/public/install.sh
 !packaging/winget/**
 test.txt