ci(container): [#2670] build the shipped binaries without test features

.dockerignore

@@ -42,6 +42,7 @@
 !/contrib/dev-tools/checks/clippy-allow-reasons/
 !/contrib/dev-tools/checks/frontmatter-validator/
 !/contrib/dev-tools/checks/package-coverage-check/
+!/contrib/dev-tools/checks/shipped-features-check/
 !/contrib/dev-tools/github/github-review-threads/
 
 # ── Re-exclusions inside admitted directories ─────────────────────────────────

.github/workflows/testing.yaml

@@ -164,6 +164,31 @@ jobs:
         name: Check layer boundary bans
         run: cargo deny check bans
 
+  # issue: #2670
+  # Rule A.5 of ADR 20261021190318: a `testing` feature of a workspace package must not be enabled in the
+  # dependency tree of a shipped package. The check reads `cargo tree` for the edges and features of
+  # `cargo build -p <package>`, so it ignores the dev-dependencies that `--tests` would enable. Keep the
+  # package (and, once the shipped build names any, its features) in step with the "Build Shipped
+  # (release)" and "Build Shipped (debug)" stages of the `Containerfile`.
+  shipped-features:
+    name: Shipped Features
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - id: checkout
+        name: Checkout Repository
+        uses: actions/checkout@v7.0.1
+
+      - id: setup
+        name: Setup Toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: stable
+
+      - id: check
+        name: Check Shipped Features
+        run: cargo run --quiet --package shipped-features-check -- --package torrust-tracker
+
   # issue: #2582
   # Packages every workspace member so a crate that cannot be published (for example a versioned
   # dependency that crates.io cannot resolve) fails here instead of at publish time. `--no-verify`

AGENTS.md

@@ -118,6 +118,7 @@ package's `Cargo.toml` holds its version. Rows marked _(unpublished)_ set `publi
 | `checks/clippy-allow-reasons`         | `clippy-allow-reasons`         | Validates documented Clippy allow attributes               |
 | `checks/frontmatter-validator`        | `frontmatter-validator`        | Validates Markdown frontmatter                             |
 | `checks/package-coverage-check`       | `package-coverage-check`       | Checks changed workspace packages for coverage regressions |
+| `checks/shipped-features-check`       | `shipped-features-check`       | Fails if a `testing` feature reaches a shipped binary      |
 | `github/github-review-threads`        | `github-review-threads`        | Fetches pull-request review threads through the GitHub CLI |
 
 **Community contributions** (under `contrib/`):

Cargo.toml

@@ -147,6 +147,7 @@ members = [
   "contrib/dev-tools/checks/clippy-allow-reasons",
   "contrib/dev-tools/checks/frontmatter-validator",
   "contrib/dev-tools/checks/package-coverage-check",
+  "contrib/dev-tools/checks/shipped-features-check",
   "contrib/dev-tools/github/github-review-threads",
   "packages/axum-health-check-api-server",
   "packages/axum-http-server",

Containerfile

@@ -121,6 +121,51 @@ RUN cargo nextest archive --tests --all-features \
     --archive-file /build/temp.tar.zst --release && rm -f /build/temp.tar.zst
 
 
+# The binaries that ship are built by `cargo build` invocations of their own, never taken from the
+# nextest archives above: `--tests` and `--all-features` enable dev-dependency features and every
+# feature, which would ship every `testing` feature (ADR 20261021190318, rule A.5). The shipped
+# builds use no test flag and name no feature, because the shipped packages need none today; name
+# any feature they need explicitly here and in the "Shipped Features" job of
+# `.github/workflows/testing.yaml`, which checks that no `testing` feature reaches the build.
+#
+# The cook stages stack on the third-party layers of the test cooks, so third-party crates whose
+# features do not differ are compiled once; they only rebuild when the external dependencies change.
+
+## Cook Third-party Shipped (debug)
+FROM dependencies_thirdparty_debug AS dependencies_shipped_thirdparty_debug
+WORKDIR /build/src
+RUN cargo chef cook --package torrust-tracker --bin torrust-tracker --recipe-path /build/recipe.json
+
+## Cook Shipped (debug)
+FROM dependencies_shipped_thirdparty_debug AS dependencies_shipped_debug
+WORKDIR /build/src
+COPY --from=recipe /build/recipe.json /build/recipe.json
+RUN cargo chef cook --package torrust-tracker --bin torrust-tracker --recipe-path /build/recipe.json
+
+## Cook Third-party Shipped (release)
+FROM dependencies_thirdparty AS dependencies_shipped_thirdparty
+WORKDIR /build/src
+RUN cargo chef cook --release --package torrust-tracker --bins --recipe-path /build/recipe.json
+
+## Cook Shipped (release)
+FROM dependencies_shipped_thirdparty AS dependencies_shipped
+WORKDIR /build/src
+COPY --from=recipe /build/recipe.json /build/recipe.json
+RUN cargo chef cook --release --package torrust-tracker --bins --recipe-path /build/recipe.json
+
+## Build Shipped (debug)
+FROM dependencies_shipped_debug AS build_shipped_debug
+WORKDIR /build/src
+COPY . /build/src
+RUN cargo build --package torrust-tracker --bin torrust-tracker
+
+## Build Shipped (release)
+FROM dependencies_shipped AS build_shipped
+WORKDIR /build/src
+COPY . /build/src
+RUN cargo build --release --package torrust-tracker --bins
+
+
 ## Build Archive (debug)
 FROM dependencies_debug AS build_debug
 WORKDIR /build/src
@@ -145,10 +190,10 @@ COPY --from=build_debug \
   /test/torrust-tracker-debug.tar.zst
 RUN cargo nextest run --workspace-remap /test/src/ --extract-to /test/src/ --no-run --archive-file /test/torrust-tracker-debug.tar.zst
 RUN mkdir -p /test/src/storage/tracker/lib/database
-RUN cargo nextest run --workspace-remap /test/src/ --target-dir-remap /test/src/target/ --cargo-metadata /test/src/target/nextest/cargo-metadata.json --binaries-metadata /test/src/target/nextest/binaries-metadata.json
+# The native-tracker tests start the shipped binary, not the one built with the test features.
+COPY --from=build_shipped_debug /build/src/target/debug/torrust-tracker /app/bin/torrust-tracker
+RUN TORRUST_TRACKER_BINARY=/app/bin/torrust-tracker cargo nextest run --workspace-remap /test/src/ --target-dir-remap /test/src/target/ --cargo-metadata /test/src/target/nextest/cargo-metadata.json --binaries-metadata /test/src/target/nextest/binaries-metadata.json
 
-RUN time mkdir -p /app/bin/ \
- && time cp -l /test/src/target/debug/torrust-tracker /app/bin/torrust-tracker
 RUN time mkdir /app/lib/ \
  && time cp -l $(realpath $(ldd /app/bin/torrust-tracker | grep "libz\.so\.1" | awk '{print $3}')) /app/lib/libz.so.1
 RUN time chown -R root:root /app \
@@ -164,11 +209,13 @@ COPY --from=build \
   /test/torrust-tracker.tar.zst
 RUN cargo nextest run --workspace-remap /test/src/ --extract-to /test/src/ --no-run --archive-file /test/torrust-tracker.tar.zst
 RUN mkdir -p /test/src/storage/tracker/lib/database
-RUN cargo nextest run --workspace-remap /test/src/ --target-dir-remap /test/src/target/ --cargo-metadata /test/src/target/nextest/cargo-metadata.json --binaries-metadata /test/src/target/nextest/binaries-metadata.json
+# The native-tracker tests start the shipped binary, not the one built with the test features.
+COPY --from=build_shipped \
+  /build/src/target/release/torrust-tracker \
+  /build/src/target/release/http_health_check \
+  /app/bin/
+RUN TORRUST_TRACKER_BINARY=/app/bin/torrust-tracker cargo nextest run --workspace-remap /test/src/ --target-dir-remap /test/src/target/ --cargo-metadata /test/src/target/nextest/cargo-metadata.json --binaries-metadata /test/src/target/nextest/binaries-metadata.json
 
-RUN time mkdir -p /app/bin/ \
- && time cp -l /test/src/target/release/torrust-tracker /app/bin/torrust-tracker \
- && time cp -l /test/src/target/release/http_health_check /app/bin/http_health_check
 RUN time mkdir -p /app/lib/ \
  && time cp -l $(realpath $(ldd /app/bin/torrust-tracker | grep "libz\.so\.1" | awk '{print $3}')) /app/lib/libz.so.1
 RUN time chown -R root:root /app \

contrib/dev-tools/checks/shipped-features-check/Cargo.toml

@@ -0,0 +1,19 @@
+[package]
+description = "Fails when a workspace `testing` feature is enabled in the dependency tree of a shipped package."
+name = "shipped-features-check"
+publish = false
+
+authors.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+version = "0.1.0"
+
+[lints]
+workspace = true
+
+[dependencies]
+serde = { version = "1", features = [ "derive" ] }
+serde_json = "1"
+
+[dev-dependencies]
+tempfile = "3"