Format check is green on unformatted tracked code: cargo fmt --all covers 1 of the repo's 4 workspaces

[avrabe]

The required Format check runs cargo fmt --all -- --check. --all means "all members of this workspace" — not "all crates in the repo". The repo has four workspaces:

$ grep -rn "^\[workspace\]" --include=Cargo.toml .
Cargo.toml:1
codegen-exec-oracle/Cargo.toml:13
codegen-kiln-oracle/Cargo.toml:20
fuzz/Cargo.toml:13

The three nested ones each carry their own [workspace] table, which makes them separate workspaces. cargo fmt --all from the root never opens them.

This is live on HEAD, not hypothetical

$ cargo fmt --all -- --check                              ; echo $?
0
$ cargo fmt --manifest-path fuzz/Cargo.toml -- --check    ; echo $?
1                                        # 13 diff lines
$ cargo fmt --manifest-path codegen-exec-oracle/Cargo.toml -- --check ; echo $?
0
$ cargo fmt --manifest-path codegen-kiln-oracle/Cargo.toml -- --check ; echo $?
0

The drift is in a tracked file, fuzz/fuzz_targets/fuzz_codegen_roundtrip.rs:32:

-    let sf = spar_base_db::SourceFile::new(
-        &db,
-        "fuzz.aadl".to_string(),
-        SEED_AADL.to_string(),
-    );
+    let sf = spar_base_db::SourceFile::new(&db, "fuzz.aadl".to_string(), SEED_AADL.to_string());

So a required status check named Format has been reporting green over unformatted tracked Rust. Nothing in CI has ever formatted fuzz/.

Why it matters more than the diff

Format is one of only five required contexts that survive code=false in the change filter, so it is one of the few things always running — and it has a hole in it. The scope mismatch is silent by construction: --all sounds exhaustive, and cargo reports success for the subset it did check. Same shape as #381: the gate answered a narrower question than its name implies, and the narrow answer looks identical to the broad one.

Fix

Extend the fmt job to cover every workspace in the repo, and — more importantly — make the set self-maintaining so a fifth workspace can't be added silently:

- name: Format (all workspaces)
  run: |
    set -euo pipefail
    mapfile -t manifests < <(grep -rl '^\[workspace\]' --include=Cargo.toml . | sort)
    echo "workspaces: ${#manifests[@]}"
    (( ${#manifests[@]} >= 4 )) || { echo "::error::expected >=4 workspaces, found ${#manifests[@]}"; exit 1; }
    for m in "${manifests[@]}"; do
      echo "--- $m"
      cargo fmt --manifest-path "$m" --all -- --check
    done

The count assertion is the part that matters: discovering the manifests is what makes it exhaustive, and the floor check is what makes a discovery failure loud instead of green.

The same scope gap applies to Clippy (cargo clippy --workspace) — the three nested crates are never linted. The workflow-level RUSTFLAGS: -D warnings means codegen-*-oracle still reject rustc warnings during the Codegen job, but fuzz/ gets neither rustc-warning nor clippy coverage. Worth folding into the same fix.

Found by a clean-room audit of all 18 required contexts after #381.