Compile all features in ci

AGENTS.md

@@ -75,6 +75,53 @@ Several crates export items to Swift/Kotlin/Node/Python through UniFFI — `live
 - A new crate that exports UniFFI items needs its own `uniffi.toml`, including `omit_checksums = true` under `[bindings.kotlin]`
   - The Kotlin checksum test is broken on ARM in every UniFFI release this workspace can use; the full explanation lives in `livekit-uniffi/uniffi.toml` and the root `Cargo.toml`
 
+## Feature combinations
+
+`.github/workflows/feature-combinations-curated.yml` is the only job in CI that exercises features in *combination*. A `dep:` that one feature pulls in but the code uses unconditionally, or a `?/` forward that silently no-ops, compiles fine under default features and breaks only for the caller who picks a particular set — nothing else catches that.
+
+**The workflow lists no crate names.** Each crate declares how it wants to be checked, in its own `Cargo.toml` directly below its `[features]` table, and the workflow reads those declarations with `cargo metadata`:
+
+```toml
+[package.metadata.feature-combinations]
+mode = "powerset"   # cargo hack --feature-powerset --depth 2
+```
+
+```toml
+[package.metadata.feature-combinations]
+mode = "curated"    # only the combinations listed below
+check = [
+    ["default"],                    # a plain `cargo check`
+    [],                             # --no-default-features
+    ["native", "rustls-tls-webpki-roots"],
+    ["default", "rustls-tls-webpki-roots"],   # defaults *plus* one
+]
+```
+
+A crate with no such table is not feature-checked at all. Today eleven crates are `"powerset"`, `livekit` and `livekit-api` are `"curated"`, and `livekit-ffi`/`livekit-uniffi` deliberately declare nothing.
+
+- **When adding a workspace crate**, give it `mode = "powerset"` and stop there
+  - Its features are then picked up automatically as they are added, and no CI file changes
+  - Reach for `"curated"` only when the powerset is genuinely too expensive — that is a real loss of coverage, so it needs a reason recorded next to the table
+  - cargo-hack only varies the features of packages it is given. A crate with no table still gets built as a dependency, which makes it easy to assume it is covered when it is not
+- **When adding a feature to a `"curated"` crate** (`livekit`, `livekit-api`), add the configurations a user would plausibly select to that crate's `check` list
+  - A curated crate's new feature is invisible to this job until it is listed there — this is the standing cost of `"curated"`
+  - Each entry is a complete feature set, run as `--no-default-features --features <entry joined by commas>`. Spell defaults as `"default"`, since a bare `[]` already means "no features at all"
+  - Pair the feature with what it realistically ships alongside (a TLS backend together with `native`, say) rather than listing it on its own
+  - Do not add combinations nobody can select — internal `__lk-*` flags and two-TLS-backends-at-once are deliberately absent, and were most of what made the full powerset expensive
+- **Check any change to these tables without building anything.** This prints exactly what CI will do:
+  ```bash
+  cargo metadata --no-deps --format-version 1 | jq -r '
+    .packages[] | .name as $c | .metadata["feature-combinations"] as $fc
+    | select($fc != null)
+    | if $fc.mode == "curated" then ($fc.check[] | "curated  \($c) \(join(","))")
+      else "powerset \($c)" end' | tr -d '\r'
+  ```
+  For a `"powerset"` crate, `cargo hack -p <crate> --feature-powerset --depth 2 --print-command-list check` enumerates the combinations cargo-hack would run
+- The workflow validates the tables before running anything and fails on a typo'd `mode`, a `"curated"` crate with an empty `check`, a `"powerset"` crate carrying a `check` list that would be silently ignored, or either package set resolving to empty. A malformed table fails the job rather than quietly dropping a crate from CI
+- Keep `--depth 2`. `livekit` alone goes from 67 combinations to 232 at depth 3, and pairwise interactions are where these bugs actually live
+- A feature that pulls in `openssl-sys` cannot build for the three Android targets — there is no Android OpenSSL to link against. Add it to their `exclude_features` in the workflow matrix rather than trying to make it work; Android ships rustls (see `ffi-builds.yml`). It is honoured by both halves of the job
+- `livekit-ffi` and `livekit-uniffi` declare no table on purpose: their combinations cost more than everything else in the job combined, because each TLS change rebuilds `livekit` underneath them. Their shipped configurations are covered by `builds.yml` and `ffi-builds.yml` instead
+
 ## Documenting changes
 
 - Changes are documented using [_knope_](https://knope.tech)

libwebrtc/Cargo.toml

@@ -16,6 +16,11 @@ default = []
 # running in your application.
 glib-main-loop = [ "dep:glib" ]
 
+# How CI checks this crate's features, read by
+# `.github/workflows/feature-combinations-curated.yml` via `cargo metadata`.
+[package.metadata.feature-combinations]
+mode = "powerset"
+
 [dependencies]
 log = { workspace = true }
 serde = { workspace = true, features = ["derive"] }

livekit-api/Cargo.toml

@@ -55,6 +55,24 @@ rustls-tls-native-roots = ["livekit-signaling?/rustls-tls-native-roots", "reqwes
 rustls-tls-webpki-roots = ["livekit-signaling?/rustls-tls-webpki-roots", "reqwest?/rustls-tls-webpki-roots"]
 __rustls-tls            = ["livekit-signaling?/__rustls-tls",             "reqwest?/__rustls"]
 
+# Feature combinations checked in CI. See the equivalent table in
+# `livekit/Cargo.toml` for the encoding, and what `mode = "curated"` costs
+# relative to cargo-hack's powerset.
+[package.metadata.feature-combinations]
+mode = "curated"
+check = [
+    ["default"],                                        # a plain `cargo check`
+    [],                                                 # --no-default-features
+    ["access-token"],
+    ["webhooks"],
+    ["services", "native-tls"],
+    ["services", "native-tls-vendored"],
+    ["services", "rustls-tls-webpki-roots"],
+    ["services", "rustls-tls-native-roots"],
+    ["signal-client-native", "rustls-tls-webpki-roots"],
+    ["default", "rustls-tls-webpki-roots"],             # defaults *plus* one
+]
+
 [dependencies]
 livekit-signaling = { workspace = true, optional = true }
 livekit-protocol = { workspace = true }

livekit-common/Cargo.toml

@@ -16,3 +16,9 @@ uniffi = { workspace = true, features = ["scaffolding-ffi-buffer-fns"], optional
 # Exposes this crate's shared FFI type registrations. Enabled transitively by
 # livekit-uniffi so every component borrows one converter per type.
 uniffi = ["dep:uniffi", "dep:bytes"]
+
+# How CI checks this crate's features, read by
+# `.github/workflows/feature-combinations-curated.yml` via `cargo metadata`.
+# `mode = "powerset"` is the full `cargo hack --feature-powerset --depth 2`:
+[package.metadata.feature-combinations]
+mode = "powerset"

livekit-data-stream/Cargo.toml

@@ -10,6 +10,11 @@ repository.workspace = true
 [features]
 test-utils = ["dep:rand"]
 
+# How CI checks this crate's features, read by
+# `.github/workflows/feature-combinations-curated.yml` via `cargo metadata`.
+[package.metadata.feature-combinations]
+mode = "powerset"
+
 [dependencies]
 livekit-common = { workspace = true }
 livekit-protocol = { workspace = true }

livekit-datatrack/Cargo.toml

@@ -28,6 +28,11 @@ indexmap = "2"
 uniffi = ["dep:uniffi", "dep:livekit-common", "livekit-common/uniffi"]
 __fuzz = ["dep:fake"]
 
+# How CI checks this crate's features, read by
+# `.github/workflows/feature-combinations-curated.yml` via `cargo metadata`.
+[package.metadata.feature-combinations]
+mode = "powerset"
+
 [dev-dependencies]
 test-case = "3.3"
 fake = { version = "4.4", features = ["derive"] }

livekit-net/Cargo.toml

@@ -42,6 +42,11 @@ rustls-tls-webpki-roots = [
 ]
 __rustls-tls = ["tokio-tungstenite?/__rustls-tls", "reqwest?/__rustls"]
 
+# How CI checks this crate's features, read by
+# `.github/workflows/feature-combinations-curated.yml` via `cargo metadata`.
+[package.metadata.feature-combinations]
+mode = "powerset"
+
 [dependencies]
 async-trait = "0.1"
 

livekit-protocol/Cargo.toml

@@ -11,3 +11,8 @@ prost = "0.12"
 serde = { workspace = true }
 pbjson = "0.6"
 pbjson-types = "0.6"
+
+# How CI checks this crate's features, read by
+# `.github/workflows/feature-combinations-curated.yml` via `cargo metadata`.
+[package.metadata.feature-combinations]
+mode = "powerset"

livekit-region/Cargo.toml

@@ -9,3 +9,8 @@ readme = "README.md"
 
 [dependencies]
 serde = { workspace = true, features = ["derive"] }
+
+# How CI checks this crate's features, read by
+# `.github/workflows/feature-combinations-curated.yml` via `cargo metadata`.
+[package.metadata.feature-combinations]
+mode = "powerset"

livekit-signaling/Cargo.toml

@@ -23,6 +23,11 @@ rustls-tls-native-roots = ["livekit-net/rustls-tls-native-roots"]
 rustls-tls-webpki-roots = ["livekit-net/rustls-tls-webpki-roots"]
 __rustls-tls            = ["livekit-net/__rustls-tls"]
 
+# How CI checks this crate's features, read by
+# `.github/workflows/feature-combinations-curated.yml` via `cargo metadata`.
+[package.metadata.feature-combinations]
+mode = "powerset"
+
 [dependencies]
 livekit-net = { workspace = true }
 livekit-protocol = { workspace = true }

livekit-token-source/Cargo.toml

@@ -22,6 +22,11 @@ native-tls-vendored     = ["livekit-net/native-tls-vendored"]
 rustls-tls-native-roots = ["livekit-net/rustls-tls-native-roots"]
 rustls-tls-webpki-roots = ["livekit-net/rustls-tls-webpki-roots"]
 
+# How CI checks this crate's features, read by
+# `.github/workflows/feature-combinations-curated.yml` via `cargo metadata`.
+[package.metadata.feature-combinations]
+mode = "powerset"
+
 [dependencies]
 async-trait = "0.1"
 base64 = { version = "0.21", features = ["std"] }

livekit-token/Cargo.toml

@@ -18,3 +18,8 @@ sha2 = "0.10"
 jsonwebtoken = { version = "10", default-features = false }
 hmac = "0.12"
 signature = "2"
+
+# How CI checks this crate's features, read by
+# `.github/workflows/feature-combinations-curated.yml` via `cargo metadata`.
+[package.metadata.feature-combinations]
+mode = "powerset"

livekit/Cargo.toml

@@ -32,6 +32,25 @@ __rustls-tls = ["livekit-signaling/__rustls-tls"]
 __lk-internal = [] # internal features (used by livekit-ffi)
 __lk-e2e-test = ["livekit-data-stream/test-utils"] # end-to-end testing with a LiveKit server
 
+# How CI checks this crate's features, read by
+# `.github/workflows/feature-combinations-curated.yml` via `cargo metadata`.
+#
+# Each entry is a complete feature set, run as
+# `cargo check --no-default-features --features <entry joined by commas>`.
+[package.metadata.feature-combinations]
+mode = "curated"
+check = [
+    ["default"],                                        # a plain `cargo check`
+    [],                                                 # --no-default-features
+    ["native"],
+    ["native", "native-tls"],
+    ["native", "native-tls-vendored"],
+    ["native", "rustls-tls-native-roots"],
+    ["native", "rustls-tls-webpki-roots"],
+    ["native", "rustls-tls-webpki-roots", "glib-main-loop"],
+    ["native", "__lk-internal"],
+]
+
 [dependencies]
 livekit-signaling = { workspace = true }
 libwebrtc = { workspace = true }

webrtc-sys/Cargo.toml

@@ -10,6 +10,11 @@ repository.workspace = true
 [features]
 default = []
 
+# How CI checks this crate's features, read by
+# `.github/workflows/feature-combinations-curated.yml` via `cargo metadata`.
+[package.metadata.feature-combinations]
+mode = "powerset"
+
 [dependencies]
 cxx = "1.0"
 log = { workspace = true }