Refactor/445 realization validation

.github/workflows/audit.yml

@@ -4,13 +4,17 @@ on:
     paths:
       # Run if workflow changes
       - .github/workflows/audit.yml
+      # Run if tool-version source changes
+      - justfile
       # Run on changed dependencies
       - "**/Cargo.toml"
       - "**/Cargo.lock"
   pull_request:
     paths:
       # Run if workflow changes
       - .github/workflows/audit.yml
+      # Run if tool-version source changes
+      - justfile
       # Run on changed dependencies
       - "**/Cargo.toml"
       - "**/Cargo.lock"
@@ -29,8 +33,6 @@ permissions:
 jobs:
   audit:
     runs-on: ubuntu-latest
-    env:
-      CARGO_AUDIT_VERSION: "0.22.2"
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
@@ -43,6 +45,12 @@ jobs:
           cache-bin: false
           # toolchain, components, etc. are specified in rust-toolchain.toml
 
+      - name: Resolve cargo-audit version
+        id: cargo_audit_version
+        run: |
+          version="$(grep '^cargo_audit_version :=' justfile | cut -d '"' -f 2)"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
       - name: Cache audit database
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
@@ -53,7 +61,7 @@ jobs:
       - name: Install cargo-audit
         uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
         with:
-          tool: cargo-audit@${{ env.CARGO_AUDIT_VERSION }}
+          tool: cargo-audit@${{ steps.cargo_audit_version.outputs.version }}
 
       - name: Run cargo audit
         run: |

.github/workflows/benchmarks.yml

@@ -13,6 +13,8 @@ on:
       - main
     # Only run on changes that could affect performance
     paths:
+      - ".github/workflows/benchmarks.yml"
+      - "justfile"
       - "src/**"
       - "benches/**"
       - "Cargo.toml"
@@ -24,6 +26,8 @@ on:
       - main
     # Only run on changes that could affect performance
     paths:
+      - ".github/workflows/benchmarks.yml"
+      - "justfile"
       - "src/**"
       - "benches/**"
       - "Cargo.toml"
@@ -42,7 +46,6 @@ concurrency:
 env:
   CARGO_TERM_COLOR: always
   RUST_BACKTRACE: 1
-  UV_VERSION: "0.11.27"
   BENCHMARK_TIMEOUT: 1800 # 30 min; pre-computed seeds + reduced 5D counts keep runtime well under this
   DELAUNAY_BENCH_DISCOVER_SEEDS_LIMIT: 256 # fallback only; ci_performance_suite uses pre-computed seeds
 
@@ -64,10 +67,16 @@ jobs:
           cache-bin: false
           # Toolchain from rust-toolchain.toml.
 
+      - name: Resolve uv version
+        id: uv_version
+        run: |
+          version="$(grep '^uv_version :=' justfile | cut -d '"' -f 2)"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
       - name: Install uv (Python package manager)
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
-          version: ${{ env.UV_VERSION }}
+          version: ${{ steps.uv_version.outputs.version }}
 
       - name: Verify uv installation
         run: uv --version

.github/workflows/ci.yml

@@ -22,14 +22,6 @@ on:
 env:
   CARGO_TERM_COLOR: always
   RUST_BACKTRACE: 1
-  CARGO_NEXTEST_VERSION: "0.9.140"
-  DPRINT_VERSION: "0.55.1"
-  JUST_VERSION: "1.55.1"
-  RUMDL_VERSION: "0.2.28"
-  TAPLO_VERSION: "0.10.0"
-  TYPOS_VERSION: "1.48.0"
-  UV_VERSION: "0.11.27"
-  ZIZMOR_VERSION: "1.26.1"
 
 jobs:
   build:
@@ -69,61 +61,84 @@ jobs:
           cache-bin: false # Avoid restoring stale rustup/cargo shims from cache.
       # toolchain, components, etc. are specified in rust-toolchain.toml
 
+      - name: Resolve just version
+        id: just_version
+        shell: bash
+        run: |
+          version="$(grep '^just_version :=' justfile | cut -d '"' -f 2)"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - name: Install just
+        uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
+        with:
+          tool: just@${{ steps.just_version.outputs.version }}
+
+      - name: Export tool versions
+        id: tool_versions
+        shell: bash
+        run: |
+          {
+            echo "CARGO_NEXTEST_VERSION=$(just --evaluate nextest_version)"
+            echo "DPRINT_VERSION=$(just --evaluate dprint_version)"
+            echo "RUMDL_VERSION=$(just --evaluate rumdl_version)"
+            echo "TAPLO_VERSION=$(just --evaluate taplo_version)"
+            echo "TYPOS_VERSION=$(just --evaluate typos_version)"
+            echo "UV_VERSION=$(just --evaluate uv_version)"
+            echo "ZIZMOR_VERSION=$(just --evaluate zizmor_version)"
+          } >> "$GITHUB_OUTPUT"
+
       - name: Set up Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version-file: ".python-version"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
-          version: ${{ env.UV_VERSION }}
+          version: ${{ steps.tool_versions.outputs.UV_VERSION }}
           enable-cache: true
 
       - name: Sync Python tooling
         run: uv sync --locked --group dev
 
-      - name: Install just
-        uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
-        with:
-          tool: just@${{ env.JUST_VERSION }}
-
       - name: Install cargo-nextest
         uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
         with:
-          tool: cargo-nextest@${{ env.CARGO_NEXTEST_VERSION }}
+          tool: cargo-nextest@${{ steps.tool_versions.outputs.CARGO_NEXTEST_VERSION }}
 
       - name: Install rumdl (for Markdown linting)
         uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
         with:
-          tool: rumdl@${{ env.RUMDL_VERSION }}
+          tool: rumdl@${{ steps.tool_versions.outputs.RUMDL_VERSION }}
 
       - name: Install dprint (for YAML formatting)
         uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
         with:
-          tool: dprint@${{ env.DPRINT_VERSION }}
+          tool: dprint@${{ steps.tool_versions.outputs.DPRINT_VERSION }}
 
       - name: Install typos-cli
         uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
         with:
-          tool: typos-cli@${{ env.TYPOS_VERSION }}
+          tool: typos-cli@${{ steps.tool_versions.outputs.TYPOS_VERSION }}
 
       - name: Install taplo (for TOML formatting and linting)
         id: install-taplo
         continue-on-error: ${{ matrix.os == 'windows-latest' }}
         uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
         with:
-          tool: taplo-cli@${{ env.TAPLO_VERSION }}
+          tool: taplo-cli@${{ steps.tool_versions.outputs.TAPLO_VERSION }}
 
       - name: Install taplo on Windows after cached install failure
         if: matrix.os == 'windows-latest' && steps.install-taplo.outcome == 'failure'
         shell: pwsh
         run: cargo install --locked taplo-cli --version $env:TAPLO_VERSION
+        env:
+          TAPLO_VERSION: ${{ steps.tool_versions.outputs.TAPLO_VERSION }}
 
       - name: Install zizmor
         uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
         with:
-          tool: zizmor@${{ env.ZIZMOR_VERSION }}
+          tool: zizmor@${{ steps.tool_versions.outputs.ZIZMOR_VERSION }}
 
       - name: Run CI checks
         run: just ci

.github/workflows/codecov.yml

@@ -20,10 +20,6 @@ jobs:
   coverage:
     name: Code Coverage
     runs-on: ubuntu-latest
-    env:
-      CARGO_LLVM_COV_VERSION: "0.8.7"
-      JUST_VERSION: "1.55.1"
-      NEXTEST_VERSION: "0.9.140"
     steps:
       - name: Checkout repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -38,23 +34,37 @@ jobs:
           cache-bin: false
           # toolchain, components, etc. are specified in rust-toolchain.toml
 
-      - name: Install LLVM coverage tools
-        run: rustup component add llvm-tools-preview
+      - name: Resolve just version
+        id: just_version
+        run: |
+          version="$(grep '^just_version :=' justfile | cut -d '"' -f 2)"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
 
-      - name: Install cargo-llvm-cov
+      - name: Install just
         uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
         with:
-          tool: cargo-llvm-cov@${{ env.CARGO_LLVM_COV_VERSION }}
+          tool: just@${{ steps.just_version.outputs.version }}
 
-      - name: Install just
+      - name: Export coverage tool versions
+        id: tool_versions
+        run: |
+          {
+            echo "CARGO_LLVM_COV_VERSION=$(just --evaluate cargo_llvm_cov_version)"
+            echo "CARGO_NEXTEST_VERSION=$(just --evaluate nextest_version)"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Install LLVM coverage tools
+        run: rustup component add llvm-tools-preview
+
+      - name: Install cargo-llvm-cov
         uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
         with:
-          tool: just@${{ env.JUST_VERSION }}
+          tool: cargo-llvm-cov@${{ steps.tool_versions.outputs.CARGO_LLVM_COV_VERSION }}
 
       - name: Install cargo-nextest
         uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
         with:
-          tool: cargo-nextest@${{ env.NEXTEST_VERSION }}
+          tool: cargo-nextest@${{ steps.tool_versions.outputs.CARGO_NEXTEST_VERSION }}
 
       - name: Verify cargo-nextest
         run: cargo nextest --version

.github/workflows/generate-baseline.yml

@@ -26,7 +26,6 @@ permissions:
 env:
   CARGO_TERM_COLOR: always
   RUST_BACKTRACE: 1
-  UV_VERSION: "0.11.27"
   # Seed search limit for both old (pre-v0.8) and current env var names.
   # Old tags read DELAUNAY_BENCH_SEED_SEARCH_LIMIT; current code reads
   # DELAUNAY_BENCH_DISCOVER_SEEDS_LIMIT. Setting both ensures backward
@@ -55,10 +54,16 @@ jobs:
           cache-bin: false
           # Toolchain from rust-toolchain.toml
 
+      - name: Resolve uv version
+        id: uv_version
+        run: |
+          version="$(grep '^uv_version :=' justfile | cut -d '"' -f 2)"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
       - name: Install uv (Python package manager)
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
-          version: ${{ env.UV_VERSION }}
+          version: ${{ steps.uv_version.outputs.version }}
           enable-cache: false
 
       - name: Verify uv installation

.github/workflows/papers.yml

@@ -49,10 +49,6 @@ on:
 
 env:
   CARGO_TERM_COLOR: always
-  JUST_VERSION: "1.55.1"
-  TECTONIC_VERSION: "0.16.9"
-  TEX_FMT_VERSION: "0.5.7"
-  UV_VERSION: "0.11.27"
 
 jobs:
   papers:
@@ -70,15 +66,35 @@ jobs:
           cache: true
           cache-bin: false
 
+      - name: Resolve just version
+        id: just_version
+        run: |
+          version="$(grep '^just_version :=' justfile | cut -d '"' -f 2)"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - name: Install just
+        uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
+        with:
+          tool: just@${{ steps.just_version.outputs.version }}
+
+      - name: Export paper tool versions
+        id: tool_versions
+        run: |
+          {
+            echo "TECTONIC_VERSION=$(just --evaluate tectonic_version)"
+            echo "TEX_FMT_VERSION=$(just --evaluate tex_fmt_version)"
+            echo "UV_VERSION=$(just --evaluate uv_version)"
+          } >> "$GITHUB_OUTPUT"
+
       - name: Set up Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version-file: ".python-version"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
-          version: ${{ env.UV_VERSION }}
+          version: ${{ steps.tool_versions.outputs.UV_VERSION }}
           enable-cache: true
 
       - name: Sync Python tooling
@@ -109,20 +125,15 @@ jobs:
             sudo "$(command -v tlmgr)" install chktex
           fi
 
-      - name: Install just
-        uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
-        with:
-          tool: just@${{ env.JUST_VERSION }}
-
       - name: Install Tectonic
         uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
         with:
-          tool: tectonic@${{ env.TECTONIC_VERSION }}
+          tool: tectonic@${{ steps.tool_versions.outputs.TECTONIC_VERSION }}
 
       - name: Install tex-fmt
         uses: taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7 # v3.0.7
         with:
-          tool: tex-fmt@${{ env.TEX_FMT_VERSION }}
+          tool: tex-fmt@${{ steps.tool_versions.outputs.TEX_FMT_VERSION }}
 
       - name: Build papers
         run: just papers

.github/workflows/release-benchmarks.yml

@@ -19,7 +19,6 @@ concurrency:
 env:
   CARGO_TERM_COLOR: always
   RUST_BACKTRACE: 1
-  UV_VERSION: "0.11.27"
 
 jobs:
   release-baseline:
@@ -39,10 +38,16 @@ jobs:
           cache: false
           cache-bin: false
 
+      - name: Resolve uv version
+        id: uv_version
+        run: |
+          version="$(grep '^uv_version :=' justfile | cut -d '"' -f 2)"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
       - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
-          version: ${{ env.UV_VERSION }}
+          version: ${{ steps.uv_version.outputs.version }}
           enable-cache: false
 
       - name: Verify uv installation