[2/n] [meta] enforce sorted Cargo.toml dependencies via tombi and add a CI check

.config/tombi.toml

@@ -0,0 +1,49 @@
+# Tombi config to apply TOML lints and autoformatting:
+#
+# * Keep Cargo.toml dependency lines sorted.
+# * Standardize things like "" across our configs.
+
+# Cargo supports TOML 1.1, under which tombi wraps > 80-column dependency lines
+# into multiline inline tables. However, toml-cli in tools/ci_check_opte_ver.sh
+# doesn't currently (as of 2026-07) support that syntax, so we restrict
+# ourselves to TOML 1.0 here.
+toml-version = "v1.0.0"
+
+[files]
+# This controls which files a bare `tombi format`/`tombi lint` applies to.
+include = [
+    "**/Cargo.toml",
+    ".config/nextest.toml",
+    ".config/tombi.toml",
+]
+# workspace-hack/Cargo.toml is generated and owned by cargo-hakari, so we don't
+# try and fight that here.
+exclude = ["workspace-hack/Cargo.toml"]
+
+[format.rules]
+indent-width = 4
+
+[[schemas]]
+toml-version = "v1.0.0"
+# Use tombi's embedded cargo schema (tombi://), not the live schemastore URL, so
+# tombi can work without a network dependency.
+path = "tombi://www.schemastore.org/cargo.json"
+include = ["**/Cargo.toml"]
+
+# By default, tombi would sort most tables in Cargo.toml. We mostly care about
+# dependency tables, though.
+[schemas.format.rules]
+array-values-order.enabled = false
+table-keys-order.enabled = false
+
+[[schemas.overrides]]
+targets = [
+    "dependencies",
+    "dev-dependencies",
+    "build-dependencies",
+    "workspace.dependencies",
+    "target.*.dependencies",
+    "target.*.dev-dependencies",
+    "target.*.build-dependencies",
+]
+format.rules.table-keys-order = "version-sort"

.envrc

@@ -6,6 +6,7 @@ PATH_add out/clickhouse
 PATH_add out/dendrite-stub/bin
 PATH_add out/mgd/root/opt/oxide/mgd/bin
 PATH_add out/mg-ddm/root/opt/oxide/mg-ddm/bin
+PATH_add out/tombi
 
 if [ "$OMICRON_USE_FLAKE" = 1 ] && nix flake show &> /dev/null
 then
@@ -15,6 +16,7 @@ then
     watch_file tools/dendrite_version
     watch_file tools/clickhouse_version
     watch_file tools/cocroachdb_version
+    watch_file tools/tombi_version
     watch_file rust-toolchain.toml
     use flake;
 fi

.github/workflows/check-toml-format.yml

@@ -0,0 +1,45 @@
+name: check-toml-format
+on:
+  push:
+    branches:
+      - main
+      - 'rel/**'
+  pull_request:
+  workflow_dispatch:
+    inputs:
+jobs:
+  check-toml-format:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ github.event.pull_request.head.sha }} # see omicron#4461
+      - name: Install tombi
+        shell: bash
+        # Keep this in sync with the dev-tools downloader and flake.nix.
+        run: |
+          set -euo pipefail
+          version="$(cat tools/tombi_version)"
+          source tools/tombi_checksums
+          triple="x86_64-unknown-linux-musl"
+          dirname="tombi-cli-${version}-${triple}"
+          tarball="${dirname}.tar.gz"
+          url="https://github.com/tombi-toml/tombi/releases/download/v${version}/${tarball}"
+          bindir="$HOME/.local/bin"
+          # Download and extract the tombi binary inside RUNNER_TEMP.
+          cd "$RUNNER_TEMP"
+          curl --retry 3 --connect-timeout 15 -fsSL -o "$tarball" "$url"
+          echo "${CIDL_SHA256_LINUX_X86_64}  ${tarball}" | sha256sum -c -
+          tar -xzf "$tarball"
+          mkdir -p "$bindir"
+          cp "${dirname}/tombi" "$bindir/tombi"
+          chmod +x "$bindir/tombi"
+          echo "$bindir" >> "$GITHUB_PATH"
+      - name: Check TOML formatting
+        shell: bash
+        run: tombi format --check --offline
+      - name: Lint TOML files
+        shell: bash
+        # Pass in --error-on-warnings because plain tombi lint exits 0 on
+        # warnings, and we care about them in this context.
+        run: tombi lint --offline --error-on-warnings