CI to expose build instability

.github/workflows/rust.yml

@@ -163,4 +163,70 @@ jobs:
       - name: cargo test fea-rs
         run: cargo test -p fea-rs
 
+  # Check if GS builds, builds repeatably, and passes OTS
+  # https://github.com/googlefonts/fontc/issues/647
+  build-gs-repeatably:
+    runs-on: ubuntu-latest
+    name: Build GS and check the result
+    steps:
+      - name: Check out fontc source repository
+        uses: actions/checkout@v4
+
+      - name: Install the latest stable Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Build and install fontc (release mode)
+        run: cd fontc && pwd && cargo install --path .
 
+      - name: Check out font project source repository
+        uses: actions/checkout@v4
+        with:
+          repository: googlefonts/googlesans
+          token: ${{ secrets.GS_READ_FONTC }}
+
+      - name: Pin SOURCE_DATE_EPOCH
+        run: echo "SOURCE_DATE_EPOCH=$(date +%s)" >> "$GITHUB_ENV"
+
+      - name: Compile me once, shame on you
+        run: |
+          rm -rf build
+          fontc source/GoogleSans/GoogleSans.designspace
+          cp build/font.ttf ./first-roman.ttf
+          rm -rf build
+          fontc source/GoogleSans/GoogleSans-Italic.designspace
+          cp build/font.ttf ./first-italic.ttf
+
+      - name: Fetch OTS
+        run: |
+            curl -OL "https://github.com/khaledhosny/ots/releases/download/v9.1.0/ots-9.1.0-Linux.zip"
+            unzip "ots-9.1.0-Linux.zip" "ots-9.1.0-Linux/ots-sanitize"
+
+      - name: OTS tests, Roman
+        run: ots-9.1.0-Linux/ots-sanitize build/font.ttf
+
+      - name: OTS tests, Italic
+        run: ots-9.1.0-Linux/ots-sanitize build/font.ttf
+
+      - name: Compile me twice, shame on me
+        run: |
+          rm -rf build
+          fontc source/GoogleSans/GoogleSans.designspace
+          cp build/font.ttf ./second-roman.ttf
+          rm -rf build
+          fontc source/GoogleSans/GoogleSans-Italic.designspace
+          cp build/font.ttf ./second-italic.ttf
+
+      - name: ttx, it might be handy to troubleshoot
+        # tail -n +2 to skip past the first line because it emits the filename
+        run: |
+          pipx install fonttools
+          which ttx
+          ttx --version
+          diff -u <(ttx -l first-roman.ttf | tail -n +2) <(ttx -l second-roman.ttf | tail -n +2)
+          diff -u <(ttx -l first-italic.ttf | tail -n +2) <(ttx -l second-italic.ttf | tail -n +2)
+
+      - name: Stable Roman?
+        run: cmp first-roman.ttf second-roman.ttf
+
+      - name: Stable Italic?
+        run: cmp first-italic.ttf second-italic.ttf