pythia-actors — Rust workspace for Pythia OSINT Actors on Apify

Cargo workspace containing Apify Actors written in Rust. Each Actor is a separate crate under actors/. Shared functionality lives in crates/.

Layout

pythia-actors/
├── Cargo.toml                  # workspace root, shared deps + release profile
├── crates/
│   ├── apify_client/           # minimal Apify API client (input read, dataset write)
│   └── source_common/          # shared types: Signal, ResultEnvelope, redaction
└── actors/
    ├── greenhouse/             # public job-board fetcher
    │   ├── Cargo.toml
    │   ├── src/main.rs
    │   └── .actor/
    │       ├── actor.json
    │       ├── input_schema.json
    │       └── Dockerfile
    └── sec_edgar/
        └── ... (same shape)

Build

# Local dev build (fast, debug symbols)
cargo build

# Release build (LTO, stripped, optimized — what ships to Apify)
cargo build --release

# Run a specific Actor locally
APIFY_TOKEN=xxx cargo run -p greenhouse-actor -- --input examples/greenhouse_input.json

Deployment to Apify

Each Actor has its own .actor/ directory with the Apify deployment scaffold. From inside an Actor's directory:

cd actors/greenhouse
apify push                      # uploads to Apify, builds Docker image, publishes

The Dockerfile is multi-stage — cargo build --release, then COPY the single binary into a minimal debian:bookworm-slim image. Final image is ~50-80 MB depending on the Actor's deps.

IP protection posture

Release profile uses lto = "fat" + codegen-units = 1 + strip = "symbols"

• panic = "abort". This produces the smallest, most-aggressively-optimized binary, which is also the hardest to reverse-engineer. Combined with Apify's private-Actor model, customers never see source code at any point.

For the proprietary scoring/synthesis layer (when built), see the planned actors/synthesis/ Actor — that's where we'll consider WASM-bound critical paths and additional obfuscation.

Testing

• Per-crate unit tests: cargo test
• HTTP fixtures via reqwest mocks
• Integration tests against real public APIs are gated behind LIVE_NETWORK=1 env var to keep CI deterministic.

Why Rust on Apify

• Compiled binary = strong IP protection vs. minified JS
• Single binary, no node_modules — small Apify Docker image, faster cold start
• tokio + reqwest async fan-out for parallel source fetching
• Existing Creator Fusion Rust expertise (ark_sensor, Ouija eBPF projects)