feat(tools): define rss tool registry contracts #11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | ||
| on: | ||
| push: | ||
| branches: [master] | ||
| pull_request: | ||
| # Read-only workflow: checkout + build + test only. Explicit least-privilege | ||
| # declaration so a future step cannot silently gain write access. | ||
| permissions: | ||
| contents: read | ||
| # Optional but recommended: cancel superseded runs on the same ref so a | ||
| # fresh push or PR update does not queue behind an outdated run. | ||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.ref }} | ||
| cancel-in-progress: true | ||
| env: | ||
| CARGO_TERM_COLOR: always | ||
| # The agent consumes pd-vm / pd-host-function from the canonical HTTPS Git | ||
| # remote, pinned to a full revision in Cargo.toml; Cargo.lock records that | ||
| # exact git source. `--locked` builds fetch exactly that revision from | ||
| # github.com into the cargo git cache — no sibling checkout of the core | ||
| # repository is required or used (tests/dependency_pin_tests.rs enforces | ||
| # the canonical source and full revision; bump only together with a | ||
| # Cargo.lock refresh). | ||
| # Integration tests place temporary SQLite state and fixture scripts | ||
| # here. Every suite honors this variable; without it they fall back to | ||
| # /mnt/TEMP/rustscript/... which is the local-development default and | ||
| # not writable on CI runners. | ||
| RUSTSCRIPT_AGENT_TEST_TMP: ${{ runner.temp }}/rustscript-agent-tests | ||
| jobs: | ||
| quality: | ||
| name: fmt, clippy, tests | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout rustscript-agent | ||
| # Full-SHA pin, matching the rustscript-lang/rustscript CI policy | ||
| # (actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5). | ||
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 | ||
| - name: Install Rust toolchain | ||
| # Full-SHA pin, matching the rustscript-lang/rustscript CI policy | ||
| # (dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30). | ||
| uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 | ||
| with: | ||
| components: rustfmt, clippy | ||
| - name: Cache cargo registry, git db, and build target | ||
| # Full-SHA pin of the v2 tag (verified: v2 → | ||
| # 6323deb102c322ba6fcbdcafc7e3dddab59af2b6). Caches the fetched | ||
| # pinned core revision (cargo git db) plus registry and build | ||
| # target, so `cargo fetch`/test runs stay correct and fast. | ||
| uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 | ||
| - name: Format check | ||
| run: cargo fmt --all -- --check | ||
| - name: Clippy (warnings denied) | ||
| run: cargo clippy --locked --all-features --all-targets -- -D warnings | ||
| # The default suite runs all non-ignored tests. The only remaining | ||
| # #[ignore]d suites are the openai_responses / anthropic_messages | ||
| # placeholder references (not_implemented adapter stubs — pure agent | ||
| # work, unrelated to the core contract gate); the core repro driver | ||
| # and all OpenAI Chat suites run by default — see | ||
| # plans/2026-08-13_a3-provider-core-blocker.md. | ||
| - name: Test (workspace, all features, all targets) | ||
| run: cargo test --locked --all-features --all-targets | ||
| # Whitespace diagnostic: `git diff --check` reports trailing-whitespace | ||
| # errors in any tracked-file change a step leaves. On a fresh checkout | ||
| # with no drift it is a no-op, which is the point — the authoritative | ||
| # gate below is what actually fails on drift. | ||
| - name: No whitespace errors in tracked changes | ||
| run: git diff --check | ||
| # Fail on real drift instead: every step above must leave the working | ||
| # tree exactly as checked out. `git diff --exit-code` only sees tracked | ||
| # modifications, so this gate uses `git status --porcelain`, which | ||
| # reports both tracked changes and untracked/generated files — it | ||
| # catches tests writing state into the checkout instead of | ||
| # $RUSTSCRIPT_AGENT_TEST_TMP, and any file a step leaves behind. | ||
| - name: Working tree must stay clean (tracked and untracked) | ||
| run: | | ||
| status="$(git status --porcelain)" | ||
| if [[ -n "$status" ]]; then | ||
| echo "::error::working tree is not clean after CI steps:" | ||
| printf '%s\n' "$status" | ||
| exit 1 | ||
| fi | ||
