ci: add minimal compile gate for PRs and main

[sagnik11]

Why

This repo has no PR CI — the release workflow is the only thing that compiles the code, so uncompilable merges land on main unnoticed. v1.6.8 alone shipped three separate "repair main compile" fixes (#41's cas_bridge.rs fix, plus the ones in #38/#39), each discovered only after the breakage had landed.

What

A single minimal job on every PR and push to main:

• cargo check --locked --all-targets on ubuntu-22.04 (matches the release workflow's runner pinning), with Swatinem/rust-cache so warm runs are fast.
• --all-targets compiles the lib, bins, integration tests, and benches without running anything — it would have caught all three of the above breakages.
• Concurrency group cancels superseded runs on force-push.

Deliberately not included (keeping the gate fast and friction-free): clippy (local/pinned toolchain version drift causes false failures), fmt, and the actual test suite. Easy to add later as separate jobs if wanted.

Verified cargo check --locked --all-targets passes on current main locally, and this PR's own run demonstrates the gate working.

---

Created with PostHog Desktop

---

Summary

Summary generated by Autter.
Adds a minimal GitHub Actions compile gate for pull requests and pushes to main, providing early validation that the Rust project builds successfully before broader CI or release workflows run.

Changes

• Adds .github/workflows/ci.yml.
• Configures a compile-only CI job for pull requests and main branch updates.
• Uses the repository’s Rust build tooling to catch compilation failures early.

Acceptance Criteria

• The workflow runs for pull requests targeting the repository and pushes to main.
• A successful Rust compilation allows the workflow to pass.
• Compilation failures cause the workflow to fail and are visible in the pull request checks.
• The workflow does not modify repository files or runtime behavior.

Test Plan

• Create or update a pull request and confirm the new compile workflow starts automatically.
• Verify the workflow completes successfully against the current main codebase.
• Confirm the workflow runs after a push to main.
• Introduce a temporary Rust compilation error in a test branch, confirm the workflow fails, then revert the error.

Rollback Plan

• Revert the commit adding .github/workflows/ci.yml to remove the compile gate.
• If the workflow causes unexpected CI load or failures, disable the workflow temporarily in GitHub Actions or revert the file while investigating.

Related Issues

No linked issue was identified.

^{Written for commit df394f3. Summary will update on new commits.}

[autter-dev]

🔴 Autter review in progress — running security, correctness & dependency checks on this PR. Follow live step-by-step progress on the autter/review-gate check in the merge box. Merge is blocked until the gate completes; Autter approves automatically when the review comes back clean, and releases this hold with a neutral review when it finds non-blocking issues.

[autter-dev]

Autter posted 3 finding(s) as review threads below (🟠 3). Each carries a copy-paste AI fix prompt.

[autter-dev]

🟠 External artefact pulled in without integrity pinning — Risk: 60/100

The CI workflow runs actions/checkout from mutable tag v4 rather than a 40-character commit SHA. A retagged or compromised action could execute code in the PR and main compile-gate runners, exposing the repository contents and any runner credentials available to subsequent steps.

🛠 AI fix prompt (copy & paste into your coding agent)

Pin actions/checkout to a reviewed 40-character commit SHA and update the SHA deliberately when upgrading the action.

_{Flagged by Autter security & observability checks.}

[autter-dev]

🟠 External artefact pulled in without integrity pinning — Risk: 60/100

The CI workflow runs dtolnay/rust-toolchain from mutable tag stable rather than a 40-character commit SHA. A changed action could execute arbitrary code while installing the Rust toolchain and compromise the cargo check gate or build runner.

🛠 AI fix prompt (copy & paste into your coding agent)

Pin dtolnay/rust-toolchain to a reviewed 40-character commit SHA; explicitly configure the intended Rust toolchain separately if stable-channel behavior is required.

_{Flagged by Autter security & observability checks.}

[autter-dev]

🟠 External artefact pulled in without integrity pinning — Risk: 60/100

The CI workflow runs Swatinem/rust-cache from mutable tag v2 rather than a 40-character commit SHA. A compromised or retagged cache action could execute code in CI and poison or expose Cargo build caches used by the compile gate.

🛠 AI fix prompt (copy & paste into your coding agent)

Pin Swatinem/rust-cache to a reviewed 40-character commit SHA and update it only through an intentional, reviewed dependency change.

_{Flagged by Autter security & observability checks.}

[autter-dev]

Autter posted 2 finding(s) as review threads below (🟠 2). Each carries a copy-paste AI fix prompt.

[autter-dev]

🟠 Third-party action pinned by mutable tag — Risk: 55/100

The Rust toolchain action uses the mutable stable tag, allowing a compromised or retagged release to execute arbitrary code in the CI job and access the repository contents and read-only GITHUB_TOKEN.

🛠 AI fix prompt (copy & paste into your coding agent)

Replace `dtolnay/rust-toolchain@stable` with the maintainer-verified 40-character commit SHA, updating it deliberately when upgrading the toolchain.

_{Flagged by Autter security & observability checks.}

[autter-dev]

🟠 Third-party action pinned by mutable tag — Risk: 55/100

The Rust cache action uses the mutable v2 tag, allowing a compromised or retagged action release to execute arbitrary code in the CI job and access the repository contents and read-only GITHUB_TOKEN.

🛠 AI fix prompt (copy & paste into your coding agent)

Replace `Swatinem/rust-cache@v2` with the maintainer-verified 40-character commit SHA, updating it deliberately when upgrading the action.

_{Flagged by Autter security & observability checks.}

[autter-dev]

🚦 Pre-merge checks · ⚠️ 4 warning, ✅ 162 passed

Needs attention

Check	Status	Explanation
External artefact pulled in without integrity pinning	⚠️ Warning	3 potential issue(s) detected (max risk 60/100): .github/workflows/ci.yml:28, .github/workflows/ci.yml:31, .github/workflows/ci.yml:34.
Missing linked tracker issue	⚠️ Warning	1 potential issue(s) detected (max risk 50/100): .github/workflows/ci.yml:1.
Missing CODEOWNERS reviewer approval	⚠️ Warning	1 potential issue(s) detected (max risk 70/100): .github/workflows/ci.yml:1.
Third-party action pinned by mutable tag	⚠️ Warning	2 potential issue(s) detected (max risk 55/100): .github/workflows/ci.yml:31, .github/workflows/ci.yml:34.

✅ Passed checks (162)

Check	Status	Explanation
Too many files changed	✅ Passed	Changed 1 file(s), within the limit of 50.
Too many lines changed	✅ Passed	Changed 37 line(s), within the limit of 1000.
Too many unrelated chapters	✅ Passed	1 chapter(s) detected, within the limit of 6.
Generated files hiding real changes	✅ Passed	Generated-file volume (0 lines) does not obscure the 37 hand-written line(s).
Missing PR context	✅ Passed	PR context looks sufficient.
Mixed concerns (refactor + behavior change)	✅ Passed	The PR only adds a CI workflow and contains neither a refactor nor an application behavior change.
Migration + app logic + UI combined in one PR	✅ Passed	The PR adds only a CI workflow and contains no database migration, application logic, or user-interface changes.
Sensitive data in logs	✅ Passed	No sensitive data in logs issues detected.
Log injection	✅ Passed	No log injection issues detected.
Missing audit logging	✅ Passed	No missing audit logging issues detected.
Removed observability	✅ Passed	No removed observability issues detected.
Silent exception swallowing	✅ Passed	No silent exception swallowing issues detected.
Unhandled promise rejection	✅ Passed	No unhandled promise rejection issues detected.
Circuit breaker not detected	✅ Passed	No circuit breaker not detected issues detected.
Stack trace leakage	✅ Passed	No stack trace leakage issues detected.
Multi-write without detected transaction	✅ Passed	No multi-write without detected transaction issues detected.
Possible TOCTOU in critical path	✅ Passed	No possible toctou in critical path issues detected.
Idempotency key not detected	✅ Passed	No idempotency key not detected issues detected.
Possible non-atomic read-modify-write	✅ Passed	No possible non-atomic read-modify-write issues detected.
Optimistic locking not detected	✅ Passed	No optimistic locking not detected issues detected.
Rate limiting not detected	✅ Passed	No rate limiting not detected issues detected.
Rate limiting removed	✅ Passed	No rate limiting removed issues detected.
Batch size limit not detected	✅ Passed	No batch size limit not detected issues detected.
Pagination not detected	✅ Passed	No pagination not detected issues detected.
Publicly exposed storage	✅ Passed	No publicly exposed storage issues detected.
Over-permissive IAM policy	✅ Passed	No over-permissive iam policy issues detected.
Security group open to the internet	✅ Passed	No security group open to the internet issues detected.
Unencrypted storage at rest	✅ Passed	No unencrypted storage at rest issues detected.
Infrastructure missing access logging	✅ Passed	No infrastructure missing access logging issues detected.
Hardcoded secret in IaC	✅ Passed	No hardcoded secret in iac issues detected.
Infrastructure misconfiguration	✅ Passed	No infrastructure misconfiguration issues detected.
Deprecated Kubernetes API version	✅ Passed	No deprecated kubernetes api version issues detected.
Compound IaC attack chain	✅ Passed	No compound iac attack chain issues detected.
Prompt injection risk	✅ Passed	No LLM/AI-integration code touched by this diff.
LLM output used in a dangerous sink	✅ Passed	No LLM/AI-integration code touched by this diff.
Sensitive data in prompt or system-prompt leakage	✅ Passed	No LLM/AI-integration code touched by this diff.
Over-privileged LLM tool / excessive agency	✅ Passed	No LLM/AI-integration code touched by this diff.
Missing validation on an LLM-driven decision	✅ Passed	No LLM/AI-integration code touched by this diff.
Unbounded LLM usage (denial-of-wallet)	✅ Passed	No LLM/AI-integration code touched by this diff.
Table exposed without row-level security	✅ Passed	No row-level-security-related code touched by this diff.
Over-broad row-level security policy	✅ Passed	No row-level-security-related code touched by this diff.
Code path that bypasses row-level security	✅ Passed	No row-level-security-related code touched by this diff.
Privileged database credential reachable from the client	✅ Passed	No row-level-security-related code touched by this diff.
Privileged query without row-level scoping	✅ Passed	No row-level-security-related code touched by this diff.
Template-default gradient styling	✅ Passed	No added frontend pages or design-slop markers in this diff.
Interchangeable AI marketing copy	✅ Passed	No added frontend pages or design-slop markers in this diff.
Placeholder content shipped to users	✅ Passed	No added frontend pages or design-slop markers in this diff.
Emoji standing in for an icon system	✅ Passed	No added frontend pages or design-slop markers in this diff.
Call-to-action that goes nowhere	✅ Passed	No added frontend pages or design-slop markers in this diff.
Templated page composition	✅ Passed	No added frontend pages or design-slop markers in this diff.
PII in logs	✅ Passed	No pii in logs issues detected.
PII or internals leaked in error response	✅ Passed	No pii or internals leaked in error response issues detected.
PII stored without application-level encryption	✅ Passed	No pii stored without application-level encryption issues detected.
User data stored without retention controls	✅ Passed	No user data stored without retention controls issues detected.
PII sent to external / cross-border destination	✅ Passed	No pii sent to external / cross-border destination issues detected.
Lockfile resolution / integrity tampered	✅ Passed	No lockfile resolution / integrity tampered issues detected.
Dependency runs install-time lifecycle script	✅ Passed	No dependency runs install-time lifecycle script issues detected.
Possible dependency-confusion attack	✅ Passed	No possible dependency-confusion attack issues detected.
Lockfile resolves a dependency the manifest does not declare	✅ Passed	No lockfile resolves a dependency the manifest does not declare issues detected.
Checked-in build artefact modified without source change	✅ Passed	No checked-in build artefact modified without source change issues detected.
Dockerfile build-step is insecure	✅ Passed	No dockerfile build-step is insecure issues detected.
Changed export, importer not updated	✅ Passed	No changed export with an un-updated importer detected.
Missing security-team review on sensitive path	✅ Passed	No missing security-team review on sensitive path issues detected.
Source changes without matching tests	✅ Passed	No source changes without matching tests issues detected.
Migration missing rollback / down step	✅ Passed	No migration missing rollback / down step issues detected.
Frontend importing database client directly	✅ Passed	No frontend importing database client directly issues detected.
Route handler bypassing service layer	✅ Passed	No route handler bypassing service layer issues detected.
Backend service importing UI module	✅ Passed	No backend service importing ui module issues detected.
Cross-context internals import	✅ Passed	No cross-context internals import issues detected.
Workspace package rule violation	✅ Passed	No workspace package rule violation issues detected.
Inconsistent logging pattern	✅ Passed	No inconsistent logging pattern issues detected.
Inconsistent error handling	✅ Passed	No inconsistent error handling issues detected.
Endpoint missing input validation	✅ Passed	No endpoint missing input validation issues detected.
Multi-write without transaction wrapper	✅ Passed	No multi-write without transaction wrapper issues detected.
New feature shipped without feature flag	✅ Passed	No new feature shipped without feature flag issues detected.
Module placed in the wrong workspace package	✅ Passed	No module placed in the wrong workspace package issues detected.
Direct env-var access bypasses config module	✅ Passed	No direct env-var access bypasses config module issues detected.
Hallucinated import (package not installed)	✅ Passed	No hallucinated import (package not installed) issues detected.
Nonexistent package (not found in registry)	✅ Passed	No nonexistent package (not found in registry) issues detected.
Call to function that does not exist	✅ Passed	No call to function that does not exist issues detected.
Generic placeholder identifier in production logic	✅ Passed	No generic placeholder identifier in production logic issues detected.
Repetitive boilerplate (duplicated block)	✅ Passed	No repetitive boilerplate (duplicated block) issues detected.
Overbroad try/catch swallowing all exceptions	✅ Passed	No overbroad try/catch swallowing all exceptions issues detected.
TODO / FIXME on critical path	✅ Passed	No todo / fixme on critical path issues detected.
Comment contradicts or fabricates code behaviour	✅ Passed	No comment contradicts or fabricates code behaviour issues detected.
Abstraction defined but never used	✅ Passed	No abstraction defined but never used issues detected.
Code style differs from rest of codebase	✅ Passed	No code style differs from rest of codebase issues detected.
Established pattern ignored	✅ Passed	No established pattern ignored issues detected.
Unhandled edge case (null / empty / zero / boundary)	✅ Passed	No unhandled edge case (null / empty / zero / boundary) issues detected.
Doc-copy code with insecure defaults	✅ Passed	No doc-copy code with insecure defaults issues detected.
Dead code (defined but never referenced)	✅ Passed	No dead code (defined but never referenced) issues detected.
Deprecated API call	✅ Passed	No deprecated api call issues detected.
API pattern from wrong library version	✅ Passed	No api pattern from wrong library version issues detected.
API endpoint removed	✅ Passed	No api endpoint removed issues detected.
HTTP method changed (GET ↔ POST etc.)	✅ Passed	No http method changed (get ↔ post etc.) issues detected.
New required field added to request	✅ Passed	No new required field added to request issues detected.
Field removed from response schema	✅ Passed	No field removed from response schema issues detected.
Response field type changed	✅ Passed	No response field type changed issues detected.
HTTP status code changed	✅ Passed	No http status code changed issues detected.
Auth requirement added / removed / changed	✅ Passed	No auth requirement added / removed / changed issues detected.
Error response shape changed	✅ Passed	No error response shape changed issues detected.
Pagination behaviour changed	✅ Passed	No pagination behaviour changed issues detected.
Outbound webhook payload schema changed	✅ Passed	No outbound webhook payload schema changed issues detected.
GraphQL field removed without deprecation	✅ Passed	No graphql field removed without deprecation issues detected.
GraphQL enum value removed	✅ Passed	No graphql enum value removed issues detected.
SQL injection	✅ Passed	No sql injection issues detected.
Cross-site scripting (XSS)	✅ Passed	No cross-site scripting (xss) issues detected.
Path traversal	✅ Passed	No path traversal issues detected.
Command injection	✅ Passed	No command injection issues detected.
Insecure deserialization	✅ Passed	No insecure deserialization issues detected.
Weak cryptography	✅ Passed	No weak cryptography issues detected.
Hardcoded secret	✅ Passed	No hardcoded secret issues detected.
Insecure randomness for security material	✅ Passed	No insecure randomness for security material issues detected.
Unsafe file upload	✅ Passed	No unsafe file upload issues detected.
Missing input validation	✅ Passed	No missing input validation issues detected.
Unsafe CORS configuration	✅ Passed	No unsafe cors configuration issues detected.
Unsafe / open redirect	✅ Passed	No unsafe / open redirect issues detected.
Missing CSRF protection	✅ Passed	No missing csrf protection issues detected.
Unsafe cookie / session settings	✅ Passed	No unsafe cookie / session settings issues detected.
Sensitive data exposure	✅ Passed	No sensitive data exposure issues detected.
API key in source	✅ Passed	No api key in source detected.
Access token in source	✅ Passed	No access token in source detected.
Private key in source	✅ Passed	No private key in source detected.
Database connection URL with embedded credentials	✅ Passed	No database connection url with embedded credentials detected.
Cloud credential in source	✅ Passed	No cloud credential in source detected.
Webhook signing secret in source	✅ Passed	No webhook signing secret in source detected.
OAuth client secret in source	✅ Passed	No oauth client secret in source detected.
JWT signing secret in source	✅ Passed	No jwt signing secret in source detected.
Hardcoded password	✅ Passed	No hardcoded password detected.
pull_request_target executes untrusted PR code	✅ Passed	No pull_request_target executes untrusted pr code issues detected.
Repository secrets exposed to fork PRs	✅ Passed	No repository secrets exposed to fork prs issues detected.
Overbroad GITHUB_TOKEN / pipeline permissions	✅ Passed	No overbroad github_token / pipeline permissions issues detected.
Shell injection via workflow expression	✅ Passed	No shell injection via workflow expression issues detected.
Cache poisoning risk from fork PRs	✅ Passed	No cache poisoning risk from fork prs issues detected.
Deployment workflow changed	✅ Passed	No deployment workflow changed issues detected.
Environment protection rule weakened	✅ Passed	No environment protection rule weakened issues detected.
Auth middleware removed from route	✅ Passed	No auth middleware removed from route issues detected.
Route protection changed (protected → public)	✅ Passed	No route protection changed (protected → public) issues detected.
Permission / RBAC check removed	✅ Passed	No permission / rbac check removed issues detected.
Required role weakened	✅ Passed	No required role weakened issues detected.
Admin-only route exposed to lower privilege	✅ Passed	No admin-only route exposed to lower privilege issues detected.
Token validation skipped in middleware chain	✅ Passed	No token validation skipped in middleware chain issues detected.
JWT verification weakened or changed	✅ Passed	No jwt verification weakened or changed issues detected.
Session expiration / TTL changed	✅ Passed	No session expiration / ttl changed issues detected.
Password reset flow changed	✅ Passed	No password reset flow changed issues detected.
OAuth callback / redirect handling changed	✅ Passed	No oauth callback / redirect handling changed issues detected.
Webhook endpoint missing signature verification	✅ Passed	No webhook endpoint missing signature verification issues detected.
Public route touches private/PII data	✅ Passed	No public route touches private/pii data issues detected.
Code correctness issue	✅ Passed	No additional explanation was reported.
Runtime error risk	✅ Passed	No additional explanation was reported.
Resource leak risk	✅ Passed	No additional explanation was reported.
Data integrity risk	✅ Passed	No additional explanation was reported.
Maintainability issue	✅ Passed	No additional explanation was reported.
Co-change coupling	✅ Passed	No additional explanation was reported.
Redundant alias / duplicate import	✅ Passed	No additional explanation was reported.
Redundant type construct	✅ Passed	No additional explanation was reported.
Simplifiable code	✅ Passed	No additional explanation was reported.
Unnecessary type assertion	✅ Passed	No additional explanation was reported.
Module smell	✅ Passed	No additional explanation was reported.
Excessive complexity	✅ Passed	No additional explanation was reported.
Dead export (no callers)	✅ Passed	No additional explanation was reported.
Code duplication / DRY violation	✅ Passed	No additional explanation was reported.

_{This comment is updated automatically whenever Autter reviews a new PR revision.}

[autter-dev]

⚠️ 2 unconfirmed finding(s) — flagged by a detector but not proven by Autter's verification pass

Inline comments are reserved for findings that survived verification. These are plausible but could not be confirmed from the available context, so they are listed here as FYIs instead — review the ones that look real to you.

• 🟡 Missing linked tracker issue (risk 49/100) — .github/workflows/ci.yml:1 — No PR description or issue-link metadata was provided, so the claim that no linked tracker issue was identified cannot be verified.
• 🟡 Missing CODEOWNERS reviewer approval (risk 49/100) — .github/workflows/ci.yml:1 — The provided context does not include CODEOWNERS contents or verifiable review records, so it cannot establish that no applicable owner exists or that approval is missing.

[autter-dev]

Autter completed PR review for #42: 7 finding(s) remain below the merge-blocking bar, so this review stays neutral rather than approving. See the findings below; the task checklist follows as the review's final comment.

[autter-dev]

Autter task list

• @sagnik11 Pin all third-party workflow actions to verified commit SHAs (.github/workflows/ci.yml) - Update actions/checkout, dtolnay/rust-toolchain, and Swatinem/rust-cache in the workflow from mutable tags to verified 40-character commit SHAs, documenting the referenced releases where appropriate.
• @sagnik11 Verify the pinned compile gate across supported triggers (.github/workflows/ci.yml) - Run the workflow for a pull request and a push to main, confirm cargo check succeeds on the current codebase, and validate that an intentional temporary Rust compile error makes the check fail before reverting it.
• @sagnik11 Link the compile-gate change to a tracker issue (.github/workflows/ci.yml) - Check for an existing CI issue or create one describing the PR/main compile gate, then add the issue reference to the pull request and any repository-required workflow documentation.
• @sagnik11 Add CODEOWNERS coverage and obtain required approval (.github/workflows/ci.yml) - Add a CODEOWNERS rule covering .github/workflows/ci.yml under the repository’s established ownership policy and obtain approval from the designated owner before merging.

Generated from PR diff, blast radius, and context.

Issues found

1. External artefact pulled in without integrity pinning · risk 60/100 · .github/workflows/ci.yml:28
2. External artefact pulled in without integrity pinning · risk 60/100 · .github/workflows/ci.yml:31
3. External artefact pulled in without integrity pinning · risk 60/100 · .github/workflows/ci.yml:34
4. Third-party action pinned by mutable tag · risk 55/100 · .github/workflows/ci.yml:31
5. Third-party action pinned by mutable tag · risk 55/100 · .github/workflows/ci.yml:34
6. Missing linked tracker issue · risk 49/100 · .github/workflows/ci.yml:1
7. Missing CODEOWNERS reviewer approval · risk 49/100 · .github/workflows/ci.yml:1

🛠 Fix options

Check one option and Autter will start a fix run for the unresolved issues above.

• One PR with all unresolved fixes
• One independent PR per unresolved issue

Checking a box triggers the fix run immediately — Autter comments back with the issues being fixed and the branch created for each.