feat(rhodibot): GitHub App authentication and a GraphQL client

.github/workflows/rust.yml

@@ -22,16 +22,32 @@ env:
   OPENSSL_NO_VENDOR: '1'
 jobs:
   rust:
-    name: build · test · clippy
+    name: build · test · clippy (${{ matrix.module }})
     runs-on: ubuntu-latest
     timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
-        crate: [robot-repo-automaton, shared-context, dashboard]
+        # `module` is the label used in the job name; `dir` is where the crate
+        # actually lives. They differ for rhodibot, which sits under bots/ --
+        # naming it `rhodibot` alone sent the job looking for a top-level
+        # directory that does not exist.
+        #
+        # rhodibot was missing entirely until 2026-09-19, so the crate that
+        # implements the GitHub App had never been built, tested or linted in
+        # CI; its verification was whatever a human remembered to run locally.
+        include:
+          - module: robot-repo-automaton
+            dir: robot-repo-automaton
+          - module: shared-context
+            dir: shared-context
+          - module: dashboard
+            dir: dashboard
+          - module: rhodibot
+            dir: bots/rhodibot
     defaults:
       run:
-        working-directory: ${{ matrix.crate }}
+        working-directory: ${{ matrix.dir }}
     steps:
       - uses: actions/checkout@v7.0.1
       - name: Ensure clippy + rustfmt components

bots/rhodibot/Cargo.toml

@@ -30,6 +30,15 @@ serde = { version = "1.0.228", features = ["derive"] }
 serde_json = "1.0.150"
 toml = "1.1.2+spec-1.1.0"
 
+# Crypto for GitHub App JWT signing (RS256).
+#
+# `ring` and `base64` are deliberately taken from versions already present in
+# Cargo.lock via rustls/reqwest, so this adds no new package to the graph --
+# which matters because CI builds with `--locked` and a regenerated lock would
+# otherwise have to be trusted sight-unseen.
+ring = "0.17"
+base64 = "0.22"
+
 # Crypto for webhook verification
 hmac = "0.13.0"
 sha2 = "0.11.0"