ci: add reproducible plugin verification by mpiton · Pull Request #1 · mpiton/vortex-mod-1fichier

mpiton · 2026-07-15T14:33:16Z

Summary

pin the supported Rust toolchain and WASM target
add the central reusable plugin CI
complete WASM ABI smoke coverage for premium extraction and resolution
use upstream Extism 1.30.0

Validation

54 unit tests, 10 fixture tests and 4 WASM smokes pass
native and WASM Clippy, release build and cargo audit pass

Linear: MAT-129

Summary by cubic

Adds reproducible plugin verification using centrally maintained, SHA-pinned workflows split into read-only verification and owner-gated release. Requires the release .wasm in smoke tests and exercises all exports with HTTP and premium credentials; pins Rust 1.95.0, wasm32-wasip1, and extism 1.30.0. Aligns with Linear MAT-129.

CI and Tests
- Reuse canonical plugin workflows on PRs/main (verification) and tags (release), pinned to exact SHAs and now re-pinned to the latest hardened SHAs; release uses write perms and is restricted to the repo owner.
- Pin toolchain via rust-toolchain.toml; docs clarify lint → build .wasm → test order; smoke tests hard-fail if the artifact is missing.
- Smoke tests call all runtime exports with HTTP and premium credential fixtures, asserting JSON shape and direct URL resolution.
Dependencies
- Pin extism to =1.30.0.
- Refresh Cargo.lock to the latest wasmtime stack and related crates.

^{Written for commit 1e10c33. Summary will update on new commits.}

Summary by CodeRabbit

Tests
- Strengthened WebAssembly smoke tests to require the release WASM artifact, use a shared fixture, and hard-fail on missing assets.
- Added a test that verifies link extraction and stream URL resolution, including expected JSON output.
Chores
- Updated CI to run separate checks for pull requests and publish/release steps for version tags.
- Standardized the Rust toolchain and pinned an Extism dev-dependency version for reproducible builds.
Documentation
- Reordered setup and README build/test instructions so linting precedes the required WASM build and tests run afterward.

qodo-code-review · 2026-07-15T14:33:20Z

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

coderabbitai · 2026-07-15T14:33:30Z

📝 Walkthrough

Walkthrough

The pull request pins the Rust and Extism test environment, adds reusable CI and release workflow paths, and strengthens WASM smoke tests with shared fixtures, JSON host stubs, required artifacts, and export-level assertions.

Changes

Plugin CI and WASM smoke coverage

Layer / File(s)	Summary
Pin the plugin test environment `rust-toolchain.toml`, `Cargo.toml`	Pins Rust 1.95.0, required WASM tooling, the `wasm32-wasip1` target, and Extism 1.30.0.
Expand WASM smoke validation `tests/wasm_smoke.rs`, `README.md`, `.github/CONTRIBUTING.md`	Requires the WASM artifact, centralizes fixture URLs, updates host stubs, tests `extract_links` and `resolve_stream_url`, and documents the build-before-test order.
Wire CI and release workflows `.github/workflows/plugin-ci.yml`	Runs the pinned external CI workflow for pull requests and `main` pushes, and the release workflow for `v*` tag pushes.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: adding reproducible plugin verification in CI.

_{Comment @coderabbitai help to get the list of available commands.}

socket-security · 2026-07-15T14:33:34Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	extism@1.21.0 ⏵ 1.30.0

View full report

cubic-dev-ai

1 issue found across 5 files

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/plugin-ci.yml">

<violation number="1" location=".github/workflows/plugin-ci.yml:11">
P2: The job-level `permissions: contents: write` in the CI workflow may be both too broad (write access to repo contents) and too narrow (all other permissions default to `none`). Granting only `contents: write` while omitting `checks`, `pull-requests`, or `statuses` could break the reusable workflow if it needs to post check annotations or comment on PRs. Consider reviewing what the called reusable workflow actually requires and setting the minimum set of explicit permissions.</violation>
</file>

_{Reply with feedback, questions, or to request a fix.

Re-trigger cubic}

cubic-dev-ai · 2026-07-15T14:39:25Z

+
+jobs:
+  plugin-ci:
+    permissions:


P2: The job-level permissions: contents: write in the CI workflow may be both too broad (write access to repo contents) and too narrow (all other permissions default to none). Granting only contents: write while omitting checks, pull-requests, or statuses could break the reusable workflow if it needs to post check annotations or comment on PRs. Consider reviewing what the called reusable workflow actually requires and setting the minimum set of explicit permissions.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/plugin-ci.yml, line 11: <comment>The job-level `permissions: contents: write` in the CI workflow may be both too broad (write access to repo contents) and too narrow (all other permissions default to `none`). Granting only `contents: write` while omitting `checks`, `pull-requests`, or `statuses` could break the reusable workflow if it needs to post check annotations or comment on PRs. Consider reviewing what the called reusable workflow actually requires and setting the minimum set of explicit permissions.</comment> <file context> @@ -0,0 +1,13 @@ + +jobs: + plugin-ci: + permissions: + contents: write + uses: mpiton/vortex/.github/workflows/plugin-ci.yml@e9edb3b1b60cd795f03cf1e5acba7d6b3731f753 </file context>

Fixed in 542117b. Branch and PR validation is read-only; contents:write exists only on the tag-gated release job.

cubic-dev-ai

All reported issues were addressed across 1 file (changes from recent commits).

_{Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic}

ci: add reproducible plugin verification

8f44268

coderabbitai Bot approved these changes Jul 15, 2026

View reviewed changes

cubic-dev-ai Bot reviewed Jul 15, 2026

View reviewed changes

mpiton added 5 commits July 15, 2026 16:50

fix(ci): scope release permissions and document smoke order

542117b

fix(ci): separate verification and release workflows

bb3a603

fix(ci): pin hardened release workflow

67833ee

fix(ci): restrict releases to owner

936bb7f

fix(ci): pin canonical release workflows

97864a2

cubic-dev-ai Bot reviewed Jul 15, 2026

View reviewed changes

Comment thread .github/workflows/plugin-ci.yml Outdated

Comment thread .github/workflows/plugin-ci.yml Outdated

ci: repin reusable plugin workflows

1e10c33

mpiton merged commit e6d6e69 into main Jul 16, 2026
7 checks passed

coderabbitai Bot mentioned this pull request Jul 16, 2026

feat: validate 1fichier premium accounts #3

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: add reproducible plugin verification#1

ci: add reproducible plugin verification#1
mpiton merged 7 commits into
mainfrom
feat/lot-1

mpiton commented Jul 15, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

qodo-code-review Bot commented Jul 15, 2026

Uh oh!

coderabbitai Bot commented Jul 15, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

socket-security Bot commented Jul 15, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

cubic-dev-ai Bot Jul 15, 2026

Uh oh!

mpiton Jul 15, 2026

Uh oh!

cubic-dev-ai Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

mpiton commented Jul 15, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation

Summary by cubic

Summary by CodeRabbit

Uh oh!

qodo-code-review Bot commented Jul 15, 2026

Qodo reviews are paused for this user.

Uh oh!

coderabbitai Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

socket-security Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

mpiton Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

mpiton commented Jul 15, 2026 •

edited by cubic-dev-ai Bot

Loading

coderabbitai Bot commented Jul 15, 2026 •

edited

Loading

socket-security Bot commented Jul 15, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading