ci: add reproducible plugin verification

[mpiton]

Summary

• pin the supported Rust toolchain and WASM target
• add the central reusable plugin CI
• add a WASM smoke covering all five required exports
• use upstream Extism 1.30.0

Validation

• 62 unit tests and the complete WASM smoke pass
• native and WASM Clippy, release build and cargo audit pass

Linear: MAT-129

---

Summary by cubic

Adds reproducible plugin verification by pinning the Rust toolchain and adopting pinned, reusable CI workflows. Splits verification and a hardened, owner-only tag release, with a WASM smoke test that checks all required exports, meeting Linear MAT-129.

• New Features

  • Pin Rust 1.95.0 with clippy, rustfmt, llvm-tools-preview, target wasm32-wasip1.
  • Use canonical reusable workflows from mpiton/vortex, pinned to SHAs and re-pinned to the latest canonical SHAs; separate verification and hardened release (read-only on PRs; write on version tags; owner-only releases).
  • Add release WASM smoke test (tests/wasm_smoke.rs) covering: can_handle, supports_playlist, extract_links, extract_generic, is_http_url.

• Dependencies

  • Pin extism to =1.30.0.

^{Written for commit dd77e9f. Summary will update on new commits.}

Summary by CodeRabbit

• Tests
  • Added automated smoke tests that load the released WebAssembly artifact and validate exported functions for URL handling, playlist support, and gallery extraction accuracy.
  • Includes contract-style assertions for expected JSON outputs and links.
• Chores
  • Added a dedicated CI workflow for pull requests and automated release execution for version tags.
  • Pinned and standardized the Rust toolchain and enabled consistent WebAssembly build target support.

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds a pinned Rust/WASI toolchain, an Extism-based end-to-end WASM ABI smoke test, and a reusable Plugin CI workflow triggered by pull requests, main pushes, and v* tags.

Changes

Plugin CI validation

Layer / File(s)	Summary
Pinned Rust and Extism test environment rust-toolchain.toml, Cargo.toml	Pins Rust 1.95.0, enables required tools and the wasm32-wasip1 target, and adds Extism 1.30.0 as a development dependency.
WASM ABI smoke test tests/wasm_smoke.rs	Loads the release WASM artifact with HTTP and configuration stubs, calls exported gallery functions, and validates JSON fields and extracted URLs.
Reusable Plugin CI workflow .github/workflows/plugin-ci.yml	Defines workflow triggers for pull requests, main pushes, and v* tags; conditionally runs the reusable Plugin CI job with contents: read or the Plugin Release job with contents: write based on tag detection.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant wasm_smoke
  participant Extism
  participant vortex_mod_gallery_wasm
  participant HostStubs
  wasm_smoke->>Extism: load release WASM plugin
  Extism->>HostStubs: provide http_request and get_config
  wasm_smoke->>vortex_mod_gallery_wasm: call gallery exports
  vortex_mod_gallery_wasm-->>wasm_smoke: return JSON results
  wasm_smoke->>wasm_smoke: assert contract fields and URLs

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately captures the main change: adding reproducible plugin verification via CI, toolchain pinning, and smoke testing.

---

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	extism@​1.30.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: cargo im-rc is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/extism@1.30.0 → cargo/im-rc@15.1.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/im-rc@15.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo libc is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/extism@1.30.0 → cargo/libc@0.2.186 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/libc@0.2.186. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo writeable is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/extism@1.30.0 → cargo/writeable@0.6.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/writeable@0.6.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo zerocopy is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/extism@1.30.0 → cargo/zerocopy@0.8.54 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/zerocopy@0.8.54. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[cubic-dev-ai]

All reported issues were addressed across 5 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>