ci: add reproducible plugin verification

[mpiton]

Summary

• track Cargo.lock for reproducible CI
• pin the supported Rust toolchain and WASM target
• add the central reusable plugin CI
• complete WASM extraction and resolution smoke coverage
• use upstream Extism 1.30.0

Validation

• 61 unit tests, the folder test and 5 WASM smokes pass
• native and WASM Clippy, release build and cargo audit pass

Linear: MAT-129

---

Summary by cubic

Adds reproducible plugin CI with scoped permissions and owner-only releases. Makes WASM smoke tests mandatory and fully exercises extraction and resolution via the http_request boundary; fulfills Linear MAT-129.

• New Features

  • Reusable workflows: verification on PRs/main (read-only), release on v* tags (write); pinned (repinned) to canonical workflows by SHA; restrict releases to the repository owner.
  • Track Cargo.lock; pin Rust 1.95.0 and target wasm32-wasip1 via rust-toolchain.toml.

• Dependencies

  • Pin extism to =1.30.0.

^{Written for commit ad0b00c. Summary will update on new commits.}

Summary by CodeRabbit

• New Features

  • Added automated CI workflows for pull requests, main-branch updates, and version releases.
  • Added a standardized Rust toolchain with WebAssembly support.

• Tests

  • WASM end-to-end and smoke tests now run as required checks.
  • Expanded smoke-test coverage for link extraction and stream URL resolution.

• Documentation

  • Updated testing instructions to reflect mandatory WASM test execution.

• Chores

  • Improved build artifact and backup-file handling.
  • Locked the test dependency to a specific compatible version.

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[coderabbitai]

📝 Walkthrough

Walkthrough

The pull request pins the Rust/WASM toolchain, makes WASM tests fail when artifacts are missing, adds smoke coverage for runtime exports, updates test documentation, and introduces conditional reusable workflows for plugin CI and tagged releases.

Changes

WASM validation and plugin delivery

Layer / File(s)	Summary
Pin Rust and repository build configuration rust-toolchain.toml, Cargo.toml, .gitignore	The project now uses Rust 1.95.0 with WASI tooling, pins Extism to =1.30.0, and ignores Rust build and backup artifacts while tracking Cargo.lock.
Require and exercise the WASM artifact tests/folder_e2e.rs, tests/wasm_smoke.rs	End-to-end and smoke tests now fail when the release WASM artifact is absent; smoke coverage uses structured Mega metadata and verifies runtime exports.
Run plugin CI and release workflows README.md, .github/workflows/plugin-ci.yml	Documentation marks WASM smoke tests as mandatory, while pull requests, main-branch pushes, and version tags invoke reusable CI or release workflows with corresponding contents permissions.

Estimated code review effort: 2 (Simple) | ~15 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 60.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and clearly reflects the main CI-focused change to reproducible plugin verification.

---

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​thiserror@​2.0.18
	cargo/​extism@​1.30.0
	cargo/​serde@​1.0.228
	cargo/​serde_json@​1.0.149
	cargo/​aes@​0.8.4
	cargo/​base64@​0.22.1
	cargo/​ctr@​0.9.2
	cargo/​extism-pdk@​1.4.1
	cargo/​hex-literal@​0.4.1
	cargo/​regex@​1.12.3
	cargo/​rstest@​0.24.0
	cargo/​sha2@​0.10.9

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: cargo cbindgen is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/extism@1.30.0 → cargo/cbindgen@0.29.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/cbindgen@0.29.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo im-rc is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/extism@1.30.0 → cargo/im-rc@15.1.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/im-rc@15.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo libc is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/extism@1.30.0 → cargo/sha2@0.10.9 → cargo/aes@0.8.4 → cargo/libc@0.2.186 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/libc@0.2.186. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo writeable is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/extism@1.30.0 → cargo/writeable@0.6.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/writeable@0.6.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo zerocopy is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/extism@1.30.0 → cargo/zerocopy@0.8.48 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/zerocopy@0.8.48. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[cubic-dev-ai]

All reported issues were addressed across 7 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[coderabbitai]

🧹 Nitpick comments (1)

tests/wasm_smoke.rs (1)

21-29: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Extract duplicated wasm_path()/require_wasm! into a shared test helper.

Both files carry an identical artifact-path helper and now-trivial macro; a shared tests/common/mod.rs (or similar) would avoid future drift between the two copies.

• tests/wasm_smoke.rs#L21-L29: move wasm_path() (and the require_wasm! macro at L53-L57) into a shared test helper module and include!/mod-import it here.
• tests/folder_e2e.rs#L20-L28: remove the duplicate wasm_path()/require_wasm! (L111-L115) and import the same shared helper.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/wasm_smoke.rs` around lines 21 - 29, The duplicated wasm_path() helper
and require_wasm! macro should be centralized in a shared tests/common/mod.rs
(or equivalent) module. Move both definitions from tests/wasm_smoke.rs#L21-L29
and its macro at L53-L57 into the shared helper, then import that module in
tests/wasm_smoke.rs. Remove the duplicate definitions from
tests/folder_e2e.rs#L20-L28 and its macro at L111-L115, and import the same
shared helper there.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@tests/wasm_smoke.rs`:
- Around line 21-29: The duplicated wasm_path() helper and require_wasm! macro
should be centralized in a shared tests/common/mod.rs (or equivalent) module.
Move both definitions from tests/wasm_smoke.rs#L21-L29 and its macro at L53-L57
into the shared helper, then import that module in tests/wasm_smoke.rs. Remove
the duplicate definitions from tests/folder_e2e.rs#L20-L28 and its macro at
L111-L115, and import the same shared helper there.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 2137ccb4-4d9e-4a93-aa97-bdee4ff884d1

📥 Commits

Reviewing files that changed from the base of the PR and between 1b015c5 and 5cf6108.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (7)

• .github/workflows/plugin-ci.yml
• .gitignore
• Cargo.toml
• README.md
• rust-toolchain.toml
• tests/folder_e2e.rs
• tests/wasm_smoke.rs

💤 Files with no reviewable changes (1)

• .gitignore