ci: fail open on sccache when R2 secrets are absent

.github/workflows/ci.yml

@@ -25,13 +25,19 @@ env:
   # Dockerfile build, and the local host sccache — one silo, zero egress cost.
   # Set at the workflow env level (not the composite) because composite actions
   # cannot read the `secrets` context. Keys are content-addressed on the full
-  # compiler input, and the sole build.rs (cow-venue) + nexum-macros are
+  # compiler input, and the sole build.rs (cow-venue) + the macro crates are
   # deterministic, so PR builds writing to the shared bucket write correct objects
   # under correct keys (no poisoning); bound storage with an R2 lifecycle-expiry
   # rule on the bucket (sccache does not evict cloud backends itself).
-  RUSTC_WRAPPER: sccache
+  # Secrets do not flow to fork pull_request runs: R2_ACCOUNT_ID interpolates
+  # empty and the R2 backend would fail sccache server startup before anything
+  # compiles. Fail open on forks: an empty RUSTC_WRAPPER disables the wrapper
+  # (cargo treats empty as unset) and an empty SCCACHE_BUCKET drops sccache to
+  # its local-disk default, so the action's post-run stats step still starts a
+  # server. Fork PRs build uncached but green.
+  RUSTC_WRAPPER: ${{ secrets.R2_ACCOUNT_ID != '' && 'sccache' || '' }}
   CARGO_INCREMENTAL: "0"
-  SCCACHE_BUCKET: shepherd-sccache
+  SCCACHE_BUCKET: ${{ secrets.R2_ACCOUNT_ID != '' && 'shepherd-sccache' || '' }}
   SCCACHE_ENDPOINT: https://${{ secrets.R2_ACCOUNT_ID }}.r2.cloudflarestorage.com
   SCCACHE_REGION: auto
   SCCACHE_S3_KEY_PREFIX: ci/rust-1.94
@@ -78,7 +84,8 @@ jobs:
       - uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
         with:
           tool: nextest
-      # Build all 15 guest module wasms ONCE (release/wasm32-wasip2): the single
+      # Build all 18 guest wasms ONCE (17 modules + the cow adapter,
+      # release/wasm32-wasip2): the single
       # source of truth for guest buildability and the artifacts the integration
       # tests load. Replaces the deleted 9-way build-module matrix, which recompiled
       # the shared wasm dependency graph ~9x cold. Per-module size report folded in;
@@ -88,8 +95,13 @@ jobs:
           cargo build --release --target wasm32-wasip2 --locked \
             -p example -p twap-monitor -p ethflow-watcher -p price-alert \
             -p balance-tracker -p stop-loss -p http-probe -p echo-venue \
-            -p echo-client -p clock-reader -p flaky-bomb -p fuel-bomb \
-            -p memory-bomb -p panic-bomb -p slow-host
+            -p echo-client -p echo-keeper -p clock-reader -p flaky-bomb -p flaky-venue \
+            -p fuel-bomb -p memory-bomb -p panic-bomb -p slow-host
+          # Separate invocation on purpose: unifying `cow-venue/adapter`
+          # into the module build would link the adapter's component
+          # export glue into every keeper module wasm.
+          cargo build --release --target wasm32-wasip2 --locked \
+            -p cow-venue --features cow-venue/adapter
           {
             echo "### module .wasm sizes"
             echo "| module | bytes |"
@@ -143,3 +155,30 @@ jobs:
           CXX_aarch64_unknown_linux_gnu: aarch64-linux-gnu-g++
           AR_aarch64_unknown_linux_gnu: aarch64-linux-gnu-ar
         run: cargo check --workspace --all-features --locked --target aarch64-unknown-linux-gnu
+
+  # Blocking zero-leak gate: host-layer crate graphs stay venue-free, the
+  # runtime Rust sources carry no charter symbol and no privileged router
+  # field, and nexum:host names no foreign WIT package and resolves as a
+  # leaf (scripts/check-venue-agnostic.sh).
+  venue-agnostic:
+    name: venue-agnostic
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: ./.github/actions/rust-setup
+      - uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
+        with:
+          tool: wasm-tools,ripgrep
+      - run: ./scripts/check-venue-agnostic.sh
+
+  # Blocking orderbook-only gate: the CoW venue crate carries no
+  # composable symbol (scripts/check-cow-orderbook-only.sh).
+  cow-orderbook-only:
+    name: cow-orderbook-only
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
+        with:
+          tool: ripgrep
+      - run: ./scripts/check-cow-orderbook-only.sh