ci(contracts): type-check every contract crate before merge

[broda-spendy]

Summary

Makes a broken contract fail CI instead of passing silently. Two small workflow changes, no code.

What changed

rust-wasm.yml — the rust-test job built only -p share-price-math (clippy) and -p mock-strategy. Nothing compiled the vault or bridge-compat crates, so either could be entirely non-compiling and still merge. Added:

- name: Type-check every contract crate
  run: cargo check --workspace --all-targets --locked

--workspace covers all four members, --all-targets includes test code, and --locked fails when Cargo.lock is stale (it currently is — see below).

codeql.yml — the vault build ended in || true, which discards the exit status:

cargo build --release --target wasm32-unknown-unknown -p vault 2>&1 || \
cargo build --release -p vault 2>&1 || true

That || true is why a non-compiling vault reached main: the job went green regardless. The wasm32 build is genuinely expected to fail for the vault (blocked upstream by DataKey contracttype limits), which is presumably why the || true was added. I kept the fallback but pointed it at mock-strategy — the crate that does build to wasm — so the host build of the vault is the thing that must pass:

cargo build --release --target wasm32-unknown-unknown -p mock-strategy || \
cargo build --release -p vault

Why cargo check and not cargo build

check type-checks without producing artifacts, so it is much faster than a full build and catches every compile error that matters here. The wasm32 build in the wasm-build job still covers artifact production for the crates that support it.

Verification

I ran the new command against both sides of the real breakage:

• On upstream/main: fails, immediately, with error: cannot update the lock file ... because --locked was passed — Cargo.lock has no bridge-compat entry even though the workspace lists it.
• On the fix branch: passes, Finished dev profile.

And the codeql.yml fallback was verified by inspection: the vault's wasm32 build is still expected to fail, so the host build is the real gate.

Related

This is the prevention half of the problem. The repair is #1416, which restores compilation across all four crates. This PR is deliberately independent of it so it can merge first — once it does, any future breakage of this kind is caught at the PR rather than discovered later. It also fixes a second blind spot: the stale Cargo.lock that made every --locked step in this workflow fail.

Closes #1304

[drips-wave]

@broda-spendy Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits