protocol-drift.yml

name: Protocol Drift

# Fails fast if the in-tree `animus-plugin-protocol` crate diverges from
# the published `launchapp-dev/animus-protocol` crate. Plugin authors
# depend on the published crate, so any in-tree-only addition that hasn't
# yet shipped as a standalone release means plugins built against the
# published crate can send wire shapes the in-tree host won't understand —
# or vice versa.
#
# The job clones the standalone repo at the pinned tag, exports the path
# to `animus-plugin-protocol/src/lib.rs`, and runs the
# `crates/orchestrator-plugin-host/tests/protocol_drift.rs` integration
# test. The test parses both crates with `syn`, extracts their public
# surface, and panics if anything diverges that isn't on the test's
# `expected_in_tree_only` allowlist.
#
# Note: the corresponding `animus-subject-protocol` drift gate was
# retired in v0.5 when the in-tree mirror at
# `crates/animus-subject-protocol/` was deleted. The CLI and daemon now
# consume the subject crate exclusively from the published git tag.

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: protocol-drift-${{ github.ref }}
  cancel-in-progress: true

env:
  # GitHub Actions runner Node 20 -> Node 24 deprecation (effective 2026-06-02).
  # Forces JS-based actions onto Node 24 ahead of the cutover.
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  drift:
    name: protocol drift check
    runs-on: ubuntu-latest
    timeout-minutes: 15
    env:
      CARGO_TERM_COLOR: always
      # Pinned tag for the published animus-plugin-protocol crate. Bump this
      # when a new standalone release ships; the in-tree crate is expected
      # to match the surface at this tag (modulo entries the test's
      # `expected_in_tree_only` allowlist documents as pending-release).
      STANDALONE_TAG: v0.1.27

    steps:
      - name: Checkout ao-cli (in-tree protocol)
        uses: actions/checkout@v4
        with:
          path: ao-cli

      - name: Checkout animus-protocol (standalone)
        uses: actions/checkout@v4
        with:
          repository: launchapp-dev/animus-protocol
          ref: ${{ env.STANDALONE_TAG }}
          path: animus-protocol

      - name: Verify standalone lib.rs file is present
        run: |
          set -euo pipefail
          STANDALONE_LIB="$GITHUB_WORKSPACE/animus-protocol/animus-plugin-protocol/src/lib.rs"
          if [ ! -f "$STANDALONE_LIB" ]; then
            echo "::error::standalone animus-plugin-protocol/src/lib.rs not found at $STANDALONE_LIB"
            exit 1
          fi
          echo "Resolved standalone plugin lib.rs at $STANDALONE_LIB"

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Cargo build artifacts
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: ao-cli

      - name: Run protocol drift tests
        working-directory: ao-cli
        env:
          ANIMUS_STANDALONE_PROTOCOL_PATH: ${{ github.workspace }}/animus-protocol/animus-plugin-protocol/src/lib.rs
        run: |
          cargo test --locked -p orchestrator-plugin-host --test protocol_drift -- --nocapture