Agent/cloudkit v2 checkpoint repair

.github/workflows/bridge-bindings.yml

@@ -0,0 +1,153 @@
+name: Rust bridge validation
+
+on:
+  workflow_dispatch:
+    inputs:
+      allow_generated_drift:
+        description: Upload regenerated bindings without failing the manual run
+        required: false
+        default: false
+        type: boolean
+  push:
+    paths:
+      - ".github/workflows/bridge-bindings.yml"
+      - ".gitmodules"
+      - "rust/Cargo.toml"
+      - "rust/Cargo.lock"
+      - "rust/src/**"
+      - "rustpush"
+      - "rust/src/api/**"
+      - "flutter_rust_bridge.yaml"
+      - "lib/src/rust/**"
+      - "rust/src/frb_generated*"
+  pull_request:
+    paths:
+      - ".github/workflows/bridge-bindings.yml"
+      - ".gitmodules"
+      - "rust/Cargo.toml"
+      - "rust/Cargo.lock"
+      - "rust/src/**"
+      - "rustpush"
+      - "rust/src/api/**"
+      - "flutter_rust_bridge.yaml"
+      - "lib/src/rust/**"
+      - "rust/src/frb_generated*"
+
+jobs:
+  bindings:
+    # Generated bindings must be reproducible, so pin the image instead of
+    # letting ubuntu-latest drift the toolchain under the drift check.
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          submodules: recursive
+
+      - name: Set up Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Set up Flutter for bridge generation
+        uses: subosito/flutter-action@v2
+        with:
+          flutter-version: "3.44.8"
+          channel: stable
+
+      - name: Install native build tools
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y protobuf-compiler
+
+      - name: Set up test FairPlay certificates
+        shell: bash
+        run: |
+          destination="rustpush/certs/fairplay"
+          mkdir -p "$destination"
+          for name in \
+            4056631661436364584235346952193 \
+            4056631661436364584235346952194 \
+            4056631661436364584235346952195 \
+            4056631661436364584235346952196 \
+            4056631661436364584235346952197 \
+            4056631661436364584235346952198 \
+            4056631661436364584235346952199 \
+            4056631661436364584235346952200 \
+            4056631661436364584235346952201 \
+            4056631661436364584235346952208
+          do
+            cp rustpush/certs/legacy-fairplay/fairplay.pem "$destination/$name.pem"
+            cp rustpush/certs/legacy-fairplay/fairplay.crt "$destination/$name.crt"
+          done
+
+      - name: Install pinned Flutter Rust Bridge generator
+        shell: bash
+        run: |
+          archive="${RUNNER_TEMP}/flutter_rust_bridge_codegen.tgz"
+          url="https://github.com/fzyzcjy/flutter_rust_bridge/releases/download/v2.3.0/flutter_rust_bridge_codegen-x86_64-unknown-linux-gnu-v2.3.0.tgz"
+          curl --fail --location --silent --show-error "$url" --output "$archive"
+          echo "bb3a5e3d1f17a543e73f8dfff886e883928b95e3a9d19ca5268da40952d80cee  $archive" | sha256sum --check --strict
+          mkdir -p "${RUNNER_TEMP}/frb-codegen"
+          tar -xzf "$archive" -C "${RUNNER_TEMP}/frb-codegen"
+          echo "${RUNNER_TEMP}/frb-codegen" >> "$GITHUB_PATH"
+
+      - name: Regenerate committed bridge bindings
+        shell: bash
+        run: flutter_rust_bridge_codegen generate --config-file flutter_rust_bridge.yaml
+
+      - name: Normalize generated SSE implementations
+        shell: pwsh
+        run: |
+          ./tooling/frb/guard_generated_sse_impls.ps1 -Mode Deduplicate -ExpectedRemovalCount 6
+          ./tooling/frb/guard_generated_sse_impls.ps1 -Mode Verify
+
+      - name: Upload regenerated bridge bindings
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: regenerated-rust-bridge-bindings
+          if-no-files-found: error
+          retention-days: 7
+          path: |
+            lib/src/rust/api/api.dart
+            lib/src/rust/frb_generated.dart
+            lib/src/rust/frb_generated.io.dart
+            lib/src/rust/frb_generated.web.dart
+            rust/src/frb_generated.rs
+            rust/src/frb_generated.io.rs
+            rust/src/frb_generated.web.rs
+
+      - name: Verify committed bridge bindings are reproducible
+        if: github.event_name != 'workflow_dispatch' || inputs.allow_generated_drift != true
+        shell: bash
+        run: |
+          git diff --exit-code -- \
+            lib/src/rust/api/api.dart \
+            lib/src/rust/frb_generated.dart \
+            lib/src/rust/frb_generated.io.dart \
+            lib/src/rust/frb_generated.web.dart \
+            rust/src/frb_generated.rs \
+            rust/src/frb_generated.io.rs \
+            rust/src/frb_generated.web.rs
+
+      - name: Compile committed Rust bridge
+        run: cargo check --manifest-path rust/Cargo.toml --lib --message-format short
+
+      # cargo check --lib does not even compile #[cfg(test)] code, so until now
+      # no Rust test in this repository could fail a build. That covered the
+      # canonical converter, the DTO parsers, the protected store, and the
+      # keyed identity hasher. A suite that cannot fail a build is not a gate.
+      - name: Run Rust tests
+        run: cargo test --manifest-path rust/Cargo.toml --lib
+
+      # Tests inside the rustpush submodule are not executed when rustpush is
+      # compiled only as a dependency of the bridge crate. Keep its protocol,
+      # concurrency, and log-redaction tests as an independent gate. Match the
+      # production bridge's non-macOS Anisette provider feature so icloud_auth
+      # exposes the same provider types that the application compiles against.
+      - name: Run rustpush tests
+        run: cargo test --manifest-path rustpush/Cargo.toml --lib --features remote-anisette-v3
+
+      # The protector harness is a separate crate and is deliberately
+      # dependency-light so these security invariants can run on hosts where the
+      # full application crate cannot build.
+      - name: Run the Cloud Sync protector harness
+        run: cargo test --manifest-path rust/cloud_sync_protector_harness/Cargo.toml