feat(cryptify): merge cryptify into the workspace

.gitattributes

@@ -5,3 +5,7 @@
 # clean tree. Keeping the stored bytes is also what makes the oasdiff gate's
 # verdict reproducible off a local checkout.
 pg-pkg/api-description.yaml -text
+
+# cryptify's `mod api_gate_tests` in src/main.rs pins its own gate the same
+# way, with anchors copied verbatim out of its spec. Same reasoning.
+cryptify/api-description.yaml -text

.github/workflows/api-diff.yml

@@ -1,6 +1,16 @@
 name: API diff
 #
-# Breaking-change gate on the pg-pkg OpenAPI contract (#249).
+# Breaking-change gate on both OpenAPI contracts (#249, cryptify#196/#202).
+#
+# Two specs, one matrix: pg-pkg/api-description.yaml (versioned /v2 routes)
+# and cryptify/api-description.yaml (unversioned). The matrix is not
+# cosmetic. Both pg-pkg/tests/api_gate.rs and cryptify's `mod
+# api_gate_tests` read this file and require exactly one `fail-on:` and one
+# `include-checks:` line, so that neither can claim a setting the committed
+# job does not use. Two separate oasdiff steps would give two of each and
+# fail both suites; the matrix varies only the spec paths, leaving the two
+# settings written once. Keep it that way: moving `fail-on` into the matrix
+# would remove the literal both tests look for.
 #
 # pg-pkg/api-description.yaml is the pinned v2 HTTP contract (#242), one of the
 # three seams COMPATIBILITY.md guarantees. This job diffs the PR's spec against
@@ -73,8 +83,15 @@ permissions:
 jobs:
 
   breaking-changes:
-    name: API breaking changes (oasdiff)
+    name: API breaking changes (${{ matrix.spec }})
     runs-on: ubuntu-latest
+    strategy:
+      # One spec's verdict must not cancel the other's.
+      fail-fast: false
+      matrix:
+        spec:
+          - pg-pkg/api-description.yaml
+          - cryptify/api-description.yaml
     steps:
       - name: Check out the pull request
         uses: actions/checkout@v6
@@ -94,8 +111,8 @@ jobs:
         # `oasdiff v1.26.1` reproduces what CI decides here.
         uses: oasdiff/oasdiff-action/breaking@0ab8ad204b00d25acc5ae87106281433e288d0c1 # v0.1.10
         with:
-          base: base/pg-pkg/api-description.yaml
-          revision: pg-pkg/api-description.yaml
+          base: base/${{ matrix.spec }}
+          revision: ${{ matrix.spec }}
           fail-on: WARN
           # Both of these rate ERR but are opt-in, so they do not run unless
           # named: a changed non-success status (401 -> 403) and an enum value

.github/workflows/build.yml

@@ -26,46 +26,57 @@ jobs:
   #       uses: SonarSource/sonarqube-scan-action@v6
   #       env:
   #         SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+  # The matrix keys on the crate directory rather than a `pg-` suffix, because
+  # `cryptify` does not carry that prefix. This renames the check contexts from
+  # `Test workspace (core)` to `Test workspace (pg-core)`; nothing required
+  # points at them today (only the two `Wire compat` contexts are required), but
+  # a ruleset added later must use the new names.
   test:
     name: Test workspace
     strategy:
       matrix:
-        workspace: [core, pkg, cli, ffi]
+        crate: [pg-core, pg-pkg, pg-cli, pg-ffi, cryptify]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
-      - if: ${{ matrix.workspace == 'core' }}
-        run: cargo test --manifest-path pg-${{ matrix.workspace }}/Cargo.toml --features test,rust,stream
-      - if: ${{ matrix.workspace != 'core' }}
-        run: cargo test --manifest-path pg-${{ matrix.workspace }}/Cargo.toml --all-features
+      - if: ${{ matrix.crate == 'pg-core' }}
+        run: cargo test --manifest-path pg-core/Cargo.toml --features test,rust,stream
+      # cryptify declares no features of its own, so `--all-targets` (what its
+      # own CI ran) is the equivalent invocation.
+      - if: ${{ matrix.crate == 'cryptify' }}
+        run: cargo test --manifest-path cryptify/Cargo.toml --all-targets
+      - if: ${{ matrix.crate != 'pg-core' && matrix.crate != 'cryptify' }}
+        run: cargo test --manifest-path ${{ matrix.crate }}/Cargo.toml --all-features
 
   format:
     name: Format workspace
     strategy:
       matrix:
-        workspace: [core, pkg, cli, ffi]
+        crate: [pg-core, pg-pkg, pg-cli, pg-ffi, cryptify]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
-      - run: cargo fmt --manifest-path pg-${{ matrix.workspace }}/Cargo.toml --all -- --check
+      - run: cargo fmt --manifest-path ${{ matrix.crate }}/Cargo.toml --all -- --check
 
   clippy:
     name: Clippy workspace
     strategy:
       matrix:
-        workspace: [core, pkg, cli, ffi]
+        crate: [pg-core, pg-pkg, pg-cli, pg-ffi, cryptify]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy
-      - if: ${{ matrix.workspace == 'core' }}
+      - if: ${{ matrix.crate == 'pg-core' }}
         run: cargo clippy --manifest-path pg-core/Cargo.toml --all-targets --features test,rust,stream -- -D warnings
-      - if: ${{ matrix.workspace != 'core' }}
-        run: cargo clippy --manifest-path pg-${{ matrix.workspace }}/Cargo.toml --all-targets --all-features -- -D warnings
+      - if: ${{ matrix.crate == 'cryptify' }}
+        run: cargo clippy --manifest-path cryptify/Cargo.toml --all-targets -- -D warnings
+      - if: ${{ matrix.crate != 'pg-core' && matrix.crate != 'cryptify' }}
+        run: cargo clippy --manifest-path ${{ matrix.crate }}/Cargo.toml --all-targets --all-features -- -D warnings
 
   test-wasm-browsers:
     name: Run wasm tests in browsers