CI: pinned actions, cargo deny, fuzz smoke; build-android.sh works on Linux

- deny.toml: allow-wildcard-paths for the workspace's own path crates; ignore two
  unmaintained notices for uniffi 0.28's build-time deps (bincode, paste).
- build-android.sh ran uniffi-bindgen on libkv_ffi.dylib, which doesn't exist on the
  Linux CI runner; pick .so there.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

.github/workflows/ci.yml

@@ -1,13 +1,58 @@
 name: ci
-on: [push, pull_request]
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: dtolnay/rust-toolchain@stable
+        with: { persist-credentials: false }
-        with: { components: "clippy,rustfmt" }
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master, 2026-10
+        with: { toolchain: stable, components: "clippy, rustfmt" }
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       - run: cargo fmt --all --check
       - run: cargo clippy --workspace --all-targets -- -D warnings
       - run: cargo test --workspace
-      - uses: EmbarkStudios/cargo-deny-action@v2
+
+  deny:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with: { persist-credentials: false }
+      - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
+        with: { command: check, arguments: --all-features }
+
+  # Builds every fuzz target and runs each for a minute from the checked-in seeds (fuzz/README.md).
+  fuzz:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with: { persist-credentials: false }
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master, 2026-10
+        with: { toolchain: nightly }
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with: { workspaces: fuzz }
+      - run: cargo install cargo-fuzz --locked
+      - name: Fuzz smoke run
+        working-directory: fuzz
+        run: |
+          for t in $(cargo +nightly fuzz list); do
+            mkdir -p "$RUNNER_TEMP/corpus/$t"
+            cargo +nightly fuzz run "$t" "$RUNNER_TEMP/corpus/$t" "seeds/$t" -- -max_total_time=60 -max_len=4096
+          done
+      - if: failure()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with: { name: fuzz-artifacts, path: fuzz/artifacts }

deny.toml

@@ -2,6 +2,13 @@
 [advisories]
 version = 2
 yanked = "deny"
+ignore = [
+  # Unmaintained (no known vulnerability), build-time only: pulled in by uniffi 0.28's proc-macros and
+  # bindgen, never linked into the shipped library's runtime paths. Goes away with a uniffi upgrade,
+  # which regenerates the Swift/Kotlin bindings (tracked in fuzz/README.md "Dependency policy").
+  { id = "RUSTSEC-2025-0141", reason = "bincode 1.x via uniffi_macros 0.28 (build-time)" },
+  { id = "RUSTSEC-2024-0436", reason = "paste via uniffi_core/uniffi_bindgen 0.28 (proc-macro)" },
+]
 
 [licenses]
 version = 2
@@ -13,6 +20,8 @@ confidence-threshold = 0.9
 [bans]
 multiple-versions = "warn"
 wildcards = "deny"
+# The workspace's own crates are path dependencies without a version; they are never published.
+allow-wildcard-paths = true
 
 [sources]
 unknown-registry = "deny"

scripts/build-android.sh

@@ -5,6 +5,7 @@ cd "$(dirname "$0")/.."
 OUT=../kestrove-android/core-ffi/src/main
 rustup target add aarch64-linux-android armv7-linux-androideabi x86_64-linux-android
 cargo ndk -t arm64-v8a -t armeabi-v7a -t x86_64 -o "$OUT/jniLibs" build -p kv-ffi --release
-cargo build -p kv-ffi
+cargo build -p kv-ffi   # host library for library-mode bindgen (.so on Linux CI, .dylib on macOS)
-cargo run -p kv-ffi --bin uniffi-bindgen -- generate --library target/debug/libkv_ffi.dylib --language kotlin --out-dir "$OUT/java"
+case "$(uname -s)" in Darwin) HOST_LIB=libkv_ffi.dylib ;; *) HOST_LIB=libkv_ffi.so ;; esac
+cargo run -p kv-ffi --bin uniffi-bindgen -- generate --library "target/debug/$HOST_LIB" --language kotlin --out-dir "$OUT/java"
 echo "✅ Android libs + bindings written to $OUT"