fix(ci): warm lifecycle dependency checks

[ahrav]

Summary

Plugin CI now warms the exact mc-host dependency graph after provisioning metadata-only sibling manifests. The release dependency-boundary test remains strict but no longer spends its five-second test budget downloading crates on the first cargo tree invocation.

Verification

• cargo tree -p mc-host -e normal
• Focused dependency-boundary test: passed in 113ms after warmup
• Workflow YAML parses

Stack

Layer 8 of 8 above #46. Parent: #65.

[claude]

Nit: check-plugin doesn't set up a Rust toolchain anywhere in this job (no dtolnay/rust-toolchain@stable step, unlike shm-crash-recovery, shm-source-build, and mc-host-lifecycle), so this step relies entirely on whatever cargo/rustc happens to be preinstalled on the ubuntu-latest runner image. That's not a new dependency introduced by this PR — the dependency-boundary test already invoked cargo tree in-process here — but now that a dedicated step exists, it'd be more robust/consistent to add an explicit toolchain step before it, so a runner-image change (or version drift between this job and the other Rust jobs) doesn't cause a silent failure that's hard to trace back to "no toolchain installed."

[claude]

Review

Small, well-targeted change: adding a dedicated "Warm mc-host dependency graph" step (cargo tree -p mc-host -e normal) before bun run test so the crates.io download that the dependency-boundary test (scripts/generate-mc-host-release-manifest.test.ts) triggers on first invocation happens outside that test's timeout budget, rather than inside it.

Assessment:

• Correctness: the warm-up invocation uses the exact same command/flags (-p mc-host -e normal) and working directory (repo root) as the test's execSync call, so the local cargo registry/target cache populated here is actually reused by the test — this should reliably fix the flake described in the PR summary.
• Output handling: >/dev/null discards stdout while leaving stderr visible, and a non-zero exit still fails the step, so failures remain visible with a clear, dedicated step name rather than surfacing as a mysterious test timeout.
• Scope: minimal, single-purpose change with no impact on other jobs.

One nit left as an inline comment: this job never installs a Rust toolchain explicitly (unlike shm-crash-recovery, shm-source-build, and mc-host-lifecycle, which all use dtolnay/rust-toolchain@stable), so cargo here is whatever's preinstalled on the ubuntu-latest image. That's pre-existing (the test already called cargo tree in this job before this PR), not introduced by this change, but worth a follow-up for consistency/robustness now that there's a named step depending on it.

No security or performance concerns beyond the above — this only affects CI plumbing.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 2783d38b-4f89-4e35-9550-c1b45b59534b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for security reviews. Please try again later.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (1 file)

• .github/workflows/ci.yml

---

_{Reviewed by gemini-3.7-flash · Input: 117.7K · Output: 6.2K · Cached: 293.4K}