Add Github CI test gate

.config/nextest.toml

@@ -1,6 +1,10 @@
 # cargo-nextest configuration
 # https://nexte.st/docs/configuration/reference/
 
+[profile.default]
+# Hard timeout rule from TESTING.md: every full test run must complete within 120 seconds
+slow-timeout = { period = "60s", terminate-after = 2 }
+
 [profile.default.junit]
 path = "/tmp/junit.xml"
 store-success-output = false

.devcontainer/Dockerfile

@@ -20,6 +20,9 @@ RUN curl -LsSf https://astral.sh/uv/install.sh | sh
 # Install cargo-nextest (pinned version for consistency with CI)
 RUN cargo install --locked cargo-nextest --version 0.9.85
 
+# Install ratchets for code quality checks (pinned version)
+RUN cargo install --locked ratchets --version 0.2.4
+
 # Set working directory (must match where source is copied later via add_local_dir)
 WORKDIR /app
 

.github/workflows/ci.yml

@@ -5,6 +5,7 @@ on:
     branches: [ main ]
   pull_request:
     branches: [ main ]
+  workflow_dispatch:
 
 env:
   CARGO_TERM_COLOR: always
@@ -22,16 +23,25 @@ jobs:
     - name: Cache Rust dependencies
       uses: Swatinem/rust-cache@v2
 
-    - name: Install cargo-nextest
+    - name: Install cargo tools
       uses: taiki-e/install-action@v2
       with:
-        tool: cargo-nextest
+        tool: cargo-nextest,cargo-deny,ratchets@0.2.4
 
     - name: Check formatting
       run: cargo fmt --check
 
     - name: Run clippy
       run: cargo clippy --all-targets --all-features -- -D warnings
 
+    - name: Build
+      run: cargo build --all-targets
+
+    - name: Check dependencies
+      run: cargo deny check
+
+    - name: Check code quality (ratchets)
+      run: ratchets check
+
     - name: Run tests
       run: cargo nextest run

ratchet-counts.toml

@@ -1,7 +1,13 @@
 # Ratchet violation budgets
 # These counts represent the maximum tolerated violations.
 # Counts can only be reduced (tightened) or explicitly bumped with justification.
+#
+# Regions:
+#   "." = global (all code)
+#   "scripts" = Python helper scripts (modal_sandbox.py etc.)
+#   "examples/tests" = test fixtures with intentionally "bad" patterns
 
+# Python rules (all zero globally, scripts has exceptions)
 [no-args-in-docstrings]
 "." = 0
 
@@ -39,9 +45,6 @@
 "." = 0
 "scripts" = 1
 
-[no-expect]
-"." = 0
-
 [no-fixme-comments]
 "." = 0
 
@@ -84,10 +87,6 @@
 [no-pandas-import]
 "." = 0
 
-[no-panic]
-"." = 0
-"src" = 1
-
 [no-relative-imports]
 "." = 0
 
@@ -98,10 +97,6 @@
 "." = 0
 "examples/tests" = 5
 
-[no-todo-comments]
-"." = 0
-"src" = 14
-
 [no-trailing-comments]
 "." = 0
 "scripts" = 6
@@ -112,15 +107,24 @@
 [no-underscore-imports]
 "." = 0
 
-[no-unwrap]
-"." = 0
-
 [no-while-true]
 "." = 0
 
 [no-yaml-usage]
 "." = 0
 
-[rust-no-todo-comments]
-"src" = 14
+# Rust rules (global budgets)
+[no-expect]
+"." = 0
+
+[no-panic]
+"." = 1
 
+[no-todo-comments]
+"." = 14
+
+[no-unwrap]
+"." = 4
+
+[rust-no-todo-comments]
+"." = 14

ratchet.toml → ratchets.toml

@@ -1,4 +1,4 @@
-[ratchet]
+[ratchets]
 version = "1"
 
 # Languages to enable (uncomment as needed)