Add credential-free fork CI

[germ-mark]

Gives this fork CI. Until now nothing here had been machine-verified — Actions was disabled, so every commit including the shipped release pin (germ-shadow-safe-exporter) had only ever been checked on a laptop.

Why not just enable the upstream workflows

Several cannot work outside awslabs: Benchmarks on Merge assumes an IAM role in their AWS account, Pull Request Slack Notifier needs their webhook, and Native's coverage step needs their Codecov token. Enabling Actions also turns all nine on at once, which saturates the runners.

They are now disabled through the Actions API rather than deleted, so the files stay byte-identical to upstream and keep resyncing cleanly. Re-enable any with gh workflow enable <id>.

What runs

Nine jobs, no credentials: tests on Linux and macOS (default, safe_extensions, TwoMLSPQ's exact feature set, all-features), lint, cargo hack --each-feature, mls_build_async, thumbv6m-none-eabi, security audit, wasm, and fuzz. The last three are folded in from upstream workflows that were observed passing here before being disabled — keeping them as jobs means one workflow to reason about.

wasm and fuzz are gated off the push trigger (push only fires on germ-integration, whose content has already been through a PR) but stay reachable via workflow_dispatch.

Three traps, each found by a red run

• rustflags: '' on every toolchain step. setup-rust-toolchain defaults RUSTFLAGS to -D warnings, which promotes pre-existing upstream warnings (unused imports in mls-rs, mls-rs-identity-x509) into build errors. It failed each-feature, no_std and macOS on the first run for reasons unrelated to any code under test. Upstream's own wasm and fuzz workflows clear it the same way; strictness stays where the lint job puts it, passed to clippy explicitly.
• macOS must be macos-26. cryptokit-bridge declares swift-tools-version: 6.2; macos-14 ships Xcode 15.4 / Swift 5.10 and dies in the build script — package 'cryptokit-bridge' is using Swift tools version 6.2.0 but the installed version is 5.10.0. The job reports swift --version up front so a future image regression is visible.
• No wasm-pack test --test '*'. client_tests exceeds ChromeDriver's 30s renderer timeout, the driver is SIGKILLed, and wasm-bindgen fails to parse the truncated response — surfacing as the misleading Error: missing field 'chunk'. Not raised by WASM_BINDGEN_TEST_TIMEOUT, and not a code failure: the 395 wasm lib tests pass on the same target.

Runs on refs that lack safe_extensions

That feature arrives with #4, so it does not exist on main, on this branch, or on germ-crypto-providers. Every step referencing it would fail with the package 'mls-rs' does not contain this feature. Feature-specific steps are therefore gated on a probe of mls-rs/Cargo.toml, and the base coverage still runs everywhere — e.g. the async job runs plain test_util unconditionally and test_util,safe_extensions only when present.

Without that gate the workflow_dispatch ref input would be useless for exactly the refs worth checking with it. This PR is the proof: all nine jobs pass here with the feature steps skipped, and the same workflow passes on germ-integration with them running.

Known limitation

For pull_request events GitHub resolves workflow files from the head branch, so this only runs automatically on germ-integration and on PRs whose head contains it. Feature-branch PRs (#4, #6, #7) get no automatic checks.

Making it an ancestor of every feature branch would fix that, at the cost of the property that makes those branches worth having — being based on plain main and submittable upstream as-is. workflow_dispatch takes a ref input instead, so any branch (or a frozen pin) can be checked on demand. See FORK.md on germ-integration.

Status

Green on germ-integration: all nine jobs pass on the PR run, seven on push with wasm/fuzz skipped by design.