[gateway] Add the Gateway runtime, common HTTP layer, lifecycle, and test infrastructure

.github/workflows/gateway-ci.yml

@@ -15,10 +15,8 @@
 # specific language governing permissions and limitations
 # under the License.
 
-# CI gates for the fluss-gateway module. The gateway is its own Cargo workspace,
-# so it gets its own workflow: triggering on gateway changes never builds the
-# fluss-rust workspace, and fluss-rust changes never build the gateway. `uses:`
-# step inputs stay relative to the repository root.
+# Gateway-only CI: gateway changes never build the fluss-rust workspace and vice versa.
+# `uses:` step inputs are relative to the repository root.
 name: Gateway CI
 
 on:
@@ -62,19 +60,29 @@ jobs:
         with:
           workspaces: fluss-gateway
 
+      # Without `--locked` Cargo rewrites a stale lockfile in the CI workspace, and the run would
+      # validate a dependency graph the repository does not contain.
       - name: Build
-        run: cargo build --all-targets
+        run: cargo build --locked --all-targets
 
       - name: Unit Test
-        run: cargo test --all-targets
+        run: cargo test --locked --all-targets
         env:
           RUST_LOG: DEBUG
           RUST_BACKTRACE: full
 
+      - name: OpenAPI drift check
+        run: |
+          cargo test --locked --lib protocol::rest::openapi::tests::export_checked_in_document -- --ignored --exact
+          git diff --exit-code openapi.yaml
+
+      - name: OpenAPI external validation
+        run: npx --yes @redocly/cli@1 lint openapi.yaml
+
   msrv:
     name: "Gateway MSRV (1.88)"
-    # The rust-toolchain.toml floats to stable, so a plain build never catches use of features newer
-    # than the declared rust-version. Pin the MSRV explicitly here; `+toolchain` overrides the file.
+    # rust-toolchain.toml floats to stable, so a plain build never catches features newer
+    # than the declared rust-version; `+toolchain` overrides the file here.
     timeout-minutes: 60
     runs-on: ubuntu-latest
     steps:
@@ -89,7 +97,7 @@ jobs:
           workspaces: fluss-gateway
 
       - name: Check on the declared MSRV
-        run: cargo +1.88.0 check --all-targets
+        run: cargo +1.88.0 check --locked --all-targets
 
   check-license-and-formatting:
     name: "Gateway License and Formatting Check"
@@ -108,7 +116,16 @@ jobs:
           tool: cargo-deny@0.14.22
 
       - name: Check dependency licenses (Apache-compatible)
-        run: cargo deny check licenses
+        run: cargo deny --locked check licenses
+
+      - name: Check banned dependencies (HTTP/2 stack stays out)
+        run: cargo deny --locked check bans
+
+      # The inventory ships with the source release, so a stale one is worse than none.
+      - name: Dependency inventory drift check
+        run: |
+          cargo deny --locked list -f tsv -t 0.6 > DEPENDENCIES.rust.tsv
+          git diff --exit-code DEPENDENCIES.rust.tsv
 
       - name: Rust Cache
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
@@ -119,9 +136,9 @@ jobs:
         run: cargo fmt --all -- --check
 
       - name: Clippy
-        run: cargo clippy --all-targets -- -D warnings
+        run: cargo clippy --locked --all-targets -- -D warnings
 
       - name: Rustdoc
-        run: cargo doc --no-deps
+        run: cargo doc --locked --no-deps
         env:
           RUSTDOCFLAGS: -D warnings