From daff14b8becce5b7e4dbe2f481ba243ed7d8b18f Mon Sep 17 00:00:00 2001
From: chrischeng-c4 <chris.cheng.c4@gmail.com>
Date: Fri, 23 Oct 2026 15:24:47 +0800
Subject: [PATCH 1/2] ci: run fmt, clippy, tests, and the release contract on
 every pull request

Keep had no pull_request workflow, so its PRs had no checks. The issue
loop's review step merges a PR only after its checks pass, and it blocks
the issue of a PR without checks. Add keep-ci on pull_request and on push
to main: cargo fmt --check, clippy with -D warnings, the workspace tests,
and verify-release-contract.py.
---
 .github/workflows/keep-ci.yml | 46 +++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 .github/workflows/keep-ci.yml

diff --git a/.github/workflows/keep-ci.yml b/.github/workflows/keep-ci.yml
new file mode 100644
index 0000000..9129cc9
--- /dev/null
+++ b/.github/workflows/keep-ci.yml
@@ -0,0 +1,46 @@
+# Pull-request and main CI: format, lint, the workspace tests, and the
+# release contract. The issue loop's review step merges a PR only after these
+# checks pass, and a PR without checks blocks its issue.
+name: keep-ci
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: keep-ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  gates:
+    name: fmt, clippy, tests, release contract
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        with:
+          toolchain: stable
+          components: rustfmt, clippy
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          version: 0.12.1
+          enable-cache: false
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          shared-key: keep-ci
+      - name: Run Keep gates
+        shell: bash
+        run: |
+          set -euo pipefail
+          cargo fmt --all -- --check
+          cargo clippy --locked --workspace --all-targets --all-features -- -D warnings
+          cargo test --locked --workspace
+      - name: Release contract
+        shell: bash
+        run: |
+          set -euo pipefail
+          uv run --python 3.13 --no-project scripts/release/verify-release-contract.py --app keep

From cdd007969a0d54ebf6853fc74d88b3e673a5ba0b Mon Sep 17 00:00:00 2001
From: chrischeng-c4 <chris.cheng.c4@gmail.com>
Date: Fri, 23 Oct 2026 15:28:06 +0800
Subject: [PATCH 2/2] ci: pin keep-ci to the Dockerfile's Rust 1.92

Stable Rust 1.99 deprecates AtomicUsize::fetch_update, and clippy -D
warnings fails on it. The image builds with rust:1.92, so CI uses the same
toolchain.
---
 .github/workflows/keep-ci.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/keep-ci.yml b/.github/workflows/keep-ci.yml
index 9129cc9..93682b6 100644
--- a/.github/workflows/keep-ci.yml
+++ b/.github/workflows/keep-ci.yml
@@ -21,9 +21,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      # The Dockerfile's toolchain, so a new stable release does not fail PRs.
       - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
-          toolchain: stable
+          toolchain: "1.92"
           components: rustfmt, clippy
       - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with: