Add repository CI workflow

.github/workflows/ci.yml

@@ -0,0 +1,44 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  CI: "true"
+  FORCE_COLOR: "1"
+
+jobs:
+  ci:
+    name: Rust checks
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+
+      - name: Activate Hermit
+        uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
+        with:
+          cache: "true"
+
+      - name: Restore Rust cache
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          workspaces: . -> target
+
+      - name: Run repository CI
+        run: just ci

Justfile

@@ -27,7 +27,12 @@ protos:
 
   # Download all protos without transitive deps (-i) to avoid pulling in
   # ~250 arcade/UI/franklin protos via client_renderable.proto
-  bin/schema-registry get --save-to=protos -i \
+  if ! command -v schema-registry >/dev/null 2>&1; then
+    echo "schema-registry is not a public Hermit package; install the internal CLI separately to refresh protos." >&2
+    exit 1
+  fi
+
+  schema-registry get --save-to=protos -i \
     google/api/annotations.proto \
     google/api/http.proto \
     squareup/cash/kgoose/api/v3/tool_endpoint_service.proto \

bin/hermit.hcl

@@ -1,4 +1,2 @@
-manage-git = false
-
-github-token-auth {
-}
+sources = ["https://github.com/cashapp/hermit-packages.git"]
+manage-git = true