ci: GitHub Actions pipeline — cargo test + llvm-cov + badges (P5 host-testable jobs)

test job runs cargo test across sim + config-lint and cargo-llvm-cov line coverage
on the sim crate; badges job renders loc/tests/coverage shields on push to bringup
([skip ci] + paths-ignore loop guard). mcdc/bench/kernel-build jobs land with
P2/P4/P1. README carries the CI + badge row.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017wB8KB3MMQztRDXCMCkPrf

.github/badges/coverage.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="116" height="20" role="img" aria-label="coverage: pending"><title>coverage: pending</title><filter id="blur"><feGaussianBlur stdDeviation="16"/></filter><linearGradient id="s" x2="0" y2="100%"><stop offset="0" stop-color="#bbb" stop-opacity=".1"/><stop offset="1" stop-opacity=".1"/></linearGradient><clipPath id="r"><rect width="116" height="20" rx="3"/></clipPath><g clip-path="url(#r)"><rect width="61" height="20" fill="#555"/><rect x="61" width="55" height="20" fill="#939393"/><rect width="116" height="20" fill="url(#s)"/></g><g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="110"><g transform="scale(.1)"><g aria-hidden="true" fill="#010101"><text x="315" y="150" fill-opacity=".8" filter="url(#blur)" textLength="510">coverage</text><text x="315" y="150" fill-opacity=".3" textLength="510">coverage</text></g><text x="315" y="140" textLength="510">coverage</text></g><g transform="scale(.1)"><g aria-hidden="true" fill="#010101"><text x="875" y="150" fill-opacity=".8" filter="url(#blur)" textLength="450">pending</text><text x="875" y="150" fill-opacity=".3" textLength="450">pending</text></g><text x="875" y="140" textLength="450">pending</text></g></g></svg>

.github/badges/loc.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="116" height="20" role="img" aria-label="lines of code: 1912"><title>lines of code: 1912</title><filter id="blur"><feGaussianBlur stdDeviation="16"/></filter><linearGradient id="s" x2="0" y2="100%"><stop offset="0" stop-color="#bbb" stop-opacity=".1"/><stop offset="1" stop-opacity=".1"/></linearGradient><clipPath id="r"><rect width="116" height="20" rx="3"/></clipPath><g clip-path="url(#r)"><rect width="79" height="20" fill="#555"/><rect x="79" width="37" height="20" fill="#007ec6"/><rect width="116" height="20" fill="url(#s)"/></g><g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="110"><g transform="scale(.1)"><g aria-hidden="true" fill="#010101"><text x="405" y="150" fill-opacity=".8" filter="url(#blur)" textLength="690">lines of code</text><text x="405" y="150" fill-opacity=".3" textLength="690">lines of code</text></g><text x="405" y="140" textLength="690">lines of code</text></g><g transform="scale(.1)"><g aria-hidden="true" fill="#010101"><text x="965" y="150" fill-opacity=".8" filter="url(#blur)" textLength="270">1912</text><text x="965" y="150" fill-opacity=".3" textLength="270">1912</text></g><text x="965" y="140" textLength="270">1912</text></g></g></svg>

.github/badges/tests.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="106" height="20" role="img" aria-label="tests: 31 passing"><title>tests: 31 passing</title><filter id="blur"><feGaussianBlur stdDeviation="16"/></filter><linearGradient id="s" x2="0" y2="100%"><stop offset="0" stop-color="#bbb" stop-opacity=".1"/><stop offset="1" stop-opacity=".1"/></linearGradient><clipPath id="r"><rect width="106" height="20" rx="3"/></clipPath><g clip-path="url(#r)"><rect width="37" height="20" fill="#555"/><rect x="37" width="69" height="20" fill="#4b0"/><rect width="106" height="20" fill="url(#s)"/></g><g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="110"><g transform="scale(.1)"><g aria-hidden="true" fill="#010101"><text x="195" y="150" fill-opacity=".8" filter="url(#blur)" textLength="270">tests</text><text x="195" y="150" fill-opacity=".3" textLength="270">tests</text></g><text x="195" y="140" textLength="270">tests</text></g><g transform="scale(.1)"><g aria-hidden="true" fill="#010101"><text x="705" y="150" fill-opacity=".8" filter="url(#blur)" textLength="590">31 passing</text><text x="705" y="150" fill-opacity=".3" textLength="590">31 passing</text></g><text x="705" y="140" textLength="590">31 passing</text></g></g></svg>

.github/workflows/ci.yml

@@ -0,0 +1,82 @@
+# warden-sdk CI.
+#
+# Policy (mirrors flare-edge): only GitHub-owned actions get the repo token; the one
+# third-party helper (taiki-e/install-action) is pinned and never handed a token.
+# Host-testable jobs run on GitHub-hosted runners; only the heavy kernel build uses
+# the self-hosted [self-hosted, warden-sdk] runner on bfe-mpc-0640 (added in P5).
+name: ci
+
+on:
+  push:
+    paths-ignore: ['.github/badges/**']
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    outputs:
+      passed: ${{ steps.result.outputs.passed }}
+      coverage: ${{ steps.result.outputs.coverage }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: cargo test (all crates)
+        run: |
+          set -o pipefail
+          : > /tmp/test.log
+          for d in sim tools/config-lint; do
+            echo "== cargo test in $d ==" | tee -a /tmp/test.log
+            ( cd "$d" && cargo test --locked ) 2>&1 | tee -a /tmp/test.log
+          done
+      - name: coverage (cargo-llvm-cov on sim)
+        run: rustup component add llvm-tools-preview
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-llvm-cov
+      - name: run coverage
+        working-directory: sim
+        run: cargo llvm-cov --locked --json --summary-only --output-path /tmp/cov.json
+      - name: parse results
+        id: result
+        run: |
+          passed=$(grep -oE '[0-9]+ passed' /tmp/test.log | awk '{s+=$1} END{print s+0}')
+          pct=$(python3 -c 'import json;print("%.0f"%json.load(open("/tmp/cov.json"))["data"][0]["totals"]["lines"]["percent"])')
+          echo "passed=$passed" >> "$GITHUB_OUTPUT"
+          echo "coverage=$pct" >> "$GITHUB_OUTPUT"
+          echo "tests passed: $passed | sim line coverage: ${pct}%"
+
+  badges:
+    needs: [test]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/bringup'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+      - name: install cloc
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq cloc
+      - name: render badges
+        env:
+          PASSED: ${{ needs.test.outputs.passed }}
+          COVERAGE: ${{ needs.test.outputs.coverage }}
+        run: |
+          mkdir -p .github/badges
+          loc=$(cloc --quiet --json --exclude-dir=target,build,build-target,patches,data,docs . \
+                | python3 -c 'import sys,json; print(json.load(sys.stdin)["SUM"]["code"])')
+          col=orange; [ "${COVERAGE:-0}" -ge 60 ] && col=yellow; [ "${COVERAGE:-0}" -ge 80 ] && col=brightgreen
+          curl -fsSL "https://img.shields.io/badge/lines%20of%20code-${loc}-blue" -o .github/badges/loc.svg
+          curl -fsSL "https://img.shields.io/badge/tests-${PASSED}%20passing-brightgreen" -o .github/badges/tests.svg
+          curl -fsSL "https://img.shields.io/badge/coverage-${COVERAGE}%25-${col}" -o .github/badges/coverage.svg
+      - name: commit badges
+        run: |
+          git config user.name  "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add .github/badges/loc.svg .github/badges/tests.svg .github/badges/coverage.svg
+          if ! git diff --cached --quiet; then
+            git commit -m "ci: update loc/tests/coverage badges [skip ci]"
+            git push
+          fi