Staging vuln-api contract #14

	name: Staging vuln-api contract

	# The deterministic staging-target contract tests are #[ignore]d so the
	# default `./harness ci` gate stays hermetic (no network). This scheduled,
	# non-blocking job runs them against the live staging worker so endpoint /
	# schema / seed drift is caught out-of-band instead of shipping undetected.
	# It does not gate PRs — failures here signal "the staging contract moved",
	# not "this PR is broken".

	on:
	schedule:
	# Daily at 07:00 UTC.
	- cron: "0 7 * * *"
	workflow_dispatch: {}

	permissions:
	contents: read

	jobs:
	staging-contract:
	name: vuln-api staging contract (non-blocking)
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v6

	- name: Setup Rust
	uses: dtolnay/rust-toolchain@stable

	- name: Cache cargo
	uses: Swatinem/rust-cache@v2

	- name: Run ignored staging contract tests
	run: cargo test --test vuln_api_contract -- --ignored

Sunbelt Computer Software