chore: dockerfile manifest guard

.gitea/workflows/ci.yml

@@ -47,4 +47,4 @@ jobs:
       # Layering guards. These live in the Makefile and were previously local-only,
       # so a PR could go green in CI while violating them.
       - name: guards
-        run: make check-appcontext check-handler-deps check-handler-repos check-http-adapter-deps check-federation-off-social check-binaries-are-thin check-sqlite-is-ap-free
+        run: make check-appcontext check-handler-deps check-handler-repos check-http-adapter-deps check-federation-off-social check-sqlite-is-ap-free check-binaries-are-thin check-dockerfile-manifests

.github/workflows/ci.yml

@@ -47,7 +47,7 @@ jobs:
       # Layering guards. These live in the Makefile and were previously local-only,
       # so a PR could go green in CI while violating them.
       - name: guards
-        run: make check-appcontext check-handler-deps check-handler-repos check-http-adapter-deps check-federation-off-social check-binaries-are-thin check-sqlite-is-ap-free
+        run: make check-appcontext check-handler-deps check-handler-repos check-http-adapter-deps check-federation-off-social check-sqlite-is-ap-free check-binaries-are-thin check-dockerfile-manifests
 
   docker:
     name: Build & Push Docker Image

Makefile

@@ -1,6 +1,6 @@
 .DEFAULT_GOAL := check
 
-check: fmt-check clippy test test-federation-off check-appcontext check-handler-deps check-handler-repos check-http-adapter-deps check-federation-off-social check-binaries-are-thin check-sqlite-is-ap-free
+check: fmt-check clippy test test-federation-off check-appcontext check-handler-deps check-handler-repos check-http-adapter-deps check-federation-off-social check-sqlite-is-ap-free check-binaries-are-thin check-dockerfile-manifests
 	@echo "✅ All checks passed"
 
 check-appcontext:
@@ -87,6 +87,22 @@ check-sqlite-is-ap-free:
 	fi
 	@echo "✅ sqlite crate depends on no k-ap, activitypub, or *-federation crate"
 
+check-dockerfile-manifests:
+	@members=$$(awk '/^members = \[/{f=1;next} f&&/^\]/{f=0} f' Cargo.toml | sed -n 's/^[[:space:]]*"\(.*\)",\{0,1\}[[:space:]]*$$/\1/p'); \
+	copied=$$(sed -n 's/^COPY \([^[:space:]]*\)\/Cargo\.toml[[:space:]].*/\1/p' Dockerfile | grep -v '^\(Cargo\.toml\|\.\)$$' || true); \
+	bad=""; \
+	for m in $$members; do \
+	    echo "$$copied" | grep -qx "$$m" || bad="$$bad missing-COPY:$$m"; \
+	done; \
+	for c in $$copied; do \
+	    echo "$$members" | grep -qx "$$c" || bad="$$bad not-a-member:$$c"; \
+	done; \
+	if [ -n "$$bad" ]; then \
+	    echo "❌ Dockerfile manifest COPY lines out of sync with workspace members:$$bad"; \
+	    exit 1; \
+	fi; \
+	echo "✅ Dockerfile copies a manifest for every workspace member"
+
 fmt:
 	cargo fmt
 
@@ -129,4 +145,4 @@ dev-spa:
 spa-dev:
 	@npm --prefix spa run dev
 
-.PHONY: check fmt fmt-check clippy test test-federation-off fix dev dev-stop dev-worker dev-spa spa-dev check-appcontext check-handler-deps check-handler-repos check-http-adapter-deps check-federation-off-social check-binaries-are-thin check-sqlite-is-ap-free
+.PHONY: check fmt fmt-check clippy test test-federation-off fix dev dev-stop dev-worker dev-spa spa-dev check-appcontext check-handler-deps check-handler-repos check-http-adapter-deps check-federation-off-social check-sqlite-is-ap-free check-binaries-are-thin check-dockerfile-manifests