fix: verify federation and enforce room access

.github/workflows/ci.yml

@@ -10,6 +10,7 @@ env:
   CARGO_TERM_COLOR: always
   RUSTFLAGS: "-D warnings"
   RUST_BACKTRACE: 1
+  SQLX_OFFLINE: true
 
 jobs:
 
@@ -30,7 +31,9 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
         with: { components: clippy }
       - uses: Swatinem/rust-cache@v2
-      - run: cargo clippy --all-targets --all-features
+      - name: Install native build dependencies
+        run: sudo apt-get update && sudo apt-get install -y pkg-config libssl-dev
+      - run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
 
   test:
     name: Tests
@@ -60,14 +63,16 @@ jobs:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
-      - name: Install psql client
-        run: sudo apt-get install -y postgresql-client
+      - name: Install native build and database dependencies
+        run: sudo apt-get update && sudo apt-get install -y pkg-config libssl-dev postgresql-client
       - name: Run migrations
         run: |
-          PGPASSWORD=vauxl psql -h localhost -U vauxl -d vauxl \
-            -f migrations/001_initial_schema.sql
-      - name: Run tests
-        run: cargo test --all
+          for migration in migrations/*.sql; do
+            PGPASSWORD=vauxl psql -h localhost -U vauxl -d vauxl \
+              -v ON_ERROR_STOP=1 -f "$migration"
+          done
+      - name: Run workspace and HTTP security regression tests
+        run: cargo test --workspace --all-targets --locked
 
   deny:
     name: Security & Licenses (cargo-deny)

.github/workflows/sytest.yml

@@ -1,20 +1,41 @@
-name: Matrix Spec Compliance
+name: Matrix Federation Smoke Checks
 on: [pull_request]
 
 jobs:
-  sytest:
+  matrix-smoke:
     runs-on: ubuntu-latest
-    continue-on-error: true  # don't block PRs until baseline established
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: vauxl
+          POSTGRES_PASSWORD: vauxl
+          POSTGRES_DB: vauxl
+          POSTGRES_HOST_AUTH_METHOD: trust
+        ports: ["5432:5432"]
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+      redis:
+        image: redis:7-alpine
+        ports: ["6379:6379"]
+    env:
+      VAUXL__DATABASE__URL: postgres://vauxl:vauxl@localhost/vauxl?sslmode=disable
+      VAUXL__REDIS__URL: redis://localhost:6379
+      SQLX_OFFLINE: true
     steps:
       - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
       - name: Build server
         run: cargo build --release -p vauxl-server
-      - name: Run Sytest
-        uses: matrix-org/sytest-action@v0
-        with:
-          server-binary: target/release/vauxl-server
-      - name: Upload results
+      - name: Run local Matrix smoke checks
+        run: ./scripts/sytest-smoke.sh target/release/vauxl-server
+      - name: Upload smoke logs
+        if: always()
         uses: actions/upload-artifact@v4
         with:
-          name: sytest-results
-          path: sytest-results.xml
+          name: matrix-smoke-logs
+          path: sytest-server.log