ci: make the stale-secrets check able to actually detect stale secrets

The job's own header claims it catches "drift between the secrets and the
working tree ... if the maintainer edited src/*.rs locally and forgot to re-pack
+ refresh the GitHub secrets". It could not. It runs on a fresh checkout where
src/* is gitignored and therefore absent, so `verify --from-env` unpacks the
secrets and compares them against themselves - self-consistent by construction,
and green no matter how old they are.

That gap is not hypothetical. A fix to src/fast_uf.rs sat local-only for over
four hours today while this job reported success on every push: the secrets were
last written at 12:46 and the edit was made at 17:04, so CI and every wheel it
would have built were compiled from source nobody was testing against.

Anchor the core's identity in something that travels with a commit. `pack` now
writes rust_core.sha256 - tracked, unlike src/* - and the new `check-manifest`
subcommand rebuilds the archive from the restored tree and compares. In CI that
runs after `unpack --from-env`, so the restored tree hashes to whatever the
secrets actually hold: if they are older than the last pack the digests differ
and the job fails with the exact commands to fix it.

Verified both directions locally: matching tree exits 0; appending one comment
line to src/fast_uf.rs makes it exit 1 with the mismatch report.

Blast radius is small on purpose - check-manifest gates nothing but this
advisory job, and release-build's publish path still keys off `verify`.

Author: qectorlab

.github/workflows/stale-secrets.yml

@@ -60,3 +60,15 @@ jobs:
           # deterministic (fixed mtime, sorted names) so a matching hash
           # is a real guarantee that the secrets are self-consistent.
           python scripts/pack_rust_core.py verify --from-env
+          # `verify` above proves the secrets are self-consistent, which on a
+          # fresh checkout is all it CAN prove: src/* is gitignored and absent
+          # until the line above restores it, so the comparison is the secrets
+          # against themselves. It cannot see failure mode 2 in this file's
+          # header - a maintainer who edited src/, re-packed, and never ran
+          # `gh secret set`. That drift is exactly what shipped a local fix
+          # nowhere for hours.
+          #
+          # rust_core.sha256 IS tracked, so it travels with the commit. Compare
+          # the restored tree against it: if the secrets are older than the last
+          # pack, the digests differ and this fails with instructions.
+          python scripts/pack_rust_core.py check-manifest

rust_core.sha256

@@ -0,0 +1 @@
+c3bea92be184174a01d7e3b6a91e081d2ec648c558210126332408a0695b8825

scripts/pack_rust_core.py

@@ -71,6 +71,12 @@
 REPO_ROOT = pathlib.Path(__file__).resolve().parent.parent
 SRC_DIR = REPO_ROOT / "src"
 
+# Tracked digest of the packed core. `src/*` is gitignored, so this file is the
+# only record of the core's identity that actually travels with a commit - and
+# the only thing CI can compare the restored secrets against. See
+# cmd_check_manifest for why stale-secrets-check cannot do this on its own.
+MANIFEST = REPO_ROOT / "rust_core.sha256"
+
 # Deterministic archives: identical sources must produce an identical base64
 # string, so an unchanged core does not churn the secrets on every pack.
 FIXED_MTIME = 0
@@ -222,6 +228,45 @@ def cmd_pack(args) -> int:
             f"Add {ENV_PREFIX}{MIN_CHUNKS + 1}..{ENV_PREFIX}{n} in repository settings; "
             "the CI restore step reads chunks until the first gap, so it adapts automatically."
         )
+    MANIFEST.write_text(digest + "\n", encoding="ascii")
+    print(f"\nWrote {MANIFEST.name} - COMMIT IT in the same change as the secret refresh.")
+    return 0
+
+
+def cmd_check_manifest(args) -> int:
+    """Fail if src/ does not hash to the digest recorded in the tracked manifest.
+
+    Closes the hole `stale-secrets-check` cannot: that job runs on a fresh
+    checkout, where `src/*` is gitignored and absent, so `verify` compares the
+    unpacked secrets against themselves and is self-consistent by construction.
+    It therefore cannot see a maintainer who edited src/, re-packed, and never
+    ran `gh secret set` — the exact drift its docstring claims to catch, and the
+    one that silently kept a local fix out of CI and the wheels for hours.
+
+    Run this *after* `unpack --from-env` in CI: the restored tree hashes to what
+    the secrets actually hold, and the manifest records what the last `pack`
+    produced. A mismatch means the two have diverged.
+    """
+    if not MANIFEST.is_file():
+        print(f"{MANIFEST.name} is missing — run `pack_rust_core.py pack` and commit it.")
+        return 1
+    expected = MANIFEST.read_text(encoding="ascii").strip()
+    actual = hashlib.sha256(_build_archive()).hexdigest()
+    print(f"manifest sha256: {expected}")
+    print(f"src/     sha256: {actual}")
+    if expected != actual:
+        print(
+            "\nMISMATCH: the Rust core in src/ is not the one the manifest records.\n"
+            "In CI this means the RUST_SRC_B64_* secrets are stale: someone packed a\n"
+            "change and never uploaded it, so CI and every released wheel are built\n"
+            "from older source than the manifest claims. Re-run:\n"
+            "    python scripts/pack_rust_core.py pack\n"
+            "    for i in $(seq 1 12); do "
+            "gh secret set RUST_SRC_B64_$i < .secrets/RUST_SRC_B64_$i.txt; done\n"
+            "and commit the refreshed manifest."
+        )
+        return 1
+    print("OK - src/ matches the committed manifest.")
     return 0
 
 
@@ -271,6 +316,12 @@ def main(argv=None) -> int:
     p.add_argument("--out", default=".secrets", help="output directory (default: .secrets)")
     p.set_defaults(func=cmd_pack)
 
+    p = sub.add_parser(
+        "check-manifest",
+        help="fail if src/ does not hash to the committed rust_core.sha256",
+    )
+    p.set_defaults(func=cmd_check_manifest)
+
     p = sub.add_parser("verify", help="check packed chunks match the working tree")
     p.add_argument("--in", dest="inp", default=".secrets", help="directory holding the chunk files")
     p.add_argument("--from-env", action="store_true", help="read chunks from RUST_SRC_B64_* env vars")