ci(frost): compile + test the frost_roast_retry activation path in CI

[mswilkison]

Why

This closes the sole production-activation blocker found in the deep production-readiness review of the ROAST retry work (stacked on #3866).

The interactive FROST + ROAST retry coordinator flow — BeginAttempt / RecordEvidence / AggregateBundle / VerifyBundle / NextAttempt, i.e. liveness plus slashing/blame — lives behind the frost_roast_retry Go build tag (~50 files). No CI job ever set that tag:

• client.yml (~line 138) and release.yml (~line 56) run untagged go build/test ./..., which compiles only the !frost_roast_retry no-op stubs.
• frost-cgo-integration.yml (~line 111) built only -tags "frost_native frost_tbtc_signer" and -run-filtered to the TestRealCgoInteractiveSigning* family.

Net effect: the entire ROAST retry state machine and ~30 frost_native unit tests never compiled or ran anywhere in CI, and make build (the release/Docker path) shipped the ROAST-retry-noop default build. The rollout doc also falsely claimed CI already exercised the tag.

What this changes

.github/workflows/client.yml — new client-frost-roast-retry job (plain Go, cgo off, no Docker; runs on every PR touching Go):

• go build -tags "frost_roast_retry" ./... and go build -tags "frost_native frost_roast_retry" ./... (mock-FFI, no Rust lib).
• go test under the three non-cgo tag sets that cover the whole matrix — frost_native, frost_roast_retry, frost_native frost_roast_retry — over ./pkg/frost/... and ./pkg/tbtc/....

.github/workflows/frost-cgo-integration.yml:

• Adds frost_roast_retry to the real-crypto cgo tag set (frost_native frost_tbtc_signer frost_roast_retry).
• Drops the narrow -run filter so the whole tagged ./pkg/frost/signing/ suite runs against the linked libfrost_tbtc, with skips still forbidden (KEEP_CORE_FROST_REQUIRE_CGO=true). Safe by construction: the heavy multiproc e2e tests already ran (matched by the old substring regex) and spawn their worker subprocesses with anchored -test.run, so dropping the outer filter only adds lighter tagged unit tests.
• New step smoke-builds the activation artifact via make build-frost using the lib built earlier in the job.
• Adds Makefile to the path triggers.

Makefile — new build-frost target: produces the ROAST-retry activation binary (tags frost_native frost_tbtc_signer frost_roast_retry, cgo-linked to libfrost_tbtc with the same CGO_LDFLAGS as the cgo workflow). The default make build still ships the !frost_roast_retry stubs; adopting the tagged artifact in the release/Docker path is gated on the readiness-manifest flip and is intentionally left to that decision (the Rust lib currently lives on a separate branch — see ci/frost-signer-pin.env), so this PR makes the artifact producible + CI-validated rather than silently flipping the default release image.

docs/development/frost-roast-retry-rollout.adoc: replaces the false "CI already exercises the tag" claim with an accurate description of the coverage above.

Validated locally (system Go, cgo disabled)

Check	Result
go build -tags "frost_roast_retry" ./...	compiles clean
go build -tags "frost_native frost_roast_retry" ./...	compiles clean
go test -tags "frost_native" ./pkg/frost/... ./pkg/tbtc/...	pass
go test -tags "frost_roast_retry" ./pkg/frost/... ./pkg/tbtc/...	pass
go test -tags "frost_native frost_roast_retry" ./pkg/frost/... ./pkg/tbtc/...	pass
make -n build-frost	expands correctly

The tagged builds compiled clean and every newly-run non-cgo tagged test passed — no failures were surfaced, and no assertion was weakened.

Deferred to CI: the cgo-linked full build/tests and the make build-frost smoke — these require building the Rust libfrost_tbtc, which cannot be done locally without the pinned signer source. The cgo job already builds that lib, so those steps are correct by construction (they reuse the same lib + CGO_LDFLAGS).

Follow-ups / known gaps

• cgo path is CI-only-validated. The frost_native frost_tbtc_signer frost_roast_retry real-crypto suite and make build-frost link libfrost_tbtc; they were not run on this machine. First green run of frost-cgo-integration.yml on this branch is the confirmation.
• Release/Docker still ship the stub build by design. make build (Dockerfile build-docker stage) is unchanged; wiring build-frost into the release image is deferred to the readiness-manifest flip and to the branch merge that brings the signer crate in-tree (per ci/frost-signer-pin.env).
• pkg/tbtc cgo-tagged tests (the 1–2 frost_native frost_tbtc_signer cgo files, e.g. real taproot-tx build) are not yet in the cgo gate; the cgo job keeps its pkg/frost/signing scope. Adding ./pkg/tbtc/ to the cgo run is a reasonable next step but pulls the heavy tbtc suite under real-crypto linking, so it is left as a follow-up.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 57491869-610a-4b0f-a447-13f3c193dcdf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/frost-roast-retry-build-coverage

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}