ci(pr-automation): compare APIs using locked dependencies

[AKolenda]

The public API compatibility job currently fails before comparing APIs because cargo-semver-checks resolves a fresh dependency graph in its placeholder crate. This selects picky-krb 0.12.5, whose new GssApiMessageError variant breaks sspi 0.21.3; ordinary CI succeeds using the committed lockfile's picky-krb 0.12.4.

Build baseline and head rustdoc JSON with cargo rustdoc --locked, then compare those artifacts with the existing pinned cargo-semver-checks binary. Both revisions retain their own locked dependencies. The existing unprivileged nobody execution, cleared environment, tool checksum, feature selection, and compatibility exit-code handling remain in place.

This fixes a shared automation failure affecting #2009, #2010, #2012, #2013, #2014 and #2016. Example failed job: https://github.com/Devolutions/IronRDP/actions/runs/36972417921/job/110729084933. Because this is a pull_request_target workflow, the repair takes effect for other PRs after it lands on the base branch.

Validation:

• Real IronRDP cargo rustdoc --locked build with the full workflow feature set passed; the pinned comparator parsed and compared the resulting JSON.
• Extracted workflow fixtures: unchanged API exits 0, removed root function exits 100, stale lockfile exits 101 without modifying the lockfile.
• YAML parsing, Bash syntax checks, and git diff --check passed.
• Fixture execution used the exact cleared-environment inner script as the current user; local sudo requires a password, so the unchanged nobody boundary was inspected rather than executed locally.

The comparator's existing inability to detect some changes through dependency re-exports reproduces with both its placeholder mode and this JSON mode; that separate limitation is unchanged.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[chatgpt-codex-connector]

The account paying for this security review has reached its Codex usage limits. The payer can check the Codex usage dashboard. For personal accounts, using credits requires enabling “Use credits for security reviews” in Code review settings. If you do not manage the paying account, contact this repository's admins.

[Copilot]

Copilot review overview

🟢 Approval recommended

No unresolved review issues remain.

Review effort: Lite
Findings: None

What changed in this PR

Updates PR automation to compare public APIs using rustdoc artifacts generated with each revision’s locked dependencies.

Changes:

• Builds baseline and head rustdoc JSON with cargo rustdoc --locked.
• Compares artifacts using the pinned semver checker.
• Documents the locked-dependency workflow.

File	Summary
.github/​workflows/​pr-automation.yml	Builds and compares locked rustdoc artifacts.
.github/​PR_AUTOMATION.md	Documents the updated compatibility check.

[Benoît Cortier (CBenoit)]

PR automation is failing because of a picky-krb 0.12.5 incompatibility, fixed on master by #2074. Please rebase on master to fix it.

Update: no rebase needed anymore. picky-krb 0.12.5 was yanked from crates.io (re-released as 0.13.0), so the API check builds again without changes to this branch. PR automation has been re-run here and passes.

[github-actions]

This pull request may overlap with #2069.

Both pull requests modify the cargo-semver-checks handling in .github/workflows/pr-automation.yml: this PR replaces the direct semver-bin invocation with a self-built baseline/head rustdoc flow, while PR 2069 adds a GitHub-only-diff exemption around the same fail-closed cargo-semver-checks path. Shared scope in the same workflow step warrants human review for interaction.

This notice is advisory only. Automated review continues as usual, and how these pull requests relate is for maintainers and authors to decide.

Note

LLM-assisted content (no human feedback).

[github-actions]

CI-only change to the pull_request_target pr-automation workflow: the semver job now builds rustdoc JSON for baseline and head with `cargo rustdoc --locked` in an inner bash script run as nobody under `env -i`, then compares the two artifacts with the existing checksum-pinned cargo-semver-checks binary. This fixes real failures caused by the comparator's placeholder crate resolving a fresh (unlocked) dependency graph, while preserving the unprivileged boundary, cleared environment, feature selection, and exit-code handling (0/100 mapping). The accompanying PR_AUTOMATION.md note documents the locked-baseline behavior. The change is correct and safe: SHA/feature values flow through env passthrough rather than interpolation into the script text, `RUSTC_BOOTSTRAP=1` is required for the unstable rustdoc flags on the stable toolchain, and per-revision `CARGO_TARGET_DIR` values keep artifacts separated with paths matching what the comparator is given. The single accepted candidate is a low-s…

[github-actions]

[code-compressor] Flatten revision-to-SHA if/else and artifact_root capture in the rustdoc loop — low 🟡 — The inner script uses three moving parts for two revisions: a loop over abstract names, an if/else translating each name back to "$BASE_SHA"/"$HEAD_SHA", and `artifact_root="$CARGO_TARGET_DIR"` taken only to survive the per-revision `export CARGO_TARGET_DIR` overwrite. A flatter equivalent iterates directly over concrete pairs, e.g. `for revision in "baseline:$BASE_SHA" "current:$HEAD_SHA"; do dir=${revision%%:*}; sha=${revision#*:}; git checkout --detach "$sha"; export CARGO_TARGET_DIR="$artifact_root/$dir"; ... done`, and passes the outer target root once as `SEMVER_ARTIFACT_ROOT="$semver_target"` alongside the existing SEMVER_BIN/SEMVER_FEATURES passthrough. Behavior is identical (same checkout order, per-revision target dirs, comparator artifact paths), and keeping SHAs in env vars preserves the quoting/injection properties under `env -i`.