Fetch full Git history for retirement provenance in CI

Require fetch-depth zero for all CI and release checkout steps. The new regression fails on the previous shallow defaults and passes on the updated workflows. Native integration proof: 788 passed, 1 existing ignored; all 10 CLI tests passed. No runtime or consumer behavior changed.

Author: MauScheff

.github/workflows/ci.yml

@@ -21,6 +21,8 @@ jobs:
       RMS_TEST_SHARD: ${{ matrix.shard }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
       - uses: dtolnay/rust-toolchain@stable
       - uses: actions/setup-python@v5
         with:
@@ -58,6 +60,8 @@ jobs:
       CARGO_BUILD_JOBS: "2"
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
       - uses: dtolnay/rust-toolchain@stable
       - uses: actions/setup-python@v5
         with:
@@ -92,6 +96,8 @@ jobs:
         shell: pwsh
         run: git config --global core.longpaths true
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
       - uses: dtolnay/rust-toolchain@stable
       - name: Cross-platform behavioral-contract corpus
         run: cargo test -p rms --locked behavioral_contract::tests
@@ -107,6 +113,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
       - uses: dtolnay/rust-toolchain@stable
       - uses: actions/setup-python@v5
         with:

.github/workflows/release.yml

@@ -14,6 +14,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
       - uses: dtolnay/rust-toolchain@stable
       - name: Check tag version
         run: |
@@ -45,6 +47,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
       - uses: dtolnay/rust-toolchain@stable
       - name: Package source crate
         run: |
@@ -76,6 +80,8 @@ jobs:
         shell: pwsh
         run: git config --global core.longpaths true
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
       - uses: dtolnay/rust-toolchain@stable
       - name: Build release binary
         run: cargo build --release -p rms --locked
@@ -115,6 +121,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
       - uses: actions/download-artifact@v4
         with:
           path: dist

tooling/rust/rms/tests/cli_smoke.rs

@@ -152,6 +152,32 @@ fn repository_root() -> PathBuf {
         .to_path_buf()
 }
 
+#[test]
+fn ci_workflows_fetch_complete_provenance_history() {
+    for file in [".github/workflows/ci.yml", ".github/workflows/release.yml"] {
+        let workflow: serde_yaml::Value =
+            serde_yaml::from_str(&fs::read_to_string(repository_root().join(file)).unwrap())
+                .unwrap();
+        let mut checkouts = 0;
+        for job in workflow["jobs"].as_mapping().unwrap().values() {
+            for step in job["steps"].as_sequence().unwrap() {
+                if step["uses"]
+                    .as_str()
+                    .is_some_and(|value| value.starts_with("actions/checkout@"))
+                {
+                    checkouts += 1;
+                    assert_eq!(
+                        step["with"]["fetch-depth"].as_u64(),
+                        Some(0),
+                        "{file}: retirement provenance requires full Git history"
+                    );
+                }
+            }
+        }
+        assert!(checkouts > 0, "{file}: no checkout found");
+    }
+}
+
 fn run_probe(arguments: &[&str]) -> Output {
     Command::new(env!("CARGO_BIN_EXE_rms"))
         .current_dir(repository_root())