Mobench CI Contract v1: CLI orchestration, reports, action + docs

[dcbuild3r]

Summary

This PR now delivers the Mobench CI/DevEx plan on codex/ci-devex, including contract hardening, CI orchestration, reporting, and migration docs.

Delivered

• CI contract v1 publication: contract doc, ADR, and JSON schemas.
• New CLI surfaces: doctor, config validate, devices resolve, fixture init|build|verify|cache-key, report summarize, and report github --pr.
• ci run orchestration for android, ios, and both, with contract-shaped outputs and structured regression handling.
• Canonical CI artifacts/metadata flow (summary.json, summary.md, results.csv) plus contract tests.
• Baseline support expanded to path|url|artifact with improved|regressed|neutral labels in outputs.
• Typed Rust API surface used by CLI internals (RunRequest, RunResult, DeviceSelection, Report).
• Local composite action/template upgrades: cache behavior docs and optional sticky PR comment publishing.
• Migration and integrator documentation updates (including minimal reference workflow).

Validation

• cargo check
• cargo test -p mobench --lib
• cargo fmt

Scope Note

This is a long-lived branch/PR; it includes earlier commits, and this description reflects the current end-state delivered in this branch.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2d3537a617

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[semgrep-code-worldcoin]

Semgrep found 10 tainted-path findings:

• crates/mobench/src/lib.rs
  • L1845 - Triage
  • L1849 - Triage
  • L1989 - Triage
  • L2012 - Triage
  • L3717 - Triage
  • L3754 - Triage
  • L3840 - Triage
  • L3864 - Triage
  • L5958 - Triage
  • L5964 - Triage

The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.

View Dataflow Graph

flowchart LR
    classDef invis fill:white, stroke: none
    classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none

    subgraph File0["<b>crates/mobench/src/lib.rs</b>"]
        direction LR
        %% Source

        subgraph Source
            direction LR

            v0["<a href=https://github.com/worldcoin/mobile-bench-rs/blob/51eb84b9402ba291dab7bb9922a055531a54baed/crates/mobench/src/lib.rs#L5964 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 5964] config_path</a>"]
        end
        %% Intermediate

        %% Sink

        subgraph Sink
            direction LR

            v1["<a href=https://github.com/worldcoin/mobile-bench-rs/blob/51eb84b9402ba291dab7bb9922a055531a54baed/crates/mobench/src/lib.rs#L5964 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 5964] config_path</a>"]
        end
    end
    %% Class Assignment
    Source:::invis
    Sink:::invis

    File0:::invis

    %% Connections

    Source --> Sink

Loading