fix(ci): lock runtime wasm-bindgen toolchain

[lemone112]

RCA verdict

The same source tree produced two runtime artifacts because wasm-pack 0.13.1 can select two different wasm-bindgen CLI binaries:

• its official x86_64-unknown-linux-musl 0.2.126 prebuilt produced pre-opt 412331B and final 378113B / 598b8358...;
• its cargo-install fallback produced a host GNU binary. With floating dependencies it produced the failed main artifact, and even with the release lockfile it deterministically produced pre-opt 412319B and final 378101B / 745b2ef0....

Run 31643064515 attempt 1 entered the fallback after the prebuilt download path failed. Attempt 2 reused the cached official prebuilt and returned to 378113B. PR #572 did not change the budget, and 4f99f1e plus b07178e have the same tree 9db8222ba8f891589752603c441bac2f5f66adc2.

Audit remediation

F1 — exact wasm-pack cache contract

Fixed. The previous dot-prefixed cargo-install root was wasm-pack's disposable temp directory and was deleted. The worker now:

1. downloads the official wasm-bindgen 0.2.126 musl release archive;
2. verifies archive SHA-256 064948d58e2d6c0a745216477a639ba696216d6309aaa902939d1b865b1d869d;
3. stages both required binaries;
4. atomically renames them into the exact completed non-dot root WASM_PACK_CACHE/wasm-bindgen-cargo-install-0.2.126/;
5. keeps wasm-bindgen and wasm-bindgen-test-runner directly at that root.

This bypasses both wasm-pack's fallback installer and its disposable dot staging.

F2 — immutable worker activation

Confirmed. This PR deliberately delivers only corrected ci-worker.yml plus its contract. The current caller still pins �eecd257371a7a6421079b0d8207a109969aa332; therefore exact-head CI on this PR executes the old worker and is not proof of the new cache producer.

After this PR is merged, a separate one-line Stage-B repin PR must update ci.yml to the resulting main SHA. That PR will also update the existing private-program-ci-contract caller-pin assertion. Its first exact-head run is the activation proof and must show:

• referenced_workflows SHA equals the merged worker SHA;
• no Installing wasm-bindgen... in the wasm job;
• runtime artifact 378113B / 598b8358....

No caller pin is changed in this PR, avoiding the immutable-worker chicken-and-egg.

F3 — contract guard

Fixed. The release contract now rejects:

• the old dot-prefixed final root;
• omission of the archive SHA-256 check;
• binaries nested under �in/ instead of directly at the completed root;
• wrong version or ordering after the runtime build starts.

The caller-binding assertion remains deferred to the Stage-B repin PR where the pin actually changes.

Evidence

• PR feat(colors): prove incremental re-resolve parity #572 exact-head run 31638392084: 378113B / 598b8358....
• Failed main run 31643064515 attempt 1: 378101B / 745b2ef0....
• Same run attempt 2: 378113B, fully green.
• Prior main runs 31562286269 and 31592768178: 378113B / 598b8358....
• Two independent clean Linux container builds with the corrected non-dot prebuilt cache:
  • wasm-pack emitted no Installing wasm-bindgen... line;
  • pre-opt 412331B / 5647c9a0...;
  • final 378113B / 598b8358...;
  • artifacts byte-identical.
• Control experiment with locked host-built CLI: cache hit but 378101B, proving host CLI and canonical prebuilt are not byte-equivalent.
• Targeted contract: RED on old dot-path workflow, GREEN on corrected layout.
• actionlint and diff checks pass.

Runtime budget remains 378113. Private Program budget 321335 is untouched. No caller pins or publish workflow changed.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 33 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 1b3dd459-1f13-4858-bf09-5916ccbfd9fd

📥 Commits

Reviewing files that changed from the base of the PR and between b07178e and 6b52ac3.

📒 Files selected for processing (2)

• .github/workflows/ci-worker.yml
• packages/colors/test/release-contract.test.mjs

---

_{Comment @coderabbitai help to get the list of available commands.}