fix(cli-generator): drop third-party rust setup action from generated ci.yml

[devin-ai-integration]

Description

The generated ci.yml used actions-rust-lang/setup-rust-toolchain@v1. Orgs that allowlist first-party actions only cannot run it, and an unrunnable action fails the workflow before any job starts — leaving no option but to fernignore ci.yml and hand-maintain it, which also means the generated npm publish jobs never land. Replaces it with a first-party equivalent, and fixes a second gap found while diffing a hand-maintained ci.yml against ours: the generated crates' tests never ran.

Changes Made

• All 8 uses of the third-party action (check, compile, test, version, and the 5 publish matrix legs) are now a shell step that uses the runner's preinstalled cargo, with a rustup fallback for containers/self-hosted runners — the same step cargo-dist emits into release.yml. The publish matrix keeps its rustup target add ${{ matrix.rust-target }}, which the action did via its target input.

• Caching came from that action wrapping Swatinem/rust-cache, so ~/.cargo and target/ are now cached with actions/cache@v4 instead, keyed per job and per rust target (target/ holds per-triple output, so the five cross-compiles must not share one entry).

• The test job now tests the generated crates by manifest path:

  - name: Test
    run: cargo test
  - name: Test acme-types
    run: cargo test --manifest-path acme-types/Cargo.toml
  - name: Test acme-sdk
    run: cargo test --manifest-path acme-sdk/Cargo.toml

  patchCargoToml wires those crates in as path dependencies, not workspace members, and cargo test only builds test targets for the packages it is invoked on — so the serialization tests shipped with every generated CLI have never executed in CI. Nested type-partition crates get a step too, since they are path dependencies of the types facade rather than members of it. Emitted for both the build-only and publish-enabled workflow forms.

No config surface, no change to job names, the job graph, the publish matrix, the version guard, OIDC/token handling, release.yml, or any generated Rust source.

Testing

• Unit tests added/updated — emitPublishWorkflow.test.ts asserts no non-actions/* action reappears in either emitted form, covers the cache paths/keys, and covers the manifest-path steps (present when crates are passed, absent otherwise). 422 generator tests pass.
• Manual testing completed — emitted a publish-enabled ci.yml for an ElevenLabs-shaped config, parsed it as YAML, and confirmed the test job's step list and the absence of actions-rust-lang/.

Link to Devin session: https://app.devin.ai/sessions/0c32af0182744cbe8d22f33a85a93160

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.