ci: gate pushes on a build, test and bundle

Migrated from musiikki/nih-plug-template, adapted for this repo: the
template gates VST3 behind an opt-in `vst3` feature and so builds twice,
while this plugin always ships VST3 (nih_plug is taken with its default
features), so one build covers both formats.

The branding check runs first because it needs no toolchain and finishes
in under a second, so a half-landed rename fails before a build is spent
on it. The bundle step is included because `cargo build` never exercises
the xtask bundler, and bundler.toml drifting from the crate name stays
invisible until you try to produce an artifact.

Performance is deliberately not gated. `Plugin::process()` cannot be
called from a test — `ProcessContext` requires a `&Transport`, whose
constructor and fields are `pub(crate)` to nih_plug — so any realtime
check would have to target the `src/dsp/` types directly, and a meaningful
one needs an audio deadline rather than a shared CI box.

Verified by running the exact step sequence as the gitea-runner user under
the service's environment: 28 branding checks, 20 unit tests, both bundles
produced.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WHt4DykxXaQnyaJfyS8KCn

.github/workflows/ci.yaml

@@ -0,0 +1,55 @@
+name: CI
+
+on:
+  push:
+    branches: [ master ]
+    paths:
+      - 'src/**'
+      - 'xtask/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - 'bundler.toml'
+      - 'check-branding.sh'
+  pull_request:
+    branches: [ master ]
+  workflow_dispatch:
+
+# Target the self-hosted Rust/audio runner registered to the `musiikki` org.
+#
+# The runner is host-mode, so the rustup toolchain installed for the
+# `gitea-runner` user is used directly — nothing installs per run, and the cargo
+# registry cache stays warm between jobs.
+#
+# Adapted from musiikki/nih-plug-template. The template gates VST3 behind an
+# opt-in `vst3` feature and so builds twice; this plugin always ships VST3
+# (nih_plug is taken with default features), so one build covers both formats.
+
+jobs:
+  build:
+    name: Build
+    runs-on: rust-audio
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Toolchain
+        run: |
+          cargo --version
+          rustc --version
+          echo "CARGO_HOME=${CARGO_HOME:?not set on this runner}"
+
+      # Cheap and needs no toolchain, so it runs first: a rename that only
+      # landed in half the files is worth catching before spending a build on it.
+      - name: Branding consistency
+        run: sh check-branding.sh
+
+      - name: Build
+        run: cargo build --release
+
+      - name: Test
+        run: cargo test --release
+
+      # Proves the xtask bundler still works, which a plain `cargo build` does
+      # not exercise — the bundle step is where bundler.toml and the crate name
+      # have to agree.
+      - name: Bundle
+        run: cargo xtask bundle codename_206 --release

README.md

@@ -291,6 +291,23 @@ which no source licence resolves. CLAP carries neither encumbrance.
  
 ---
  
+## CI
+
+`.github/workflows/ci.yaml` gates pushes and PRs on the branding check, a release build,
+`cargo test`, and a bundle — enough to catch a rename that only half-landed, a build break,
+or a `bundler.toml` that no longer matches the crate name.
+
+It targets `runs-on: rust-audio`, a self-hosted host-mode runner registered to the `musiikki`
+org. That label is org-scoped: a fork outside `musiikki` will not see the runner and its jobs
+will queue indefinitely rather than fail.
+
+Plugin performance is deliberately not gated. Realtime cost is only meaningful against an
+audio deadline, and `Plugin::process()` cannot be called from a test at all — `ProcessContext`
+requires a `&Transport`, whose constructor and fields are `pub(crate)` to nih_plug. The DSP
+types under `src/dsp/` take no nih-plug context and are directly testable if you need it.
+
+---
+
 ## Reference Material
  
 - [NIH-plug repo](https://github.com/robbert-vdh/nih-plug) — read the `plugins/` examples first