ci: gate pushes on a build of both feature sets

Adds the minimal check a plugin repo actually needs: does it still build,
and do the identity strings still agree.

Both feature sets are built rather than just the default, because the
`vst3` cfg gates are exactly the kind of thing that rots — a default build
never compiles the Vst3Plugin impl, so a break there would otherwise
surface only when someone tried to ship a VST3. The bundle step is
included for the same reason: `cargo build` never exercises the xtask
bundler, and bundler.toml drifting from the crate name is invisible until
you try to produce an artifact.

The branding check runs first because it needs no toolchain and finishes
in under a second, so a half-landed rename fails before a build is spent
on it.

Performance testing is deliberately absent. Realtime cost is only
meaningful against an audio deadline, and `Plugin::process()` cannot be
called from a test at all: `ProcessContext` requires a `&Transport`, whose
constructor and fields are `pub(crate)` to nih_plug, so no external crate
can implement the trait. A static lint for locks in the audio path was
considered and dropped — `lock` and `borrow` are ordinary identifiers, not
reserved words, so a substring search matches every occurrence of "block"
in DSP code while missing `println!`, `recv()` and `Condvar::wait()`,
which are the likelier offenders. `assert_process_allocs` remains the real
guarantee, and it only fires in a debug build inside a host.

Verified by running the exact step sequence as the gitea-runner user under
the service's environment.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WHt4DykxXaQnyaJfyS8KCn

.github/workflows/ci.yaml

@@ -0,0 +1,61 @@
+name: CI
+
+on:
+  push:
+    branches: [ master ]
+    paths:
+      - 'src/**'
+      - 'xtask/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - 'bundler.toml'
+      - 'check-branding.sh'
+  pull_request:
+    branches: [ master ]
+  workflow_dispatch:
+
+# Target the self-hosted Rust/audio runner registered to the `musiikki` org.
+#
+# The runner is host-mode, so the rustup toolchain installed for the
+# `gitea-runner` user is used directly — nothing installs per run, and the cargo
+# registry cache stays warm between jobs.
+#
+# NOTE: `rust-audio` is an ORG-SCOPED label. A plugin cloned from this template
+# into a different org will not see that runner, and its jobs will queue
+# indefinitely rather than fail. Either register a runner advertising this label
+# for that org, or change `runs-on` below.
+
+jobs:
+  build:
+    name: Build
+    runs-on: rust-audio
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Toolchain
+        run: |
+          cargo --version
+          rustc --version
+          echo "CARGO_HOME=${CARGO_HOME:?not set on this runner}"
+
+      # Cheap and needs no toolchain, so it runs first: a rename that only
+      # landed in half the files is worth catching before spending a build on it.
+      - name: Branding consistency
+        run: sh check-branding.sh
+
+      # The default build is CLAP-only; the vst3 feature is opt-in, so both
+      # configurations have to be built to know the cfg gates are still correct.
+      - name: Build (default, CLAP only)
+        run: cargo build --release
+
+      - name: Build (--features vst3)
+        run: cargo build --release --features vst3
+
+      - name: Test
+        run: cargo test --release --features vst3
+
+      # Proves the xtask bundler still works, which a plain `cargo build` does
+      # not exercise — the bundle step is where bundler.toml and the crate name
+      # have to agree.
+      - name: Bundle
+        run: cargo xtask bundle nih_plug_template --release --features vst3

README.md

@@ -107,8 +107,25 @@ xtask/              # Bundler xtask (cargo xtask bundle)
 .cargo/config.toml  # xtask alias
 check-branding.sh   # Asserts the plugin's identity strings agree everywhere (see Renaming)
 .gitattributes      # Pins *.sh to LF so Windows checkouts keep a valid shebang
+.github/workflows/  # CI: branding check, both feature sets build, test, bundle
 ```
 
+## CI
+
+`.github/workflows/ci.yaml` gates pushes and PRs on the branding check, a build of both
+feature sets, `cargo test`, and a bundle — enough to catch a rename that only half-landed,
+a `cfg(feature = "vst3")` gate that stopped compiling, or a `bundler.toml` that no longer
+matches the crate name.
+
+It targets `runs-on: rust-audio`, an **org-scoped** runner label. A plugin cloned into a
+different org will not see that runner and its jobs will queue indefinitely rather than fail
+— register a runner advertising the label for that org, or change `runs-on`.
+
+Deliberately not covered: plugin performance. Realtime cost can only be measured meaningfully
+against a real audio deadline, and `Plugin::process()` cannot be called from a test at all
+(`ProcessContext` requires a `Transport`, whose constructor and fields are `pub(crate)` to
+nih-plug). Benchmark your DSP types directly if you need it.
+
 ## License
 
 **GPL-3.0-or-later.** See `LICENSE` for the terms and `NOTICE` for third-party attribution.