fix(ci): repair shared workflow checks

[artemyarulin]

• Allow repositories sharing the Rust workflow to provide an optional pre-check setup script.
• Publish the standalone Swift package only from actors main and release tags.
• Prevent synced copies of the workflow from publishing the Swift package.
• Format the Rust files currently failing the always-on formatting check.

[railway-app]

🚅 Deployed to the actors-pr-5692 environment in rivet-frontend

Service	Status	Web	Updated
website	❌ Build Failed (View Logs)	Web	Sep 10, 2026 at 11:02 am UTC
frontend-inspector	😴 Sleeping (View Logs)	Web	Sep 10, 2026 at 10:38 am UTC
kitchen-sink	😴 Sleeping (View Logs)	Web	Sep 10, 2026 at 10:38 am UTC
frontend-cloud	😴 Sleeping (View Logs)	Web	Sep 10, 2026 at 10:34 am UTC
ladle	✅ Success (View Logs)	Web	Sep 10, 2026 at 9:55 am UTC
mcp-hub	✅ Success (View Logs)	Web	Sep 10, 2026 at 9:55 am UTC

[the-company-company]

✅ No issues found

_{Reviewed commit 39bf6de.}

[claude]

Review

Small, focused CI-repair PR. Went through both workflow changes and the formatting-only Rust diffs.

.github/workflows/mirror-swift.yml

• Restricting branches: ["**"] to branches: [main] and adding if: github.repository == 'rivet-dev/actors' both look correct and match the stated goal of stopping synced copies of this workflow (in other repos under the org) from force-pushing to rivetkit-swift on every branch push. Good hardening: this job force-pushes with a PAT, so limiting the trigger surface is the right call.

.github/workflows/rust.yml

• The optional pre-check hook via hashFiles('scripts/ci/pre-rust-check.sh') != '' is a clean, minimal-footprint way to let downstream repos hook into the shared workflow without forking it.
• Minor robustness suggestion: run: scripts/ci/pre-rust-check.sh invokes the script directly, which requires the file to carry the executable bit (and a shebang) in whatever repo adds it. Since this file lives in a repo other than the one being edited here, a missing +x bit would fail with an obscure "permission denied" rather than a clear error. Consider run: bash scripts/ci/pre-rust-check.sh to sidestep the executable-bit requirement entirely. Low priority, just a papercut for whoever adds the script later.

Formatting-only changes

• inspector_bundle.rs, lib.rs, serverless_listener.rs changes all look like straight cargo fmt output (import ordering, wrapped signatures/macros) consistent with hard_tabs = true in rustfmt.toml. No behavioral changes.

Other notes

• No test coverage concerns: this is CI/formatting-only, no logic changes, so no new tests are expected.
• No security concerns beyond the trigger-scoping improvement noted above, which is a net positive.

Overall: looks good to merge. Only the bash vs. direct-exec suggestion above is worth considering, and it is non-blocking.