[kinyoklion]

Summary

On main, the linux (8) job of Quality control checks fails at the Contract tests step with Unable to find a release matching 'v2'. CI ran make contract-tests, which downloads the sse-contract-tests harness without authentication. GitHub rate-limits unauthenticated release lookups, and the downloader reports a rate-limited lookup as a missing release.

This change adds a local composite action, .github/actions/contract-tests, modelled on the one in swift-eventsource. It builds and starts the test service using the existing make targets, then runs the harness through launchdarkly/gh-actions/actions/contract-tests@contract-tests-v1 with token: ${{ secrets.GITHUB_TOKEN }}. The Contract tests step in ci.yml now uses that action. The make targets stay as they were for local use.

 - name: Contract tests
-  run: make contract-tests
+  uses: ./.github/actions/contract-tests
+  with:
+    token: ${{ secrets.GITHUB_TOKEN }}

How to test: the linux matrix jobs on this PR should download the harness and run the contract tests.

Limitations: running the harness with this token locally downloaded sse-contract-tests v2.32.0. I could not build the test service on my machine because a Gradle dependency would not resolve there, so CI on this PR is the end-to-end check.

Link to Devin session: https://app.devin.ai/sessions/fe4a81e87871412a99d2eed85302fe33
Open in Devin Desktop: https://app.devin.ai/desktop/session/fe4a81e87871412a99d2eed85302fe33?variant=devin

---

Note

Overview
Fixes flaky CI where the contract test step failed with "Unable to find a release matching 'v2'" because unauthenticated GitHub API lookups for sse-contract-tests were rate-limited.

Adds a local composite action (.github/actions/contract-tests) that runs make build-contract-tests and make start-contract-test-service-bg, then invokes launchdarkly/gh-actions/actions/contract-tests@contract-tests-v1 with token from the workflow, v2 harness settings, port 8000, and persistence tests off. The Linux Contract tests step in CI now uses that action with secrets.GITHUB_TOKEN instead of make contract-tests alone, so the harness download is authenticated while existing make targets stay for local use.

^{Reviewed by Cursor Bugbot for commit 1d6e4d1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring