fix(deps): update rust crate reqwest to 0.13

.github/actions/setup-rust/action.yml

@@ -0,0 +1,48 @@
+name: "Set up Rust"
+description: "Install the Rust toolchain and restore the shared cargo cache."
+
+inputs:
+  cache-key:
+    description: "Cache key prefix, unique per job (e.g. 'os-trust', 'clippy')."
+    required: true
+  targets:
+    description: "Comma-separated rustup targets to add."
+    required: false
+    default: ""
+  components:
+    description: "Comma-separated rustup components to add."
+    required: false
+    default: ""
+  cache-target:
+    description: "Whether to include target/ in the cache (fast check-only jobs may skip it)."
+    required: false
+    default: "true"
+
+runs:
+  using: "composite"
+  steps:
+    - name: Set up Rust
+      uses: dtolnay/rust-toolchain@stable
+      with:
+        targets: ${{ inputs.targets }}
+        components: ${{ inputs.components }}
+
+    - name: Resolve cache paths
+      id: paths
+      shell: bash
+      run: |
+        {
+          echo "value<<EOF"
+          echo "~/.cargo/bin/"
+          echo "~/.cargo/registry/index/"
+          echo "~/.cargo/registry/cache/"
+          echo "~/.cargo/git/db/"
+          [ "${{ inputs.cache-target }}" = "true" ] && echo "target/"
+          echo "EOF"
+        } >> "$GITHUB_OUTPUT"
+
+    - name: Cache
+      uses: actions/cache@v6
+      with:
+        path: ${{ steps.paths.outputs.value }}
+        key: cargo-${{ inputs.cache-key }}-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}

.github/workflows/os-trust-store.yml

@@ -0,0 +1,93 @@
+name: "[Agent] OS trust store"
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+    paths:
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - 'src/api/**'
+      - 'src/tests/**'
+      - '.github/workflows/os-trust-store.yml'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  os-trust-store:
+    name: "🔐 OS trust store (${{ matrix.os }})"
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 25
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu
+            runner: ubuntu-latest
+          - os: windows
+            runner: windows-latest
+          - os: macos
+            runner: macos-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Set up Rust and cache
+        uses: ./.github/actions/setup-rust
+        with:
+          cache-key: os-trust
+
+      - name: Generate a private CA and a 127.0.0.1 certificate
+        shell: bash
+        # Git Bash rewrites the leading slash of -subj into a Windows path
+        env:
+          MSYS_NO_PATHCONV: 1
+          MSYS2_ARG_CONV_EXCL: "*"
+        run: |
+          openssl req -x509 -newkey rsa:2048 -sha256 -days 1 -nodes \
+            -keyout ca.key -out ca.pem -subj "/CN=OpenAEV OS trust test CA" \
+            -addext "basicConstraints=critical,CA:TRUE" \
+            -addext "keyUsage=critical,keyCertSign,cRLSign"
+          printf 'subjectAltName=DNS:localhost,IP:127.0.0.1\nbasicConstraints=critical,CA:FALSE\nextendedKeyUsage=serverAuth\n' > leaf.ext
+          openssl req -newkey rsa:2048 -nodes -keyout leaf.key -out leaf.csr -subj "/CN=localhost"
+          openssl x509 -req -in leaf.csr -CA ca.pem -CAkey ca.key -CAcreateserial \
+            -out leaf.pem -days 1 -sha256 -extfile leaf.ext
+          openssl x509 -in leaf.pem -noout -subject -issuer -ext subjectAltName
+
+      - name: Trust the CA (linux)
+        if: matrix.os == 'ubuntu'
+        run: |
+          sudo cp ca.pem /usr/local/share/ca-certificates/openaev-os-trust-test-ca.crt
+          sudo update-ca-certificates
+
+      - name: Trust the CA (macos)
+        if: matrix.os == 'macos'
+        run: sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ca.pem
+
+      - name: Trust the CA (windows)
+        if: matrix.os == 'windows'
+        shell: pwsh
+        run: certutil -addstore -f Root ca.pem
+
+      - name: Serve HTTPS and run the OS trust store test
+        shell: bash
+        env:
+          OAEV_OS_TRUST_URL: https://127.0.0.1:8443
+        run: |
+          openssl s_server -accept 8443 -cert leaf.pem -key leaf.key -www -quiet &
+          server=$!
+          for _ in $(seq 1 30); do
+            if (exec 3<>/dev/tcp/127.0.0.1/8443) 2>/dev/null; then break; fi
+            sleep 1
+          done
+          set +e
+          cargo test --locked test_os_trust_store_is_consulted -- --ignored --nocapture
+          status=$?
+          kill "$server" 2>/dev/null
+          exit $status