ci: run yaegi-check and the pricing-sync tests on pull requests

A go test run over ./... stops at nested modules, so CI never ran
tools/pricing-sync or the Yaegi interpreter check. A new job runs both
with Go 1.25.x. The go.sum of tools/yaegi-check now holds its test
dependencies, and its go.mod lists the prometheus modules as direct
dependencies. The .gitattributes comment now says that the
export-ignore rules for tools/, webui/, examples/ and testdata/ do take
effect.

Claude-Session: https://claude.ai/code/session_01V5jYJNxpDFdJkyyExpADrv

.gitattributes

@@ -32,6 +32,44 @@ tools/ export-ignore
 docs/ export-ignore
 examples/ export-ignore
 testdata/ export-ignore
+# cmd/gateway/testdata/ holds a real captured production config used as the
+# config-loader test fixture. It carries no key material (every provider key
+# in it is a `file:` reference resolved from a mounted volume), but it does
+# carry in-cluster hostnames and addresses that have no business in a public
+# catalog tarball.
+#
+# Written as `/**`, not as a trailing-slash directory pattern like the
+# lines above, so `git check-attr export-ignore --` can confirm THIS one
+# line is live for a specific file path (P5, review round 4: the
+# trailing-slash form below is NOT broken — see the next paragraph — this
+# is only about what check-attr itself can verify). `git check-attr`
+# evaluates a pattern as if for a FILE, and a pattern ending in "/"
+# matches only a directory, so it always reports "unspecified" for a
+# trailing-slash pattern regardless of whether git archive actually
+# honours it; `/**` sidesteps that check-attr quirk. Verified with `git
+# check-attr export-ignore --`: this line reports "set", while a
+# `cmd/gateway/testdata/` form reported "unspecified" even though (next
+# paragraph) that form still works for git archive.
+#
+# The same check reports "unspecified" for tools/, webui/, examples/ and the
+# repo-root testdata/ above — but that is a `git check-attr` quirk, NOT
+# evidence those lines are no-ops. check-attr evaluates the attribute as if
+# for a FILE, and a pattern ending in "/" only ever matches a directory, so
+# it reports "unspecified" for any per-file path you hand it, whether or
+# not the pattern actually governs that path. `git archive` walks the tree
+# and applies export-ignore to each directory ENTRY it visits, which a
+# trailing-slash pattern matches directly — verified: `git archive
+# --worktree-attributes HEAD | tar -t | grep -c '^tools/'` (and the same for
+# webui/, examples/, testdata/, integration/, .github/) all print 0, i.e.
+# every file under each of those directories is excluded from the release
+# tarball today. These lines are live, not no-ops — do not "fix" them to
+# `/**` (harmless, but unnecessary) or delete them as dead weight (deleting
+# them would send ~250 test and tooling files into the catalog tarball).
+# The *_test.go and .gitattributes lines below reach the same outcome
+# through an ordinary no-slash pattern, which check-attr reports correctly
+# for both a file and a directory path — hence no similar-looking discrepancy
+# there.
+cmd/gateway/testdata/** export-ignore
 .superpowers/ export-ignore
 .github/ export-ignore
 *_test.go export-ignore

.github/workflows/pr.yaml

@@ -21,3 +21,30 @@ jobs:
       go-version: "1.25.x"
       coverage-threshold: 75
     secrets: inherit
+
+  # C2 (review round 3, 2026-09): the shared pr-checks job above runs
+  # `go vet`/staticcheck/`go test -race`/gosec/govulncheck/CodeQL against
+  # `./...`, which stops at every NESTED go.mod (tools/yaegi-check,
+  # tools/pricing-sync, integration/) — so neither the yaegi interpreter
+  # compatibility check nor the pricing-sync tool's own tests ran in CI at
+  # all before this job existed. This job runs both, the same two commands
+  # a contributor is expected to run locally before pushing.
+  yaegi-and-tools:
+    name: Yaegi compatibility & tooling
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: "1.25.x"
+          cache: true
+
+      - name: yaegi-check
+        run: make yaegi-check
+
+      - name: pricing-sync tests
+        run: cd tools/pricing-sync && go test ./...

tools/yaegi-check/go.mod

@@ -2,11 +2,13 @@ module llmgw-yaegi-check
 
 go 1.25.0
 
-require github.com/traefik/yaegi v0.16.1
+require (
+	github.com/prometheus/client_model v0.6.2
+	github.com/prometheus/common v0.70.1
+	github.com/traefik/yaegi v0.16.1
+)
 
 require (
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.70.1 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 )

tools/yaegi-check/go.sum

@@ -1,10 +1,22 @@
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
 github.com/prometheus/common v0.70.1 h1:1HvjP4D5oL3t8RsPlwxA9onvvStjtIHYE5XuuwOi/PY=
 github.com/prometheus/common v0.70.1/go.mod h1:VdFUQDMZK3VLkurFUVhia6uys/0suUp86TJz5qbJRhc=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/traefik/yaegi v0.16.1 h1:f1De3DVJqIDKmnasUF6MwmWv1dSEEat0wcpXhD2On3E=
 github.com/traefik/yaegi v0.16.1/go.mod h1:4eVhbPb3LnD2VigQjhYbEJ69vDRFdT2HQNrXx8eEwUY=
+go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
+go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=