ci: add clippy and cargo test gates via self-hosted macOS runner (#14)

Closes #5.

Adds a `clippy-and-test` job to `.github/workflows/ci.yml` that runs on
`self-hosted-macos-26-arm64` for every Rust-touching PR/push, gated on
the same `needs: changes` path-filter as the existing `deny` and `fmt`
jobs and protected with the fork-PR + repository guard pattern used in
`release.yml` and `pipeline-parallel-ci.yml`.

Steps:
- `cargo build --release --features metal,accelerate`
- `cargo clippy --all-targets --features metal,accelerate -- -D warnings`
- `cargo test --release --features metal,accelerate`

CUDA gating intentionally stays exclusive to `release.yml`: PR-level
CUDA verification would require a Linux self-hosted runner and double
the cost for limited additional safety on PRs that do not touch
CUDA-specific code paths.

`CONTRIBUTING.md` quality-gate list updated to reflect the new CI
enforcement.

Merged with the clippy-and-test job still in-progress on the first
run (cold MLX C++ build can take 15-30+ minutes); a follow-up fix PR
will be filed if that first run uncovers an environmental issue.

Author: inureyes

.github/workflows/ci.yml

@@ -1,8 +1,13 @@
 # PR / push CI for lightweight quality gates. Builds and tests are covered by
 # release.yml (signed artifacts) and pipeline-parallel-ci.yml (distributed
-# runs); this workflow runs cargo-deny (license / advisory) and cargo-fmt
-# checks on every touched-Rust change so formatting drift and license issues
-# are caught at PR time.
+# runs); this workflow runs cargo-deny (license / advisory), cargo-fmt, and
+# cargo-clippy + cargo-test checks on every touched-Rust change so formatting
+# drift, license issues, and lint/test regressions are caught at PR time.
+#
+# Note on CUDA gating: CUDA verification stays exclusive to release.yml because
+# it requires a Linux self-hosted runner (currently only the GB10 node used for
+# release builds). Adding a PR-level CUDA gate would double runner cost for
+# limited additional safety on PRs that don't touch CUDA-specific code paths.
 
 name: CI
 
@@ -70,3 +75,30 @@ jobs:
         with:
           components: rustfmt
       - run: cargo fmt --all -- --check
+
+  clippy-and-test:
+    name: clippy + test (macOS ARM64)
+    needs: changes
+    # Only run when Rust files changed; block fork-PR access to the self-hosted
+    # runner pool (mirrors the guard in release.yml and pipeline-parallel-ci.yml).
+    if: >-
+      needs.changes.outputs.rust == 'true' &&
+      github.repository == 'lablup/mlxcel' &&
+      (github.event_name != 'pull_request' ||
+        github.event.pull_request.head.repo.full_name == github.repository)
+    runs-on: self-hosted-macos-26-arm64
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+      - name: Build (verify MLX FFI compiles)
+        run: cargo build --release --features metal,accelerate
+      - name: Clippy
+        run: cargo clippy --all-targets --features metal,accelerate -- -D warnings
+      - name: Test
+        run: cargo test --release --features metal,accelerate

CONTRIBUTING.md

@@ -42,9 +42,11 @@ Thank you for your interest in contributing to mlxcel! This document covers the
 4. Run the local quality gates:
    ```bash
    cargo fmt --all -- --check   # enforced by CI; fmt violations block merge
-   cargo clippy --all-targets -- -D warnings
+   cargo clippy --all-targets --features metal,accelerate -- -D warnings   # enforced by CI on self-hosted macOS runner
+   cargo test --release --features metal,accelerate                         # enforced by CI on self-hosted macOS runner
    cargo deny check             # advisories + licenses + sources
    ```
+   CI enforces `clippy` (with `-D warnings`) and `cargo test` on the `self-hosted-macos-26-arm64` runner on every PR that touches Rust files. CUDA verification is not gated at PR time — that stays exclusive to `release.yml`.
 5. For inference changes, validate against a real checkpoint — synthetic or build-only validation is not enough (see [`AGENTS.md`](AGENTS.md) for why).
 6. Commit with a conventional prefix (see below) and a clear message.
 7. Push to your fork and open a Pull Request. The PR template will prompt for a summary, test plan, and linked issues.