chore(deps): bump pulseengine/rivet from 0.29.0 to 0.30.0

[dependabot]

Bumps pulseengine/rivet from 0.29.0 to 0.30.0.

Release notes

Sourced from pulseengine/rivet's releases.

Rivet v0.30.0

What's Changed

• plan(v0.30): CI resilience + compliance-export robustness by @​avrabe in pulseengine/rivet#731
• ci(resilience): wasm-seam gate + disk cleanup + hosted traceability fallback (REQ-268/271/272) by @​avrabe in pulseengine/rivet#732
• fix(export): honest AADL static-export fallback + embed source (REQ-273, #468) by @​avrabe in pulseengine/rivet#734
• chore(release): v0.30.0 — CI resilience + compliance-export robustness by @​avrabe in pulseengine/rivet#736

Full Changelog: pulseengine/rivet@v0.29.0...v0.30.0

Changelog

Sourced from pulseengine/rivet's changelog.

[0.30.0] - 2026-07-23

CI resilience + compliance-export robustness.

Added

• Per-PR WASM-seam CI gate (REQ-268) — the composition core is exposed as a Wasm component (compose-witness/ + the host wasm feature via wasmtime), but per-PR CI only ever built the default features; a break in the host-side wasm seam was invisible until release.yml ran on a tag. Adds a wasm-seam job (gated by a paths-filter on compose-witness/, wasm_runtime.rs, feature_model.rs, *.wit, the wasm build script, and assets/wasm/) that runs cargo build -p rivet-cli --features wasm on every PR touching the seam.
• Self-hosted runner disk cleanup (REQ-271, #567) — a reusable .github/actions/free-space composite action prunes docker/bazel/cargo caches and /tmp, reporting before/after free space, so long-lived self-hosted runners stop failing compile-heavy jobs on a full disk. (Currently wired into the wasm-seam job; broadening to all compile-heavy jobs is queued for v0.31.)
• Hosted traceability fallback (REQ-272, #509) — a push-only traceability-hosted-fallback job on ubuntu-latest runs rivet validate, so a self-hosted-pool outage can no longer silently zero out main's traceability enforcement. Skipped on PRs (self-hosted carries the per-PR gate). Complements the runner-liveness alert workflow shipped earlier.

Fixed

• AADL diagrams no longer stuck on "Loading…" forever in static export (REQ-273, #468) — the static compliance report embedded an AADL placeholder that only rivet serve could fill client-side (spar-WASM + /source-raw + /wasm endpoints a static bundle lacks), so the report looked broken. Static export now emits an honest fallback — a "rendered interactively in rivet serve" note plus the AADL source in a <details> block — and the fix lands at the render source, so the prior post-hoc text replacements become harmless no-ops. Real inline SVG still activates automatically once a non-stub spar-wasm component is embedded (cross-repo, spar#259), with no further code change.

Commits

• 5914b01 chore(release): v0.30.0 — CI resilience + compliance-export robustness (#736)
• 77faf5e fix(export): honest AADL static-export fallback + embed source (REQ-273, #468...
• ae8925f ci(resilience): wasm-seam gate + disk cleanup + hosted traceability fallback ...
• 665961e plan(v0.30): CI resilience + compliance-export robustness (#731)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)