ci: add external types and semver compat checks

.github/workflows/rust.yml

@@ -78,6 +78,34 @@ jobs:
         env:
           RUSTDOCFLAGS: -Dwarnings
 
+  semver:
+    name: Check semver compatibility
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Check semver
+        uses: obi1kenobi/cargo-semver-checks-action@v2
+
+  check-external-types:
+    name: Validate external types appearing in public API
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Install rust toolchain
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: nightly-2025-05-04
+          # ^ sync with https://github.com/awslabs/cargo-check-external-types/blob/main/rust-toolchain.toml
+      - run: cargo install --locked cargo-check-external-types
+      - name: run cargo-check-external-types
+        run: cargo check-external-types --all-features
+
   audit:
     runs-on: ubuntu-latest
     steps:

Cargo.toml

@@ -66,3 +66,18 @@ required-features = ["hyper-rustls"]
 # all non-default features except fips (cannot build on docs.rs environment)
 features = ["aws-lc-rs", "x509-parser", "time"]
 rustdoc-args = ["--cfg", "docsrs"]
+
+[package.metadata.cargo_check_external_types]
+allowed_external_types = [
+    "aws_lc_rs::*",
+    "base64::*",
+    "bytes::*",
+    "http::*",
+    "http_body::*",
+    "http_body_util::*",
+    "hyper::*",
+    "hyper_util::*",
+    "rustls_pki_types::*",
+    "serde::*",
+    "serde_json::*",
+]