From 727906b3bb0164d8b56c94dab9835e396fe7ac16 Mon Sep 17 00:00:00 2001
From: Manuel Raimann <raimannma@outlook.de>
Date: Fri, 30 Jan 2026 17:25:01 +0100
Subject: [PATCH] feat: add CI, audit, publish, and dependabot workflows

---
 .github/dependabot.yml        | 21 +++++++++
 .github/workflows/audit.yml   | 31 ++++++++++++++
 .github/workflows/ci.yml      | 75 ++++++++++++++++++++++++++++++++
 .github/workflows/publish.yml | 35 +++++++++++++++
 scripts/make-release          | 80 +++++++++++++++++++++++++++++++++++
 5 files changed, 242 insertions(+)
 create mode 100644 .github/dependabot.yml
 create mode 100644 .github/workflows/audit.yml
 create mode 100644 .github/workflows/ci.yml
 create mode 100644 .github/workflows/publish.yml
 create mode 100755 scripts/make-release

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..1fe1e31
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,21 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: daily
+    groups:
+      all-actions:
+        patterns:
+          - "*"
+    rebase-strategy: auto
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: daily
+    rebase-strategy: auto
+    groups:
+      production-dependencies:
+        dependency-type: "production"
+      development-dependencies:
+        dependency-type: "development"
diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
new file mode 100644
index 0000000..0a8c07c
--- /dev/null
+++ b/.github/workflows/audit.yml
@@ -0,0 +1,31 @@
+name: Audit
+
+on:
+  push:
+    paths:
+      - '**/Cargo.toml'
+      - '**/Cargo.lock'
+  pull_request:
+    paths:
+      - '**/Cargo.toml'
+      - '**/Cargo.lock'
+  schedule:
+    - cron: '0 0 * * *'
+
+permissions:
+  contents: read
+  issues: write
+  checks: write
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Install Rust
+        run: |
+          rustup override set stable
+          rustup update stable
+      - uses: rustsec/audit-check@v2.0.0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..4f07a4f
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,75 @@
+name: CI
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  fmt:
+    name: Format
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Install Rust
+        run: |
+          rustup override set stable
+          rustup update stable
+          rustup component add rustfmt
+      - run: cargo fmt --all --check
+
+  clippy:
+    name: Clippy
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Install Rust
+        run: |
+          rustup override set stable
+          rustup update stable
+          rustup component add clippy
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo clippy --all-targets --all-features -- -D warnings
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        features:
+          - ""
+          - "serde"
+          - "async"
+          - "serde,async"
+    steps:
+      - uses: actions/checkout@v6
+      - name: Install Rust
+        run: |
+          rustup override set stable
+          rustup update stable
+      - uses: Swatinem/rust-cache@v2
+      - name: Run tests
+        run: |
+          if [ -z "${{ matrix.features }}" ]; then
+            cargo test --verbose
+          else
+            cargo test --verbose --features "${{ matrix.features }}"
+          fi
+
+  docs:
+    name: Docs
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Install Rust
+        run: |
+          rustup override set stable
+          rustup update stable
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo doc --all-features --no-deps
+        env:
+          RUSTDOCFLAGS: -D warnings
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..3eff01f
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,35 @@
+name: Publish
+
+on:
+  push:
+    tags:
+      - "v*"
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  publish:
+    name: Publish to crates.io
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Install Rust
+        run: |
+          rustup override set stable
+          rustup update stable
+      - uses: Swatinem/rust-cache@v2
+
+      - name: Verify version matches tag
+        run: |
+          CARGO_VERSION=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[0].version')
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          if [ "$CARGO_VERSION" != "$TAG_VERSION" ]; then
+            echo "Error: Cargo.toml version ($CARGO_VERSION) doesn't match tag ($TAG_VERSION)"
+            exit 1
+          fi
+
+      - name: Publish
+        run: cargo publish
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
diff --git a/scripts/make-release b/scripts/make-release
new file mode 100755
index 0000000..b910167
--- /dev/null
+++ b/scripts/make-release
@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+    echo "Usage: $0 <version|major|minor|patch>"
+    echo ""
+    echo "Examples:"
+    echo "  $0 0.2.0    # Set version to 0.2.0"
+    echo "  $0 patch    # Bump patch version (0.1.0 -> 0.1.1)"
+    echo "  $0 minor    # Bump minor version (0.1.0 -> 0.2.0)"
+    echo "  $0 major    # Bump major version (0.1.0 -> 1.0.0)"
+    exit 1
+}
+
+[[ $# -ne 1 ]] && usage
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT_DIR="$(dirname "$SCRIPT_DIR")"
+CARGO_TOML="$ROOT_DIR/Cargo.toml"
+
+# Get current version
+CURRENT_VERSION=$(grep -m1 '^version = ' "$CARGO_TOML" | sed 's/version = "\(.*\)"/\1/')
+IFS='.' read -r MAJOR MINOR PATCH <<< "$CURRENT_VERSION"
+
+# Determine new version
+case "$1" in
+    major)
+        NEW_VERSION="$((MAJOR + 1)).0.0"
+        ;;
+    minor)
+        NEW_VERSION="$MAJOR.$((MINOR + 1)).0"
+        ;;
+    patch)
+        NEW_VERSION="$MAJOR.$MINOR.$((PATCH + 1))"
+        ;;
+    *)
+        if [[ "$1" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            NEW_VERSION="$1"
+        else
+            echo "Error: Invalid version format '$1'"
+            usage
+        fi
+        ;;
+esac
+
+echo "Current version: $CURRENT_VERSION"
+echo "New version:     $NEW_VERSION"
+echo ""
+
+# Check for uncommitted changes
+if ! git -C "$ROOT_DIR" diff --quiet || ! git -C "$ROOT_DIR" diff --cached --quiet; then
+    echo "Error: You have uncommitted changes. Please commit or stash them first."
+    exit 1
+fi
+
+# Check if tag already exists
+if git -C "$ROOT_DIR" tag -l "v$NEW_VERSION" | grep -q .; then
+    echo "Error: Tag v$NEW_VERSION already exists"
+    exit 1
+fi
+
+# Update version in Cargo.toml
+sed -i "s/^version = \"$CURRENT_VERSION\"/version = \"$NEW_VERSION\"/" "$CARGO_TOML"
+
+# Update Cargo.lock if it exists
+if [[ -f "$ROOT_DIR/Cargo.lock" ]]; then
+    cargo generate-lockfile --manifest-path "$CARGO_TOML" 2>/dev/null || true
+fi
+
+# Commit and tag
+git -C "$ROOT_DIR" add "$CARGO_TOML"
+[[ -f "$ROOT_DIR/Cargo.lock" ]] && git -C "$ROOT_DIR" add "$ROOT_DIR/Cargo.lock"
+git -C "$ROOT_DIR" commit -m "chore: release v$NEW_VERSION"
+git -C "$ROOT_DIR" tag -a "v$NEW_VERSION" -m "Release v$NEW_VERSION"
+
+echo ""
+echo "Created release v$NEW_VERSION"
+echo ""
+echo "To publish, run:"
+echo "  git push origin main --tags"