From 8f329de7209550c4c8ae160f37011dd85320e0b0 Mon Sep 17 00:00:00 2001 From: UncleSp1d3r Date: Mon, 16 Feb 2026 08:29:26 -0500 Subject: [PATCH 01/15] fix: address PR #132 review feedback - Add #![forbid(unsafe_code)] to src/lib.rs (was claimed in AGENTS.md and SECURITY.md but not actually enforced) - Fix qlty coverage upload path: target/lcov.info -> lcov.info to match where cargo-llvm-cov writes the report - Clarify CONTRIBUTING.md: list actual merge-blocking checks (quality, MSRV, test, cross-platform, coverage) and note that security audit and CodeQL are informational, not merge-blocking Signed-off-by: UncleSp1d3r --- .github/workflows/ci.yml | 2 +- CONTRIBUTING.md | 2 +- src/lib.rs | 2 ++ 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 89282f8..5ac7db0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -132,4 +132,4 @@ jobs: - uses: qltysh/qlty-action/coverage@v2 with: token: ${{ secrets.QLTY_COVERAGE_TOKEN }} - files: target/lcov.info + files: lcov.info diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 37eb6a4..c0c2545 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -82,7 +82,7 @@ All pull requests require review before merging. Reviewers check for: - **Style**: Follows project conventions, passes `cargo fmt` and `cargo clippy -- -D warnings` - **Documentation**: Public APIs have rustdoc, AGENTS.md updated if architecture changes -CI must pass before merge. This includes formatting, linting, tests, security audit, and CodeQL analysis. Branch protection enforces these checks on the `main` branch. +CI must pass before merge. The merge queue requires quality, MSRV, test, cross-platform test, and coverage checks. Security audit and CodeQL run as additional CI jobs but are not currently merge-blocking. ## Developer Certificate of Origin (DCO) diff --git a/src/lib.rs b/src/lib.rs index 510086e..fd04ec5 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -1,3 +1,5 @@ +#![forbid(unsafe_code)] + //! Stringy - A smarter alternative to the strings command //! //! Stringy leverages format-specific knowledge to distinguish meaningful strings From b359e7593ac1f2dc1f0c79ecec06edef21241896 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 16 Feb 2026 13:32:28 +0000 Subject: [PATCH 02/15] chore(deps): Bump rust-toolchain from 1.91.0 to 1.93.0 (#130) Bumps [rust-toolchain](https://github.com/rust-lang/rust) from 1.91.0 to 1.93.0.
Release notes

Sourced from rust-toolchain's releases.

Rust 1.93.0

Language

Compiler

Platform Support

Refer to Rust's platform support page for more information on Rust's tiered platform support.

Libraries

Stabilized APIs

... (truncated)

Changelog

Sourced from rust-toolchain's changelog.

Version 1.93.0 (2026-01-22)

Language

Compiler

Platform Support

Refer to Rust's platform support page for more information on Rust's tiered platform support.

Libraries

Stabilized APIs

... (truncated)

Commits
  • 254b596 Auto merge of #151369 - Mark-Simulacrum:stable-next, r=Mark-Simulacrum
  • 01ad1d6 Bump to stable release
  • 641c209 Add latest release note copy
  • a741008 Auto merge of #151270 - Mark-Simulacrum:beta-backport, r=Mark-Simulacrum
  • 6feceec Disable SimplifyComparisonIntegral
  • 2b8a999 Use both bors e-mails for CI postprocessing git lookup
  • 4c28b43 Revert bors email to the original homu one
  • a8201d3 Remove references to bors2
  • 9a4aba1 Auto merge of #151241 - fmease:beta-rustdoc-dont-eval-assoc-consts, r=fmease
  • 36e6625 [beta] rustdoc: Stop unconditionally evaluating the initializer of associated...
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=rust-toolchain&package-manager=rust_toolchain&previous-version=1.91.0&new-version=1.93.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: UncleSp1d3r Signed-off-by: UncleSp1d3r --- rust-toolchain.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rust-toolchain.toml b/rust-toolchain.toml index d7b41d3..a4571d6 100644 --- a/rust-toolchain.toml +++ b/rust-toolchain.toml @@ -1,3 +1,3 @@ [toolchain] -channel = "1.91.0" +channel = "1.93.0" components = [ "rustfmt", "clippy" ] From 22d1ba7bfaddff32d7e2e96e5d75194af4ef2a75 Mon Sep 17 00:00:00 2001 From: UncleSp1d3r Date: Mon, 16 Feb 2026 09:39:02 -0500 Subject: [PATCH 03/15] ci: replace dtolnay/rust-toolchain with jdx/mise-action across all workflows Standardize CI toolchain management on mise-action, making mise.toml the single source of truth for tool versions. This replaces dtolnay/rust-toolchain, jontze/action-mdbook, cargo-bins/cargo-binstall, extractions/setup-just, actions/setup-python, taiki-e/install-action, and EmbarkStudios/cargo-deny-action with a single mise-action step per job. The MSRV job retains dtolnay@1.91.0 for pinned older toolchain testing. Also syncs Rust version to 1.93.0 in mise.toml to match rust-toolchain.toml and adds mdbook-yml-header, mdbook-image-size, and cargo-outdated to mise.toml. Signed-off-by: UncleSp1d3r --- .github/workflows/ci.yml | 49 ++++++++--------------- .github/workflows/codeql.yml | 7 +++- .github/workflows/copilot-setup-steps.yml | 27 +++---------- .github/workflows/docs.yml | 22 ++-------- .github/workflows/security.yml | 12 +++--- .vscode/settings.json | 2 +- Cargo.toml | 12 +++--- mise.lock | 14 ++++++- mise.toml | 10 +++-- 9 files changed, 62 insertions(+), 93 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5ac7db0..7d2e441 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -25,15 +25,11 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v6 - - uses: dtolnay/rust-toolchain@1.91.0 + - uses: jdx/mise-action@v3 with: - components: rustfmt, clippy - - - name: Install just - uses: extractions/setup-just@v3 - - - name: Cache Rust dependencies - uses: Swatinem/rust-cache@v2 + install: true + cache: true + github_token: ${{ secrets.GITHUB_TOKEN }} - name: Rustfmt Check uses: actions-rust-lang/rustfmt@v1 @@ -57,16 +53,11 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v6 - - - name: Setup Rust - uses: dtolnay/rust-toolchain@1.91.0 + - uses: jdx/mise-action@v3 with: - components: rustfmt, clippy - - - name: Install cargo-nextest - uses: taiki-e/install-action@v2 - with: - tool: cargo-nextest + install: true + cache: true + github_token: ${{ secrets.GITHUB_TOKEN }} - name: Run tests (all features) run: cargo nextest run --all-features @@ -88,14 +79,11 @@ jobs: runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@v6 - - - name: Setup Rust - uses: dtolnay/rust-toolchain@1.91.0 - - - name: Install cargo-nextest - uses: taiki-e/install-action@v2 + - uses: jdx/mise-action@v3 with: - tool: cargo-nextest + install: true + cache: true + github_token: ${{ secrets.GITHUB_TOKEN }} - run: cargo nextest run --all-features - run: cargo build --release --all-features @@ -105,16 +93,11 @@ jobs: needs: [test, test-cross-platform] steps: - uses: actions/checkout@v6 - - - name: Setup Rust - uses: dtolnay/rust-toolchain@1.91.0 - with: - components: llvm-tools - - - name: Install cargo-llvm-cov - uses: taiki-e/install-action@v2 + - uses: jdx/mise-action@v3 with: - tool: cargo-llvm-cov + install: true + cache: true + github_token: ${{ secrets.GITHUB_TOKEN }} - name: Generate coverage run: cargo llvm-cov --all-features --no-report diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 08df85d..4865ff5 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -21,8 +21,11 @@ jobs: steps: - uses: actions/checkout@v6 - - name: Setup Rust - uses: dtolnay/rust-toolchain@1.91.0 + - uses: jdx/mise-action@v3 + with: + install: true + cache: true + github_token: ${{ secrets.GITHUB_TOKEN }} - uses: github/codeql-action/init@v4 with: diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml index 09d0b69..9938e35 100644 --- a/.github/workflows/copilot-setup-steps.yml +++ b/.github/workflows/copilot-setup-steps.yml @@ -19,33 +19,16 @@ jobs: # Set the permissions to the lowest permissions possible needed for your steps. # Copilot will be given its own token for its operations. permissions: - # If you want to clone the repository as part of your setup steps, for example to - # install dependencies, you'll need the `contents: read` permission. If you don't - # clone the repository in your setup steps, Copilot will do this for you - # automatically after the steps complete. contents: read - # You can define any steps you want, and they will run before the agent starts. - # If you do not check out your code, Copilot will do this for you. steps: - uses: actions/checkout@v6 - - uses: dtolnay/rust-toolchain@1.91.0 - - uses: extractions/setup-just@v3 - - name: Set up Python for pre-commit - uses: actions/setup-python@v6 + - uses: jdx/mise-action@v3 with: - python-version: "3.13" - - - name: Install cargo tools - uses: taiki-e/install-action@v2 - with: - tool: cargo-nextest,cargo-llvm-cov,cargo-audit,cargo-deny,cargo-dist,mdbook - - - name: Install mdbook plugins - uses: taiki-e/install-action@v2 - with: - tool: mdbook-admonish,mdbook-mermaid,mdbook-linkcheck,mdbook-toc,mdbook-open-on-gh,mdbook-tabs,mdbook-i18n-helpers + install: true + cache: true + github_token: ${{ secrets.GITHUB_TOKEN }} - name: Run just install run: | @@ -53,7 +36,7 @@ jobs: - name: Setup summary run: | - echo "✅ Stringy development environment setup complete!" + echo "Stringy development environment setup complete!" echo "" echo "Available tools:" echo " - Rust toolchain: $(rustc --version)" diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 5ffb9fc..0347e54 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -27,25 +27,11 @@ jobs: - name: Checkout uses: actions/checkout@v6 - - name: Setup Rust - uses: dtolnay/rust-toolchain@1.91.0 + - uses: jdx/mise-action@v3 with: - components: rustfmt, clippy - - - name: Setup mdBook - uses: jontze/action-mdbook@v4 - with: - token: ${{ secrets.GITHUB_TOKEN }} - mdbook-version: 0.5.2 - use-mermaid: true - use-toc: true - use-admonish: true - - - name: Install cargo-binstall - uses: cargo-bins/cargo-binstall@main - - - name: Install mdbook plugins - run: cargo binstall mdbook-tabs mdbook-i18n-helpers mdbook-yml-header mdbook-image-size --no-confirm + install: true + cache: true + github_token: ${{ secrets.GITHUB_TOKEN }} - name: Build mdBook run: | diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 5e8643d..4c1c9e7 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -26,14 +26,14 @@ jobs: steps: - uses: actions/checkout@v6 - - name: Setup Rust - uses: dtolnay/rust-toolchain@1.91.0 - - - uses: taiki-e/install-action@v2 + - uses: jdx/mise-action@v3 with: - tool: cargo-outdated,cargo-dist + install: true + cache: true + github_token: ${{ secrets.GITHUB_TOKEN }} - - uses: EmbarkStudios/cargo-deny-action@v2 + - name: Run cargo deny check + run: cargo deny check - name: Run cargo outdated run: cargo outdated --depth=1 --exit-code=1 diff --git a/.vscode/settings.json b/.vscode/settings.json index 868f790..e62bfb9 100644 --- a/.vscode/settings.json +++ b/.vscode/settings.json @@ -9,4 +9,4 @@ "debug.javascript.defaultRuntimeExecutable": { "pwa-node": "${workspaceFolder}/.vscode/mise-tools/node" } -} \ No newline at end of file +} diff --git a/Cargo.toml b/Cargo.toml index 2c6d19b..4f7d908 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -20,22 +20,22 @@ name = "stringy" path = "src/main.rs" [dependencies] -clap = { version = "4.5.54", features = [ "derive" ] } +clap = { version = "4.5.58", features = [ "derive" ] } cpp_demangle = "0.5.1" entropy = "0.4.3" -goblin = "0.10.4" +goblin = "0.10.5" once_cell = "1.21.3" pelite = "0.10.0" -regex = "1.12.2" +regex = "1.12.3" rustc-demangle = "0.1.27" serde = { version = "1.0.228", features = [ "derive" ] } serde_json = "1.0.149" thiserror = "2.0.18" [dev-dependencies] -criterion = "0.8.1" -insta = "1.46.1" -tempfile = "3.24.0" +criterion = "0.8.2" +insta = "1.46.3" +tempfile = "3.25.0" # The profile that 'dist' will build with [profile.dist] diff --git a/mise.lock b/mise.lock index d379be0..8c32ede 100644 --- a/mise.lock +++ b/mise.lock @@ -38,6 +38,10 @@ backend = "cargo:cargo-llvm-cov" version = "0.9.123-b.4" backend = "cargo:cargo-nextest" +[[tools."cargo:cargo-outdated"]] +version = "0.17.0" +backend = "cargo:cargo-outdated" + [[tools."cargo:cargo-release"]] version = "0.25.22" backend = "cargo:cargo-release" @@ -58,6 +62,10 @@ backend = "cargo:mdbook-admonish" version = "0.4.0" backend = "cargo:mdbook-i18n-helpers" +[[tools."cargo:mdbook-image-size"]] +version = "0.2.1" +backend = "cargo:mdbook-image-size" + [[tools."cargo:mdbook-linkcheck"]] version = "0.7.7" backend = "cargo:mdbook-linkcheck" @@ -78,6 +86,10 @@ backend = "cargo:mdbook-tabs" version = "0.15.3" backend = "cargo:mdbook-toc" +[[tools."cargo:mdbook-yml-header"]] +version = "0.1.5" +backend = "cargo:mdbook-yml-header" + [[tools.claude]] version = "2.1.42" backend = "aqua:anthropics/claude-code" @@ -130,7 +142,7 @@ version = "3.14.2" backend = "core:python" [[tools.rust]] -version = "1.92.0" +version = "1.93.0" backend = "core:rust" [[tools.zig]] diff --git a/mise.toml b/mise.toml index 5ca36bf..e0eff34 100644 --- a/mise.toml +++ b/mise.toml @@ -15,21 +15,23 @@ cargo-insta = "1.46.1" "cargo:mdbook-admonish" = "1.20.0" "cargo:mdbook-open-on-gh" = "3.0.0" "cargo:mdbook-i18n-helpers" = "0.4.0" +"cargo:mdbook-yml-header" = "0.1.5" +"cargo:mdbook-image-size" = "0.2.1" +"cargo:cargo-outdated" = "0.17.0" claude = "latest" cyclonedx = "0.29.2" git-cliff = "2.11.0" goreleaser = "2.13.3" just = "1.46.0" markdownlint-cli2 = "0.20.0" -node = "25.4.0" pre-commit = "4.5.1" prettier = "3.8.1" -python = "3.14.2" -rust = "1.92.0" "cargo:cargo-release" = "0.25.22" "cargo:cargo-auditable" = "0.7.2" "cargo:cargo-cyclonedx" = "0.5.7" "pipx:mdformat" = { version = "0.7.21", uvx_args = "--with mdformat-gfm --with mdformat-frontmatter --with mdformat-footnote --with mdformat-simple-breaks --with mdformat-gfm-alerts --with mdformat-toc --with mdformat-wikilink --with mdformat-tables" } lychee = "0.22.0" -zig = "0.15.2" "cargo:cargo-zigbuild" = "0.21.2" + +[settings] +idiomatic_version_file_enable_tools = [ "python", "rust", "node", "zig" ] From 735925518f49f5757abe7a185d1ce045473a26d7 Mon Sep 17 00:00:00 2001 From: UncleSp1d3r Date: Mon, 16 Feb 2026 10:31:19 -0500 Subject: [PATCH 04/15] fix(ci): resolve cross-platform and copilot-setup-steps failures - test-cross-platform: use selective tool install (rust + cargo-nextest only) instead of installing all mise tools, avoiding the unsupported claude tool on Windows and unnecessary mdbook/zig installs - docs: install mdbook-yml-header via cargo-binstall since it fails to compile from source via mise - mise.toml: remove mdbook-yml-header and mdbook-image-size (yml-header cannot build from source in CI, image-size is unused in book.toml) Signed-off-by: UncleSp1d3r --- .github/workflows/ci.yml | 5 ++++- .github/workflows/docs.yml | 3 +++ mise.toml | 2 -- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7d2e441..33e9adc 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -81,10 +81,13 @@ jobs: - uses: actions/checkout@v6 - uses: jdx/mise-action@v3 with: - install: true + install: false cache: true github_token: ${{ secrets.GITHUB_TOKEN }} + - name: Install test dependencies + run: mise install rust "cargo:cargo-nextest" + - run: cargo nextest run --all-features - run: cargo build --release --all-features diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 0347e54..639f3f5 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -33,6 +33,9 @@ jobs: cache: true github_token: ${{ secrets.GITHUB_TOKEN }} + - name: Install mdbook-yml-header + run: cargo binstall mdbook-yml-header --no-confirm + - name: Build mdBook run: | cd docs diff --git a/mise.toml b/mise.toml index e0eff34..c6c21ba 100644 --- a/mise.toml +++ b/mise.toml @@ -15,8 +15,6 @@ cargo-insta = "1.46.1" "cargo:mdbook-admonish" = "1.20.0" "cargo:mdbook-open-on-gh" = "3.0.0" "cargo:mdbook-i18n-helpers" = "0.4.0" -"cargo:mdbook-yml-header" = "0.1.5" -"cargo:mdbook-image-size" = "0.2.1" "cargo:cargo-outdated" = "0.17.0" claude = "latest" cyclonedx = "0.29.2" From ec2213e1c0222e9c2e83e4963c9020b390d9a451 Mon Sep 17 00:00:00 2001 From: UncleSp1d3r Date: Mon, 16 Feb 2026 10:34:49 -0500 Subject: [PATCH 05/15] fix(ci): add default profile to rust-toolchain.toml for cargo support When rust is managed via idiomatic version file (rust-toolchain.toml) instead of mise.toml directly, the absence of an explicit profile caused mise to install Rust without the cargo component. This broke any cargo: tool that needed to compile from source (e.g. mdbook-yml-header). Adding profile = "default" ensures cargo, rustc, rust-std, rust-docs, rustfmt, and clippy are all installed. Restores mdbook-yml-header to mise.toml now that the root cause is fixed. Signed-off-by: UncleSp1d3r --- .github/workflows/docs.yml | 3 --- mise.toml | 1 + rust-toolchain.toml | 1 + 3 files changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 639f3f5..0347e54 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -33,9 +33,6 @@ jobs: cache: true github_token: ${{ secrets.GITHUB_TOKEN }} - - name: Install mdbook-yml-header - run: cargo binstall mdbook-yml-header --no-confirm - - name: Build mdBook run: | cd docs diff --git a/mise.toml b/mise.toml index c6c21ba..25a3672 100644 --- a/mise.toml +++ b/mise.toml @@ -15,6 +15,7 @@ cargo-insta = "1.46.1" "cargo:mdbook-admonish" = "1.20.0" "cargo:mdbook-open-on-gh" = "3.0.0" "cargo:mdbook-i18n-helpers" = "0.4.0" +"cargo:mdbook-yml-header" = "0.1.5" "cargo:cargo-outdated" = "0.17.0" claude = "latest" cyclonedx = "0.29.2" diff --git a/rust-toolchain.toml b/rust-toolchain.toml index a4571d6..0d4b45c 100644 --- a/rust-toolchain.toml +++ b/rust-toolchain.toml @@ -1,3 +1,4 @@ [toolchain] channel = "1.93.0" +profile = "default" components = [ "rustfmt", "clippy" ] From 5f630b3aed7a5c3fbd538bb3b06705821d9e840d Mon Sep 17 00:00:00 2001 From: UncleSp1d3r Date: Mon, 16 Feb 2026 10:43:11 -0500 Subject: [PATCH 06/15] fix(ci): remove mdbook-yml-header from mise.toml (fails cargo install) mdbook-yml-header cannot compile from source via cargo install --locked, which causes every CI job using mise install to fail. Install it via cargo-binstall in the docs workflow where it is actually needed. Signed-off-by: UncleSp1d3r --- .github/workflows/docs.yml | 3 +++ mise.toml | 1 - 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 0347e54..639f3f5 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -33,6 +33,9 @@ jobs: cache: true github_token: ${{ secrets.GITHUB_TOKEN }} + - name: Install mdbook-yml-header + run: cargo binstall mdbook-yml-header --no-confirm + - name: Build mdBook run: | cd docs diff --git a/mise.toml b/mise.toml index 25a3672..c6c21ba 100644 --- a/mise.toml +++ b/mise.toml @@ -15,7 +15,6 @@ cargo-insta = "1.46.1" "cargo:mdbook-admonish" = "1.20.0" "cargo:mdbook-open-on-gh" = "3.0.0" "cargo:mdbook-i18n-helpers" = "0.4.0" -"cargo:mdbook-yml-header" = "0.1.5" "cargo:cargo-outdated" = "0.17.0" claude = "latest" cyclonedx = "0.29.2" From 8e32bc3977cd650fd43e14869386327225492e91 Mon Sep 17 00:00:00 2001 From: UncleSp1d3r Date: Mon, 16 Feb 2026 10:56:57 -0500 Subject: [PATCH 07/15] fix(ci): replace rustfmt action with direct command, prevent auto-install - Replace actions-rust-lang/rustfmt@v1 with direct cargo fmt --check to avoid stderr suppression that hides errors with mise toolchain - Add MISE_AUTO_INSTALL=false to test-cross-platform to prevent mise shims from auto-installing all tools (fixes Windows claude failure) Signed-off-by: UncleSp1d3r --- .github/workflows/ci.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 33e9adc..4dadea5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -32,7 +32,7 @@ jobs: github_token: ${{ secrets.GITHUB_TOKEN }} - name: Rustfmt Check - uses: actions-rust-lang/rustfmt@v1 + run: cargo fmt --all -- --check - name: Run clippy (all features) run: cargo clippy --all-targets --all-features -- -D warnings @@ -77,6 +77,8 @@ jobs: platform: "Windows" runs-on: ${{ matrix.os }} + env: + MISE_AUTO_INSTALL: "false" steps: - uses: actions/checkout@v6 - uses: jdx/mise-action@v3 From b7139716cdb4914b41b5dd40bad5a3ff0fa1dccf Mon Sep 17 00:00:00 2001 From: UncleSp1d3r Date: Mon, 16 Feb 2026 11:00:04 -0500 Subject: [PATCH 08/15] fix(ci): bust stale mise cache and add toolchain verification Bump cache_key_prefix to mise-v1 across all jobs to invalidate stale caches from before the rust-toolchain.toml profile change. Add a toolchain verification step to quality job for debugging. Signed-off-by: UncleSp1d3r --- .github/workflows/ci.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4dadea5..f9cf73e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -29,8 +29,15 @@ jobs: with: install: true cache: true + cache_key_prefix: mise-v1 github_token: ${{ secrets.GITHUB_TOKEN }} + - name: Verify toolchain + run: | + rustc --version + cargo --version + rustfmt --version + - name: Rustfmt Check run: cargo fmt --all -- --check @@ -57,6 +64,7 @@ jobs: with: install: true cache: true + cache_key_prefix: mise-v1 github_token: ${{ secrets.GITHUB_TOKEN }} - name: Run tests (all features) @@ -85,6 +93,7 @@ jobs: with: install: false cache: true + cache_key_prefix: mise-v1 github_token: ${{ secrets.GITHUB_TOKEN }} - name: Install test dependencies @@ -102,6 +111,7 @@ jobs: with: install: true cache: true + cache_key_prefix: mise-v1 github_token: ${{ secrets.GITHUB_TOKEN }} - name: Generate coverage From e8bf0333502532bd9f72055b61ffcd9047566693 Mon Sep 17 00:00:00 2001 From: UncleSp1d3r Date: Mon, 16 Feb 2026 11:02:02 -0500 Subject: [PATCH 09/15] fix(ci): align with libmagic-rs CI pattern for reliable toolchain setup - quality: use dtolnay/rust-toolchain for Rust (rustfmt, clippy) with mise-action for other tools, matching the proven libmagic-rs pattern - Remove claude from mise.toml as it does not support Windows and is not a build dependency (developers install it separately) - Simplify test-cross-platform back to plain mise install: true now that the Windows-incompatible tool is removed - Remove debug toolchain verification step and cache key overrides Signed-off-by: UncleSp1d3r --- .github/workflows/ci.yml | 20 ++++---------------- mise.toml | 1 - 2 files changed, 4 insertions(+), 17 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f9cf73e..4d31947 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -25,19 +25,15 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v6 + - uses: dtolnay/rust-toolchain@1.93.0 + with: + components: rustfmt, clippy - uses: jdx/mise-action@v3 with: install: true cache: true - cache_key_prefix: mise-v1 github_token: ${{ secrets.GITHUB_TOKEN }} - - name: Verify toolchain - run: | - rustc --version - cargo --version - rustfmt --version - - name: Rustfmt Check run: cargo fmt --all -- --check @@ -64,7 +60,6 @@ jobs: with: install: true cache: true - cache_key_prefix: mise-v1 github_token: ${{ secrets.GITHUB_TOKEN }} - name: Run tests (all features) @@ -85,20 +80,14 @@ jobs: platform: "Windows" runs-on: ${{ matrix.os }} - env: - MISE_AUTO_INSTALL: "false" steps: - uses: actions/checkout@v6 - uses: jdx/mise-action@v3 with: - install: false + install: true cache: true - cache_key_prefix: mise-v1 github_token: ${{ secrets.GITHUB_TOKEN }} - - name: Install test dependencies - run: mise install rust "cargo:cargo-nextest" - - run: cargo nextest run --all-features - run: cargo build --release --all-features @@ -111,7 +100,6 @@ jobs: with: install: true cache: true - cache_key_prefix: mise-v1 github_token: ${{ secrets.GITHUB_TOKEN }} - name: Generate coverage diff --git a/mise.toml b/mise.toml index c6c21ba..d52164f 100644 --- a/mise.toml +++ b/mise.toml @@ -16,7 +16,6 @@ cargo-insta = "1.46.1" "cargo:mdbook-open-on-gh" = "3.0.0" "cargo:mdbook-i18n-helpers" = "0.4.0" "cargo:cargo-outdated" = "0.17.0" -claude = "latest" cyclonedx = "0.29.2" git-cliff = "2.11.0" goreleaser = "2.13.3" From 5d5ff2c5c57137370cf52fd67252441cdb0feeb5 Mon Sep 17 00:00:00 2001 From: UncleSp1d3r Date: Mon, 16 Feb 2026 18:03:21 -0500 Subject: [PATCH 10/15] fix(ci): update rust-toolchain action and add toolchain matrix for MSRV compliance Signed-off-by: UncleSp1d3r --- .github/workflows/ci.yml | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4d31947..7149ede 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -25,9 +25,10 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v6 - - uses: dtolnay/rust-toolchain@1.93.0 + - uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9 with: components: rustfmt, clippy + toolchain: 1.93.0 - uses: jdx/mise-action@v3 with: install: true @@ -42,9 +43,20 @@ jobs: msrv: runs-on: ubuntu-latest + strategy: + matrix: + include: + - toolchain: stable + - toolchain: stable minus 1 releases + - toolchain: stable minus 2 releases + - toolchain: stable minus 3 releases + - toolchain: stable minus 4 releases steps: - uses: actions/checkout@v6 - - uses: dtolnay/rust-toolchain@1.91.0 + - uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9 + with: + components: rustfmt, clippy + toolchain: ${{ matrix.toolchain }} - name: Cache Rust dependencies uses: Swatinem/rust-cache@v2 From 13deaeb2cecaf5e98068d49ae11c39d8444d0e54 Mon Sep 17 00:00:00 2001 From: UncleSp1d3r Date: Mon, 16 Feb 2026 18:12:46 -0500 Subject: [PATCH 11/15] ci: remove qlty coverage upload from CI Codecov is the coverage provider for this project. Remove the unused qltysh/qlty-action/coverage step. Signed-off-by: UncleSp1d3r --- .github/workflows/ci.yml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7149ede..844e91c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -127,7 +127,3 @@ jobs: fail_ci_if_error: false token: ${{ secrets.CODECOV_TOKEN }} slug: EvilBit-Labs/Stringy - - uses: qltysh/qlty-action/coverage@v2 - with: - token: ${{ secrets.QLTY_COVERAGE_TOKEN }} - files: lcov.info From 4dcffe35f4161d1243e277fe4a85b093d5f5bab8 Mon Sep 17 00:00:00 2001 From: UncleSp1d3r Date: Mon, 16 Feb 2026 18:18:28 -0500 Subject: [PATCH 12/15] fix: add node, zig, and python versions to mise.toml Signed-off-by: UncleSp1d3r --- mise.toml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/mise.toml b/mise.toml index d52164f..36e1245 100644 --- a/mise.toml +++ b/mise.toml @@ -29,6 +29,9 @@ prettier = "3.8.1" "pipx:mdformat" = { version = "0.7.21", uvx_args = "--with mdformat-gfm --with mdformat-frontmatter --with mdformat-footnote --with mdformat-simple-breaks --with mdformat-gfm-alerts --with mdformat-toc --with mdformat-wikilink --with mdformat-tables" } lychee = "0.22.0" "cargo:cargo-zigbuild" = "0.21.2" +node = "25.4.0" +zig = "0.15.2" +python = "3.14.2" [settings] idiomatic_version_file_enable_tools = [ "python", "rust", "node", "zig" ] From 1f176495e496d6551e16159ce96d58d419687c2c Mon Sep 17 00:00:00 2001 From: UncleSp1d3r Date: Mon, 16 Feb 2026 18:24:51 -0500 Subject: [PATCH 13/15] fix: address PR #134 review feedback - Add #![forbid(unsafe_code)] to src/main.rs so the prohibition applies to both library and binary targets - Add llvm-tools-preview to rust-toolchain.toml components so cargo llvm-cov has the instrumentation tools it needs for coverage - Pin mdbook-yml-header version in docs.yml binstall command for reproducible builds Signed-off-by: UncleSp1d3r --- .github/workflows/docs.yml | 2 +- rust-toolchain.toml | 2 +- src/main.rs | 2 ++ 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 639f3f5..f199f73 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -34,7 +34,7 @@ jobs: github_token: ${{ secrets.GITHUB_TOKEN }} - name: Install mdbook-yml-header - run: cargo binstall mdbook-yml-header --no-confirm + run: cargo binstall mdbook-yml-header@0.1.5 --no-confirm - name: Build mdBook run: | diff --git a/rust-toolchain.toml b/rust-toolchain.toml index 0d4b45c..0dd0ae1 100644 --- a/rust-toolchain.toml +++ b/rust-toolchain.toml @@ -1,4 +1,4 @@ [toolchain] channel = "1.93.0" profile = "default" -components = [ "rustfmt", "clippy" ] +components = [ "rustfmt", "clippy", "llvm-tools-preview" ] diff --git a/src/main.rs b/src/main.rs index 3a4cfdb..664951f 100644 --- a/src/main.rs +++ b/src/main.rs @@ -1,3 +1,5 @@ +#![forbid(unsafe_code)] + use clap::Parser; use std::path::PathBuf; From 8c99b60daf690cdc11cef61549c15a5e1c1e98fd Mon Sep 17 00:00:00 2001 From: UncleSp1d3r Date: Mon, 16 Feb 2026 18:32:21 -0500 Subject: [PATCH 14/15] fix(ci): update mergify msrv check to match matrix job names The msrv job now uses a strategy matrix (stable, stable minus 1..4), so the check names are msrv (stable), msrv (stable minus 1 releases), etc. Use regex matching (check-success~=^msrv) instead of exact match. Signed-off-by: UncleSp1d3r --- .mergify.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.mergify.yml b/.mergify.yml index 19b8c72..459efe4 100644 --- a/.mergify.yml +++ b/.mergify.yml @@ -3,7 +3,7 @@ queue_rules: merge_method: squash merge_conditions: - check-success = quality - - check-success = msrv + - "check-success~=^msrv" - check-success = test - "check-success = test-cross-platform (ubuntu-latest, Linux)" - "check-success = test-cross-platform (macos-latest, macOS)" @@ -74,7 +74,7 @@ merge_protections: - base = main success_conditions: - check-success = quality - - check-success = msrv + - "check-success~=^msrv" - check-success = test - "check-success = test-cross-platform (ubuntu-latest, Linux)" - "check-success = test-cross-platform (macos-latest, macOS)" From 35e9ab1e8a85bac0b285a4678018b08119f7618b Mon Sep 17 00:00:00 2001 From: UncleSp1d3r Date: Mon, 16 Feb 2026 20:05:35 -0500 Subject: [PATCH 15/15] fix(ci): list msrv matrix variants explicitly in mergify config The check-success~= regex operator does not work as expected for merge protections. List all 5 msrv matrix job names explicitly instead. Signed-off-by: UncleSp1d3r --- .mergify.yml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/.mergify.yml b/.mergify.yml index 459efe4..4a5bd4f 100644 --- a/.mergify.yml +++ b/.mergify.yml @@ -3,7 +3,11 @@ queue_rules: merge_method: squash merge_conditions: - check-success = quality - - "check-success~=^msrv" + - "check-success = msrv (stable)" + - "check-success = msrv (stable minus 1 releases)" + - "check-success = msrv (stable minus 2 releases)" + - "check-success = msrv (stable minus 3 releases)" + - "check-success = msrv (stable minus 4 releases)" - check-success = test - "check-success = test-cross-platform (ubuntu-latest, Linux)" - "check-success = test-cross-platform (macos-latest, macOS)" @@ -74,7 +78,11 @@ merge_protections: - base = main success_conditions: - check-success = quality - - "check-success~=^msrv" + - "check-success = msrv (stable)" + - "check-success = msrv (stable minus 1 releases)" + - "check-success = msrv (stable minus 2 releases)" + - "check-success = msrv (stable minus 3 releases)" + - "check-success = msrv (stable minus 4 releases)" - check-success = test - "check-success = test-cross-platform (ubuntu-latest, Linux)" - "check-success = test-cross-platform (macos-latest, macOS)"