fix(security): enforce unsafe code prohibition and update CI requirements by unclesp1d3r · Pull Request #134 · EvilBit-Labs/Stringy

unclesp1d3r · 2026-02-16T13:33:21Z

This pull request introduces several improvements to project quality and safety, including enforcing Rust's safety guarantees, updating CI documentation to reflect current merge requirements, and correcting a coverage file path in the CI workflow.

Project safety and code quality:

Enforced Rust's safety guarantees by adding #![forbid(unsafe_code)] at the top of src/lib.rs, preventing the use of unsafe Rust code in the crate.

Continuous Integration (CI) and documentation:

Updated the CI requirements in CONTRIBUTING.md to clarify which checks are required for merging (quality, MSRV, test, cross-platform test, and coverage), and noted that security audit and CodeQL are no longer merge-blocking.
Fixed the coverage report file path in .github/workflows/ci.yml from target/lcov.info to lcov.info to ensure correct coverage reporting.

coderabbitai · 2026-02-16T13:33:38Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

Consolidated GitHub Actions Rust/tooling setup to jdx/mise-action@v3, updated coverage output path to lcov.info, added #![forbid(unsafe_code)], bumped several Cargo dependency versions and added [profile.dist], modified mise.toml tools/settings, and updated CONTRIBUTING CI/merge-queue language.

Changes

Cohort / File(s)	Summary
Workflows (tooling consolidation) `.github/workflows/ci.yml`, `.github/workflows/codeql.yml`, `.github/workflows/docs.yml`, `.github/workflows/security.yml`, `.github/workflows/copilot-setup-steps.yml`	Replaced per-job Rust/tooling setup and separate install/cache steps with `jdx/mise-action@v3` (commonly `install: true`, `cache: true`, `github_token`). Removed explicit installs for tools (just, cargo-nextest, cargo-llvm-cov, etc.).
CI — coverage path & tooling `.github/workflows/ci.yml`	Coverage job now uses mise-action; coverage report path changed from `target/lcov.info` to `lcov.info` at repo root; test dependency installation adjusted for cross-platform matrix.
Repository tooling manifest `mise.toml`	Added `cargo:mdbook-yml-header = "0.1.5"` and `cargo:cargo-outdated = "0.17.0"`, removed `zig = "0.15.2"`, and added `[settings].idiomatic_version_file_enable_tools` including `["python","rust","node","zig"]`.
Rust crate `src/lib.rs`	Added crate attribute `#![forbid(unsafe_code)]`.
Dependencies & profile `Cargo.toml`	Bumped dependency versions (`clap`, `goblin`, `regex`, `criterion`, `insta`, `tempfile`) and added `[profile.dist]` with `inherits = "release"` and `lto = "thin"`.
Contributor guidance `CONTRIBUTING.md`	Replaced merge-blocking CI wording with merge-queue description enumerating quality, MSRV, tests, cross-platform tests, and coverage as gating checks; CodeQL/security remain non-gating.
Editor config `.vscode/settings.json`	Only added a trailing newline — no behavioral change.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

chore(ci): add OSSF and CI best practices #132: Overlapping changes to CI workflows (notably .github/workflows/ci.yml) and contributor/CI gating language; likely directly related to this tooling consolidation.

Poem

Tooling merged into one tidy thread,
Coverage moved to root where it's read,
Unsafe is forbidden — safety first,
Versions bumped, profiles set — build thirst. 🚀

🚥 Pre-merge checks | ✅ 7 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Merge Conflict Detection	⚠️ Warning	❌ Merge conflicts detected (12 files): ⚔️ `.github/workflows/ci.yml` (content) ⚔️ `.github/workflows/codeql.yml` (content) ⚔️ `.github/workflows/copilot-setup-steps.yml` (content) ⚔️ `.github/workflows/docs.yml` (content) ⚔️ `.github/workflows/security.yml` (content) ⚔️ `.vscode/settings.json` (content) ⚔️ `CONTRIBUTING.md` (content) ⚔️ `Cargo.toml` (content) ⚔️ `mise.lock` (content) ⚔️ `mise.toml` (content) ⚔️ `rust-toolchain.toml` (content) ⚔️ `src/lib.rs` (content) These conflicts must be resolved before merging into `main`.	Resolve conflicts locally and push changes to this branch.
Error Handling	⚠️ Warning	PR introduces inconsistent error handling patterns within extraction module: config.rs uses Result<(), String> with raw string errors while mod.rs uses Result<()> with StringyError variants, violating project conventions.	Change config.rs validation methods to Result<()> and replace 11 raw string Err() returns with Err(StringyError::ConfigError(...)) to match mod.rs pattern and adhere to documented error-handling conventions.

✅ Passed checks (7 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title follows Conventional Commits format with type 'fix' and scope 'security', accurately reflecting the main changes: adding forbid(unsafe_code) and updating CI merge requirements.
Description check	✅ Passed	The description clearly relates to the changeset, outlining the three main improvements: safety enforcement, CI documentation updates, and coverage file path correction.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
No Unsafe Code	✅ Passed	The pull request correctly enforces unsafe code prohibition with #![forbid(unsafe_code)] at the crate root. No unsafe blocks, unsafe fn, or unsafe trait definitions exist in the codebase.
Ascii Only	✅ Passed	PR introduces no Unicode punctuation; pre-existing emojis in src/lib.rs unaffected; only ASCII changes added.
File Size Limit	✅ Passed	All modified files are under 500-line limit. Largest files: .github/workflows/ci.yml (121 lines), CONTRIBUTING.md (143 lines), src/lib.rs (94 lines). Only fine-grained function-level #[allow] attributes present, no blanket module/file-level suppressions.
Section Weight Consistency	✅ Passed	PR modifies only CI workflows, configuration files, and documentation. No container parser code or section weight configurations are present in the changeset.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch fix/pr-132-review-feedback

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

mergify · 2026-02-16T13:33:55Z

- Add #![forbid(unsafe_code)] to src/lib.rs (was claimed in AGENTS.md and SECURITY.md but not actually enforced) - Fix qlty coverage upload path: target/lcov.info -> lcov.info to match where cargo-llvm-cov writes the report - Clarify CONTRIBUTING.md: list actual merge-blocking checks (quality, MSRV, test, cross-platform, coverage) and note that security audit and CodeQL are informational, not merge-blocking Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

Bumps [rust-toolchain](https://github.com/rust-lang/rust) from 1.91.0 to 1.93.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/rust-lang/rust/releases">rust-toolchain's releases</a>.</em></p> <blockquote> <h2>Rust 1.93.0</h2> <p></p> <h2>Language</h2> <ul> <li><a href="https://redirect.github.com/rust-lang/rust/pull/145656">Stabilize several s390x <code>vector</code>-related target features and the <code>is_s390x_feature_detected!</code> macro</a></li> <li><a href="https://redirect.github.com/rust-lang/rust/pull/145954">Stabilize declaration of C-style variadic functions for the <code>system</code> ABI</a></li> <li><a href="https://redirect.github.com/rust-lang/rust/pull/146978">Emit error when using some keyword as a <code>cfg</code> predicate</a></li> <li><a href="https://redirect.github.com/rust-lang/rust/pull/147736">Stabilize <code>asm_cfg</code></a></li> <li><a href="https://redirect.github.com/rust-lang/rust/pull/148259">During const-evaluation, support copying pointers byte-by-byte</a></li> <li><a href="https://redirect.github.com/rust-lang/rust/pull/148602">LUB coercions now correctly handle function item types, and functions with differing safeties</a></li> <li><a href="https://redirect.github.com/rust-lang/rust/pull/148746">Allow <code>const</code> items that contain mutable references to <code>static</code> (which is <em>very</em> unsafe, but not <em>always</em> UB)</a></li> <li><a href="https://redirect.github.com/rust-lang/rust/pull/148407">Add warn-by-default <code>const_item_interior_mutations</code> lint to warn against calls which mutate interior mutable <code>const</code> items</a></li> <li><a href="https://redirect.github.com/rust-lang/rust/pull/141470">Add warn-by-default <code>function_casts_as_integer</code> lint</a></li> </ul> <p></p> <h2>Compiler</h2> <ul> <li><a href="https://redirect.github.com/rust-lang/rust/pull/145974">Stabilize <code>-Cjump-tables=bool</code></a>. The flag was previously called <code>-Zno-jump-tables</code>.</li> </ul> <p></p> <h2>Platform Support</h2> <ul> <li><a href="https://redirect.github.com/rust-lang/rust/pull/148435">Promote <code>riscv64a23-unknown-linux-gnu</code> to Tier 2 (without host tools)</a></li> </ul> <p>Refer to Rust's <a href="https://doc.rust-lang.org/rustc/platform-support.html">platform support page</a> for more information on Rust's tiered platform support.</p> <p></p> <h2>Libraries</h2> <ul> <li><a href="https://redirect.github.com/rust-lang/rust/pull/135634">Stop internally using <code>specialization</code> on the <code>Copy</code> trait as it is unsound in the presence of lifetime dependent <code>Copy</code> implementations. This may result in some performance regressions as some standard library APIs may now call <code>Clone::clone</code> instead of performing bitwise copies</a></li> <li><a href="https://redirect.github.com/rust-lang/rust/pull/144465">Allow the global allocator to use thread-local storage and <code>std::thread::current()</code></a></li> <li><a href="https://redirect.github.com/rust-lang/rust/pull/145628">Make <code>BTree::append</code> not update existing keys when appending an entry which already exists</a></li> <li><a href="https://redirect.github.com/rust-lang/rust/pull/145665">Don't require <code>T: RefUnwindSafe</code> for <code>vec::IntoIter<T>: UnwindSafe</code></a></li> </ul> <p></p> <h2>Stabilized APIs</h2> <ul> <li><a href="https://doc.rust-lang.org/stable/core/primitive.slice.html#method.assume_init_drop"><code><[MaybeUninit<T>]>::assume_init_drop</code></a></li> <li><a href="https://doc.rust-lang.org/stable/core/primitive.slice.html#method.assume_init_ref"><code><[MaybeUninit<T>]>::assume_init_ref</code></a></li> <li><a href="https://doc.rust-lang.org/stable/core/primitive.slice.html#method.assume_init_mut"><code><[MaybeUninit<T>]>::assume_init_mut</code></a></li> <li><a href="https://doc.rust-lang.org/stable/std/primitive.slice.html#method.write_copy_of_slice"><code><[MaybeUninit<T>]>::write_copy_of_slice</code></a></li> <li><a href="https://doc.rust-lang.org/stable/std/primitive.slice.html#method.write_clone_of_slice"><code><[MaybeUninit<T>]>::write_clone_of_slice</code></a></li> <li><a href="https://doc.rust-lang.org/stable/std/string/struct.String.html#method.into_raw_parts"><code>String::into_raw_parts</code></a></li> <li><a href="https://doc.rust-lang.org/stable/std/vec/struct.Vec.html#method.into_raw_parts"><code>Vec::into_raw_parts</code></a></li> <li><a href="https://doc.rust-lang.org/stable/std/primitive.isize.html#method.unchecked_neg"><code><iN>::unchecked_neg</code></a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/rust-lang/rust/blob/main/RELEASES.md">rust-toolchain's changelog</a>.</em></p> <blockquote> <h1>Version 1.93.0 (2026-01-22)</h1> <p></p> <h2>Language</h2> <ul> <li><a href="https://redirect.github.com/rust-lang/rust/pull/145656">Stabilize several s390x <code>vector</code>-related target features and the <code>is_s390x_feature_detected!</code> macro</a></li> <li><a href="https://redirect.github.com/rust-lang/rust/pull/145954">Stabilize declaration of C-style variadic functions for the <code>system</code> ABI</a></li> <li><a href="https://redirect.github.com/rust-lang/rust/pull/146978">Emit error when using some keyword as a <code>cfg</code> predicate</a></li> <li><a href="https://redirect.github.com/rust-lang/rust/pull/147736">Stabilize <code>asm_cfg</code></a></li> <li><a href="https://redirect.github.com/rust-lang/rust/pull/148259">During const-evaluation, support copying pointers byte-by-byte</a></li> <li><a href="https://redirect.github.com/rust-lang/rust/pull/148602">LUB coercions now correctly handle function item types, and functions with differing safeties</a></li> <li><a href="https://redirect.github.com/rust-lang/rust/pull/148746">Allow <code>const</code> items that contain mutable references to <code>static</code> (which is <em>very</em> unsafe, but not <em>always</em> UB)</a></li> <li><a href="https://redirect.github.com/rust-lang/rust/pull/148407">Add warn-by-default <code>const_item_interior_mutations</code> lint to warn against calls which mutate interior mutable <code>const</code> items</a></li> <li><a href="https://redirect.github.com/rust-lang/rust/pull/141470">Add warn-by-default <code>function_casts_as_integer</code> lint</a></li> </ul> <p></p> <h2>Compiler</h2> <ul> <li><a href="https://redirect.github.com/rust-lang/rust/pull/145974">Stabilize <code>-Cjump-tables=bool</code></a>. The flag was previously called <code>-Zno-jump-tables</code>.</li> </ul> <p></p> <h2>Platform Support</h2> <ul> <li><a href="https://redirect.github.com/rust-lang/rust/pull/148435">Promote <code>riscv64a23-unknown-linux-gnu</code> to Tier 2 (without host tools)</a></li> </ul> <p>Refer to Rust's <a href="https://doc.rust-lang.org/rustc/platform-support.html">platform support page</a> for more information on Rust's tiered platform support.</p> <p></p> <h2>Libraries</h2> <ul> <li><a href="https://redirect.github.com/rust-lang/rust/pull/135634">Stop internally using <code>specialization</code> on the <code>Copy</code> trait as it is unsound in the presence of lifetime dependent <code>Copy</code> implementations. This may result in some performance regressions as some standard library APIs may now call <code>Clone::clone</code> instead of performing bitwise copies</a></li> <li><a href="https://redirect.github.com/rust-lang/rust/pull/144465">Allow the global allocator to use thread-local storage and <code>std::thread::current()</code></a></li> <li><a href="https://redirect.github.com/rust-lang/rust/pull/145628">Make <code>BTree::append</code> not update existing keys when appending an entry which already exists</a></li> <li><a href="https://redirect.github.com/rust-lang/rust/pull/145665">Don't require <code>T: RefUnwindSafe</code> for <code>vec::IntoIter<T>: UnwindSafe</code></a></li> </ul> <p></p> <h2>Stabilized APIs</h2>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/rust-lang/rust/commit/254b59607d4417e9dffbc307138ae5c86280fe4c"><code>254b596</code></a> Auto merge of <a href="https://redirect.github.com/rust-lang/rust/issues/151369">#151369</a> - Mark-Simulacrum:stable-next, r=Mark-Simulacrum</li> <li><a href="https://github.com/rust-lang/rust/commit/01ad1d67a6952f78338d8c99f73ffe993fecbd1c"><code>01ad1d6</code></a> Bump to stable release</li> <li><a href="https://github.com/rust-lang/rust/commit/641c2090495c6da22d0d3a178f60444d1164b3c1"><code>641c209</code></a> Add latest release note copy</li> <li><a href="https://github.com/rust-lang/rust/commit/a741008f5b09716754d1ff1275968a55ff6492b2"><code>a741008</code></a> Auto merge of <a href="https://redirect.github.com/rust-lang/rust/issues/151270">#151270</a> - Mark-Simulacrum:beta-backport, r=Mark-Simulacrum</li> <li><a href="https://github.com/rust-lang/rust/commit/6feceec6b3e782aab1ca914b800bf6cccdc560cb"><code>6feceec</code></a> Disable SimplifyComparisonIntegral</li> <li><a href="https://github.com/rust-lang/rust/commit/2b8a999ac43b386edc6472d6e34a1f50683c18f1"><code>2b8a999</code></a> Use both bors e-mails for CI postprocessing git lookup</li> <li><a href="https://github.com/rust-lang/rust/commit/4c28b43a948cdcd98f21283fe49d8c30883cd1bd"><code>4c28b43</code></a> Revert bors email to the original homu one</li> <li><a href="https://github.com/rust-lang/rust/commit/a8201d341a8b5b456eff782f32197af6b6533038"><code>a8201d3</code></a> Remove references to bors2</li> <li><a href="https://github.com/rust-lang/rust/commit/9a4aba12f3360680f24451ef112d9e8d08ee978d"><code>9a4aba1</code></a> Auto merge of <a href="https://redirect.github.com/rust-lang/rust/issues/151241">#151241</a> - fmease:beta-rustdoc-dont-eval-assoc-consts, r=fmease</li> <li><a href="https://github.com/rust-lang/rust/commit/36e6625457599bccf2a5067110b47de82802a9d0"><code>36e6625</code></a> [beta] rustdoc: Stop unconditionally evaluating the initializer of associated...</li> <li>Additional commits viewable in <a href="https://github.com/rust-lang/rust/compare/1.91.0...1.93.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=rust-toolchain&package-manager=rust_toolchain&previous-version=1.91.0&new-version=1.93.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io> Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

Copilot

Pull request overview

Tightens project safety and CI clarity by forbidding unsafe in the library crate, updating contribution guidance on merge-blocking checks, and fixing the coverage report path used by CI actions.

Changes:

Added #![forbid(unsafe_code)] to the library crate root.
Updated CONTRIBUTING.md to reflect current merge-queue required checks vs non-blocking security jobs.
Fixed CI coverage upload configuration to use lcov.info (matching the generated output path).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
src/lib.rs	Adds a crate-level prohibition on `unsafe` for the library target.
CONTRIBUTING.md	Clarifies which CI checks are required for merging and which are informational.
.github/workflows/ci.yml	Corrects the LCOV file path consumed by coverage upload steps.

Copilot · 2026-02-16T13:36:16Z

src/lib.rs

@@ -1,3 +1,5 @@
+#![forbid(unsafe_code)]


#![forbid(unsafe_code)] here only applies to the library target. This package also has a binary target (src/main.rs), which can still compile unsafe unless it also has #![forbid(unsafe_code)] (or the restriction is enforced via RUSTFLAGS=-F unsafe_code in CI). Consider applying the same prohibition to src/main.rs (and any examples/benches if the intent is repo-wide).

coderabbitai

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@src/lib.rs`:
- Around line 1-2: Add the crate-level attribute to deny all compiler warnings
by adding #![deny(warnings)] alongside the existing #![forbid(unsafe_code)] at
the top of src/lib.rs; update the file's crate attributes so both
#![forbid(unsafe_code)] and #![deny(warnings)] appear together and then verify
with cargo clippy -- -D warnings or a build to ensure no warnings remain.

src/lib.rs

codecov · 2026-02-16T13:41:17Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

…rkflows Standardize CI toolchain management on mise-action, making mise.toml the single source of truth for tool versions. This replaces dtolnay/rust-toolchain, jontze/action-mdbook, cargo-bins/cargo-binstall, extractions/setup-just, actions/setup-python, taiki-e/install-action, and EmbarkStudios/cargo-deny-action with a single mise-action step per job. The MSRV job retains dtolnay@1.91.0 for pinned older toolchain testing. Also syncs Rust version to 1.93.0 in mise.toml to match rust-toolchain.toml and adds mdbook-yml-header, mdbook-image-size, and cargo-outdated to mise.toml. Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

mergify · 2026-02-16T14:41:28Z

🧪 CI Insights

Here's what we observed from your CI run for 8e32bc3.

🟢 All jobs passed!

But CI Insights is watching 👀

Copilot

Pull request overview

Copilot reviewed 9 out of 11 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

.github/workflows/ci.yml:106

The coverage job switched to mise-action, but it no longer installs the llvm-tools-preview/llvm-tools component (previously installed via the toolchain setup step). cargo llvm-cov typically requires that component to provide llvm-profdata/llvm-cov, and rust-toolchain.toml currently only lists rustfmt and clippy. Consider adding llvm-tools-preview to rust-toolchain.toml components or explicitly installing it in this job before running cargo llvm-cov.

      - name: Generate coverage
        run: cargo llvm-cov --all-features --no-report

      - name: Combine coverage reports
        run: cargo llvm-cov report --lcov --output-path lcov.info

mise.toml

src/lib.rs

- test-cross-platform: use selective tool install (rust + cargo-nextest only) instead of installing all mise tools, avoiding the unsupported claude tool on Windows and unnecessary mdbook/zig installs - docs: install mdbook-yml-header via cargo-binstall since it fails to compile from source via mise - mise.toml: remove mdbook-yml-header and mdbook-image-size (yml-header cannot build from source in CI, image-size is unused in book.toml) Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

When rust is managed via idiomatic version file (rust-toolchain.toml) instead of mise.toml directly, the absence of an explicit profile caused mise to install Rust without the cargo component. This broke any cargo: tool that needed to compile from source (e.g. mdbook-yml-header). Adding profile = "default" ensures cargo, rustc, rust-std, rust-docs, rustfmt, and clippy are all installed. Restores mdbook-yml-header to mise.toml now that the root cause is fixed. Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

Copilot

Pull request overview

Copilot reviewed 10 out of 12 changed files in this pull request and generated 2 comments.

rust-toolchain.toml

src/lib.rs

coderabbitai

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In @.github/workflows/docs.yml:
- Around line 30-34: The workflow currently uses the floating tag
jdx/mise-action@v3 which conflicts with the repo-wide policy decision; either
(A) pin this action to a specific commit SHA (replace jdx/mise-action@v3 with
jdx/mise-action@<commit-sha>) and apply the same SHA-pin change across all
workflows to be consistent, or (B) explicitly document the repository policy for
using floating tags (e.g., add a top-of-workflow comment and a short note in the
repository docs/README that states "floating tags are used intentionally") so
this usage is clearly justified; update the workflow header or repo docs
accordingly and ensure similar actions like actions/checkout and
actions/configure-pages follow the same documented policy.

.github/workflows/docs.yml

mdbook-yml-header cannot compile from source via cargo install --locked, which causes every CI job using mise install to fail. Install it via cargo-binstall in the docs workflow where it is actually needed. Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

…tall - Replace actions-rust-lang/rustfmt@v1 with direct cargo fmt --check to avoid stderr suppression that hides errors with mise toolchain - Add MISE_AUTO_INSTALL=false to test-cross-platform to prevent mise shims from auto-installing all tools (fixes Windows claude failure) Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

Bump cache_key_prefix to mise-v1 across all jobs to invalidate stale caches from before the rust-toolchain.toml profile change. Add a toolchain verification step to quality job for debugging. Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

- quality: use dtolnay/rust-toolchain for Rust (rustfmt, clippy) with mise-action for other tools, matching the proven libmagic-rs pattern - Remove claude from mise.toml as it does not support Windows and is not a build dependency (developers install it separately) - Simplify test-cross-platform back to plain mise install: true now that the Windows-incompatible tool is removed - Remove debug toolchain verification step and cache key overrides Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

Copilot

Pull request overview

Copilot reviewed 10 out of 12 changed files in this pull request and generated no new comments.

…RV compliance Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

Codecov is the coverage provider for this project. Remove the unused qltysh/qlty-action/coverage step. Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

Copilot

Pull request overview

Copilot reviewed 10 out of 12 changed files in this pull request and generated 4 comments.

mise.toml

.github/workflows/docs.yml

.github/workflows/ci.yml

- Add #![forbid(unsafe_code)] to src/main.rs so the prohibition applies to both library and binary targets - Add llvm-tools-preview to rust-toolchain.toml components so cargo llvm-cov has the instrumentation tools it needs for coverage - Pin mdbook-yml-header version in docs.yml binstall command for reproducible builds Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

unclesp1d3r · 2026-02-16T23:30:23Z

@Mergifyio queue

mergify · 2026-02-16T23:30:42Z

The msrv job now uses a strategy matrix (stable, stable minus 1..4), so the check names are msrv (stable), msrv (stable minus 1 releases), etc. Use regex matching (check-success~=^msrv) instead of exact match. Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

Copilot

Pull request overview

Copilot reviewed 12 out of 14 changed files in this pull request and generated no new comments.

The check-success~= regex operator does not work as expected for merge protections. List all 5 msrv matrix job names explicitly instead. Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

Copilot

Pull request overview

Copilot reviewed 12 out of 14 changed files in this pull request and generated 3 comments.

Copilot · 2026-02-17T01:16:21Z

.github/workflows/docs.yml

+      - name: Install mdbook-yml-header
+        run: cargo binstall mdbook-yml-header@0.1.5 --no-confirm



This manual installation of mdbook-yml-header appears redundant since mise.lock already includes mdbook-yml-header@0.1.5 and the mise-action above is configured with install: true, which should install all tools from mise. Unless there's a specific reason to reinstall it (like a mise installation issue), this step can likely be removed to simplify the workflow.

Suggested change

- name: Install mdbook-yml-header

run: cargo binstall mdbook-yml-header@0.1.5 --no-confirm

Copilot · 2026-02-17T01:16:21Z

.github/workflows/ci.yml

@@ -129,7 +127,3 @@ jobs:
          fail_ci_if_error: false
          token: ${{ secrets.CODECOV_TOKEN }}
          slug: EvilBit-Labs/Stringy


The removal of the qlty-action coverage upload is not mentioned in the PR description. While the PR description mentions fixing the coverage report file path for Codecov, it doesn't explain why the Qlty coverage upload was removed. Consider updating the PR description to document this change, or if the removal was unintentional, restore the qlty-action upload step.

Copilot · 2026-02-17T01:16:21Z

.github/workflows/ci.yml

+      - uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9
        with:
          components: rustfmt, clippy
-
-      - name: Install just
-        uses: extractions/setup-just@v3
-
-      - name: Cache Rust dependencies
-        uses: Swatinem/rust-cache@v2
+          toolchain: 1.93.0


This job uses both dtolnay/rust-toolchain to explicitly install Rust 1.93.0 and mise-action which will also install Rust 1.93.0 from rust-toolchain.toml (via the idiomatic_version_file_enable_tools setting in mise.toml). While this duplication is harmless, consider removing the dtolnay/rust-toolchain step since mise-action should handle Rust installation. The msrv job correctly keeps dtolnay/rust-toolchain since it needs to install different versions via the matrix.

unclesp1d3r self-assigned this Feb 16, 2026

Copilot AI review requested due to automatic review settings February 16, 2026 13:33

Copilot started reviewing on behalf of unclesp1d3r February 16, 2026 13:33 View session

coderabbitai bot added bug Something isn't working documentation Improvements or additions to documentation enhancement New feature or request labels Feb 16, 2026

unclesp1d3r and others added 2 commits February 16, 2026 08:35

unclesp1d3r force-pushed the fix/pr-132-review-feedback branch from 2ccdb67 to b359e75 Compare February 16, 2026 13:36

Copilot AI reviewed Feb 16, 2026

View reviewed changes

Merge branch 'main' into fix/pr-132-review-feedback

b3ff1e2

coderabbitai bot reviewed Feb 16, 2026

View reviewed changes

src/lib.rs Show resolved Hide resolved

unclesp1d3r changed the title ~~fix: address PR #132 review feedback~~ fix(security): enforce unsafe code prohibition and update CI requirements Feb 16, 2026

Copilot AI review requested due to automatic review settings February 16, 2026 14:39

Copilot started reviewing on behalf of unclesp1d3r February 16, 2026 14:39 View session

Copilot AI reviewed Feb 16, 2026

View reviewed changes

mise.toml Show resolved Hide resolved

src/lib.rs Show resolved Hide resolved

unclesp1d3r added 2 commits February 16, 2026 10:31

Copilot AI review requested due to automatic review settings February 16, 2026 15:34

Copilot started reviewing on behalf of unclesp1d3r February 16, 2026 15:35 View session

Copilot AI reviewed Feb 16, 2026

View reviewed changes

rust-toolchain.toml Show resolved Hide resolved

src/lib.rs Show resolved Hide resolved

coderabbitai bot reviewed Feb 16, 2026

View reviewed changes

.github/workflows/docs.yml Show resolved Hide resolved

unclesp1d3r added 2 commits February 16, 2026 10:43

Copilot AI review requested due to automatic review settings February 16, 2026 15:57

Copilot started reviewing on behalf of unclesp1d3r February 16, 2026 15:57 View session

unclesp1d3r added 2 commits February 16, 2026 11:00

Copilot AI reviewed Feb 16, 2026

View reviewed changes

unclesp1d3r added 2 commits February 16, 2026 18:03

fix(ci): update rust-toolchain action and add toolchain matrix for MS…

5d5ff2c

…RV compliance Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

ci: remove qlty coverage upload from CI

13deaeb

Codecov is the coverage provider for this project. Remove the unused qltysh/qlty-action/coverage step. Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

Copilot AI review requested due to automatic review settings February 16, 2026 23:12

Copilot started reviewing on behalf of unclesp1d3r February 16, 2026 23:13 View session

unclesp1d3r added the lgtm This PR has been approved by a maintainer label Feb 16, 2026

fix: add node, zig, and python versions to mise.toml

4dcffe3

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

Copilot AI reviewed Feb 16, 2026

View reviewed changes

mise.toml Show resolved Hide resolved

.github/workflows/docs.yml Outdated Show resolved Hide resolved

.github/workflows/ci.yml Show resolved Hide resolved

.github/workflows/ci.yml Show resolved Hide resolved

Copilot AI review requested due to automatic review settings February 16, 2026 23:32

Copilot started reviewing on behalf of unclesp1d3r February 16, 2026 23:32 View session

Copilot AI reviewed Feb 16, 2026

View reviewed changes

fix(ci): list msrv matrix variants explicitly in mergify config

35e9ab1

The check-success~= regex operator does not work as expected for merge protections. List all 5 msrv matrix job names explicitly instead. Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

unclesp1d3r requested a review from Copilot February 17, 2026 01:11

Copilot started reviewing on behalf of unclesp1d3r February 17, 2026 01:11 View session

unclesp1d3r merged commit bd84315 into main Feb 17, 2026
31 of 32 checks passed

unclesp1d3r deleted the fix/pr-132-review-feedback branch February 17, 2026 01:14

Copilot AI reviewed Feb 17, 2026

View reviewed changes

		- name: Install mdbook-yml-header
		run: cargo binstall mdbook-yml-header@0.1.5 --no-confirm

Uh oh!

Conversation

unclesp1d3r commented Feb 16, 2026

Uh oh!

coderabbitai bot commented Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Poem

❌ Failed checks (2 warnings)

Uh oh!

mergify bot commented Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge Protections

🟠 CI must pass

🟢 📃 Configuration Change Requirements

🟢 Enforce conventional commit

🟢 Do not merge outdated PRs

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

codecov bot commented Feb 16, 2026

Codecov Report

Uh oh!

mergify bot commented Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🧪 CI Insights

🟢 All jobs passed!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

unclesp1d3r commented Feb 16, 2026

Uh oh!

mergify bot commented Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge Queue Status

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

coderabbitai bot commented Feb 16, 2026 •

edited

Loading

mergify bot commented Feb 16, 2026 •

edited

Loading

mergify bot commented Feb 16, 2026 •

edited

Loading

mergify bot commented Feb 16, 2026 •

edited

Loading