Migrate repository automation to xtask

.cargo/config.toml

@@ -0,0 +1,2 @@
+[alias]
+xtask = "run --package xtask --"

.github/pull_request_template.md

@@ -11,6 +11,6 @@
 - [ ] I ran the relevant local tests, including `just ci` and `just coverage` when applicable.
 - [ ] I added or updated deterministic tests for behavior changes.
 - [ ] I documented new or changed ownership, safety, or cleanup contracts.
-- [ ] I reviewed public API compatibility and intentionally updated the snapshot if needed.
+- [ ] I reviewed public API compatibility and updated the snapshot if needed.
 - [ ] I did not include secrets or public vulnerability details.
 - [ ] I kept this pull request focused and updated relevant documentation.

.github/workflows/ci.yml

@@ -33,7 +33,7 @@ jobs:
       - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4  # v2.9.1
       - uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf  # v2.85.2
         with:
-          tool: just@1.57.0,cargo-public-api@0.52.0,cargo-deny@0.19.4
+          tool: just@1.57.0,cargo-public-api@0.52.0,cargo-deny@0.19.4,typos-cli@1.48.0
       - run: python -m pip install "reuse[charset-normalizer]==6.2.0"
       - run: just fmt
       - run: just clippy
@@ -43,6 +43,7 @@ jobs:
       - run: just cross-targets
       - run: just supply-chain
       - run: just reuse
+      - run: just typos
 
   test:
     name: Windows ${{ matrix.os }} / Rust ${{ matrix.rust }}
@@ -72,7 +73,7 @@ jobs:
       - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9  # v1
         with:
           toolchain: stable
-      - run: cargo check --locked
+      - run: cargo xtask linux-empty
 
   coverage:
     name: Coverage

.github/workflows/release.yml

@@ -37,7 +37,7 @@ jobs:
       - name: Verify existing tag, commit, and Cargo version
         env:
           RELEASE_TAG: ${{ inputs.tag }}
-        run: .\scripts\verify-release-tag.ps1 -Tag $env:RELEASE_TAG
+        run: cargo xtask verify-release-tag "$env:RELEASE_TAG"
 
   release:
     name: Approved release
@@ -64,16 +64,11 @@ jobs:
           toolchain: stable
       - uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf  # v2.85.2
         with:
-          tool: just@1.57.0,cargo-cyclonedx@0.5.9
+          tool: cargo-cyclonedx@0.5.9
       - run: python -m pip install "reuse[charset-normalizer]==6.2.0"
       - name: Build and verify release candidate
         id: candidate
-        run: |
-          just release-candidate
-          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
-          $sbom = @(Get-ChildItem -LiteralPath target\release-candidate -Filter *.cdx.json)
-          if ($sbom.Count -ne 1) { throw "Expected exactly one CycloneDX SBOM" }
-          "sbom=$($sbom[0].FullName)" >> $env:GITHUB_OUTPUT
+        run: cargo xtask release-candidate --github-output
 
       - name: Attest SLSA v1 provenance
         uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d  # v4
@@ -94,23 +89,14 @@ jobs:
         id: github-release
         env:
           GH_TOKEN: ${{ github.token }}
-        run: |
-          $artifacts = @(
-              Get-ChildItem -LiteralPath target\release-candidate -File |
-                  ForEach-Object { $_.FullName }
-          )
-          $url = & gh release create $env:RELEASE_TAG @artifacts --verify-tag --draft --generate-notes --title $env:RELEASE_TAG
-          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
-          "url=$url" >> $env:GITHUB_OUTPUT
+        run: cargo xtask draft-release "$env:RELEASE_TAG" --github-output
 
       - name: Select crates.io authentication mode
         id: crates-mode
         if: ${{ inputs.publish_crates_io }}
         env:
-          BOOTSTRAP_TOKEN: ${{ secrets.CRATES_IO_BOOTSTRAP_TOKEN }}
-        run: |
-          $bootstrap = -not [string]::IsNullOrEmpty($env:BOOTSTRAP_TOKEN)
-          "bootstrap=$($bootstrap.ToString().ToLowerInvariant())" >> $env:GITHUB_OUTPUT
+          CRATES_IO_BOOTSTRAP_TOKEN: ${{ secrets.CRATES_IO_BOOTSTRAP_TOKEN }}
+        run: cargo xtask crates-io-auth-mode --github-output
 
       - name: Authenticate with crates.io trusted publishing
         id: crates-auth

CHANGELOG.md

@@ -1,7 +1,6 @@
 # Changelog
 
-All notable changes to this project are documented here. The format follows
-[Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and Semantic
+Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and Semantic
 Versioning with Cargo's pre-1.0 compatibility rules.
 
 ## [Unreleased]

CONTRIBUTING.md

@@ -1,7 +1,6 @@
 # Contributing
 
-Thank you for helping improve `windows-spawn`. Contributions that make Windows
-process creation safer, more predictable, or better documented are welcome.
+Contributions must preserve the crate's ownership and cleanup contracts.
 
 ## Before opening a change
 
@@ -42,12 +41,11 @@ does not publish anything.
 - Preserve the documented ownership and cleanup behavior, including on errors.
 - Give every `unsafe` block a specific safety justification.
 - Add deterministic tests for behavior changes and avoid timing-only assertions.
-- Keep the public API snapshot unchanged unless the pull request intentionally
-  changes the public API and explains the compatibility impact.
+- Keep the public API snapshot unchanged unless the pull request changes the
+  public API and explains the compatibility impact.
 - Update the crate documentation, ADRs, or security boundary when contracts
   change.
 - Keep dependencies minimal and compatible with the MSRV.
 
-All required GitHub checks must pass and review conversations must be resolved
-before merge. The repository uses squash merges so each pull request becomes
-one focused commit on `main`.
+Required checks and review conversations must be complete before merge. Pull
+requests are squash-merged into `main`.

Cargo.toml

@@ -5,7 +5,7 @@ authors = ["Yasunobu Sakashita"]
 edition = "2021"
 rust-version = "1.75"
 license = "MIT OR Apache-2.0"
-description = "Advanced Windows process creation: CreateProcessW with STARTUPINFOEX and PROC_THREAD_ATTRIBUTE_LIST, with attribute-value lifetimes enforced by the type system"
+description = "Windows process creation with explicit handle, Job, mitigation, ConPTY, and child ownership"
 documentation = "https://docs.rs/windows-spawn"
 repository = "https://github.com/P4suta/windows-spawn"
 readme = "README.md"
@@ -50,13 +50,21 @@ features = [
   "Win32_System_Threading",
 ]
 
-[lints.rust]
+[workspace]
+members = ["xtask"]
+default-members = ["."]
+resolver = "2"
+
+[workspace.lints.rust]
 missing_docs = "deny"
 rust_2018_idioms = { level = "deny", priority = -1 }
 unsafe_op_in_unsafe_fn = "deny"
 unreachable_pub = "deny"
 unused_qualifications = "deny"
 
-[lints.clippy]
+[workspace.lints.clippy]
 all = { level = "deny", priority = -1 }
 pedantic = { level = "deny", priority = -1 }
+
+[lints]
+workspace = true