Prepare RustPost v1.1.0 from dev

.dockerignore

@@ -6,3 +6,18 @@ queue-demo
 *.tar.gz
 *.zip
 *.sha256
+
+# Runtime data and local build artifacts
+target-*
+/app-data
+/db
+/uploads
+/backups
+/logs
+/tmp
+/tor
+.env
+.env.*
+*.sqlite*
+*.db*
+*.tar

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,23 @@
+name: Report an issue
+description: Tell us what went wrong.
+body:
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      placeholder: "1.1.0"
+    validations:
+      required: true
+  - type: input
+    id: platform
+    attributes:
+      label: Platform
+      placeholder: "macOS Intel, Linux ARM64, Windows"
+    validations:
+      required: true
+  - type: textarea
+    id: issue
+    attributes:
+      label: What is the issue?
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security information
+    url: https://github.com/csd113/RustPost/security/advisories
+    about: Do not post secrets or sensitive security details in public issues.

.github/workflows/audit.yml

@@ -0,0 +1,57 @@
+name: Dependency Audit
+on:
+  pull_request:
+    branches: [main, dev]
+    paths: [Cargo.toml, Cargo.lock, .github/workflows/audit.yml]
+  push:
+    branches: [main, dev]
+    paths: [Cargo.toml, Cargo.lock, .github/workflows/audit.yml]
+  schedule:
+    - cron: "23 6 * * 1"
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: audit-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+jobs:
+  audit:
+    name: Dependency advisory report
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
+        with:
+          toolchain: 1.99.1
+      - name: Install cargo-audit
+        uses: taiki-e/install-action@c509219cf42fba86913069efd0ade2458c59337b # v2.90.1
+        with:
+          tool: cargo-audit@0.22.2
+          fallback: none
+      - name: Report all dependency advisories
+        id: audit
+        # Report-only policy: keep upstream blockers visible, without an ignore list.
+        continue-on-error: true
+        run: cargo audit --file Cargo.lock --format json > audit.json
+      - name: Verify report and summarize findings
+        env:
+          AUDIT_OUTCOME: ${{ steps.audit.outcome }}
+        run: |
+          jq -e '.lockfile["dependency-count"] > 0' audit.json > /dev/null
+          echo "Dependency audit: $(jq -r '.vulnerabilities.count' audit.json) vulnerability findings; full report attached." >> "$GITHUB_STEP_SUMMARY"
+          if [ "$AUDIT_OUTCOME" != success ]; then
+            echo "::warning::Dependency advisories require review; see the full audit report."
+          fi
+      - name: Preserve full advisory report
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: dependency-advisories
+          path: audit.json
+          if-no-files-found: error
+          retention-days: 7

.github/workflows/ci.yml

@@ -1,97 +1,103 @@
 name: CI
-
 on:
   pull_request:
+    branches: [main, dev]
   push:
-    branches:
-      - main
-
+    branches: [main, dev]
+  merge_group:
+  workflow_dispatch:
 permissions:
   contents: read
-
+concurrency:
+  group: ci-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 env:
   CARGO_TERM_COLOR: always
-
+  CARGO_INCREMENTAL: 0
 jobs:
-  fmt:
-    name: Format
+  quality:
+    name: Quality
     runs-on: ubuntu-24.04
+    timeout-minutes: 25
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
-      - name: Install Rust 1.91
-        uses: dtolnay/rust-toolchain@1.91.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          components: rustfmt
-      - name: Check formatting
-        run: cargo fmt --all --check
-
-  clippy:
-    name: Clippy
-    runs-on: ubuntu-24.04
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Install Linux build tools
-        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends build-essential pkg-config
-      - name: Install Rust 1.91
-        uses: dtolnay/rust-toolchain@1.91.0
+          persist-credentials: false
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
-          components: clippy
-      - name: Cache Cargo
-        uses: Swatinem/rust-cache@v2
-        with:
-          cache-bin: false
-      - name: Run Clippy
-        run: cargo clippy --workspace --all-targets --all-features -- -D warnings
-
-  strict-clippy:
-    name: Strict Clippy
-    runs-on: ubuntu-24.04
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Install Linux build tools
-        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends build-essential pkg-config
-      - name: Install Rust 1.91
-        uses: dtolnay/rust-toolchain@1.91.0
-        with:
-          components: clippy
-      - name: Cache Cargo
-        uses: Swatinem/rust-cache@v2
+          toolchain: 1.99.1
+          components: clippy, rustfmt
+      - name: Cache Rust artifacts
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           cache-bin: false
+      - name: Check formatting
+        run: cargo fmt --all --check
       - name: Run strict Clippy
-        run: cargo clippy --workspace --all-targets --all-features -- -D warnings -D clippy::all -D clippy::pedantic -D clippy::nursery -D clippy::cargo
-
-  test:
-    name: Test (${{ matrix.name }})
+        run: cargo clippy --locked --workspace --all-targets --all-features -- -D warnings -D clippy::all -D clippy::pedantic -D clippy::nursery -D clippy::cargo
+      - name: Build API documentation
+        run: cargo doc --locked --workspace --all-features --no-deps
+        env:
+          RUSTDOCFLAGS: -D warnings
+  build:
+    name: Build (${{ matrix.asset_suffix }})
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 35
     strategy:
       fail-fast: false
       matrix:
         include:
-          - name: linux-x86_64
-            os: ubuntu-24.04
-          - name: linux-aarch64
-            os: ubuntu-24.04-arm
-          - name: macos-aarch64
-            os: macos-14
-          - name: windows-x86_64
-            os: windows-2022
-    runs-on: ${{ matrix.os }}
+          - target: x86_64-apple-darwin
+            runner: macos-15-intel
+            binary_suffix: ""
+            asset_suffix: macos-intel
+          - target: aarch64-apple-darwin
+            runner: macos-15
+            binary_suffix: ""
+            asset_suffix: macos-apple-silicon
+          - target: x86_64-unknown-linux-gnu
+            runner: ubuntu-24.04
+            binary_suffix: ""
+            asset_suffix: linux-x86_64
+          - target: aarch64-unknown-linux-gnu
+            runner: ubuntu-24.04-arm
+            binary_suffix: ""
+            asset_suffix: linux-arm64
+          - target: x86_64-pc-windows-msvc
+            runner: windows-latest
+            binary_suffix: ".exe"
+            asset_suffix: windows-x86_64
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
-      - name: Install Linux build tools
-        if: runner.os == 'Linux'
-        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends build-essential pkg-config
-      - name: Install Rust 1.91
-        uses: dtolnay/rust-toolchain@1.91.0
-      - name: Cache Cargo
-        uses: Swatinem/rust-cache@v2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
+        with:
+          toolchain: 1.99.1
+          targets: ${{ matrix.target }}
+      - name: Cache Rust artifacts
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
+          key: ${{ matrix.target }}
           cache-bin: false
-      - name: Run tests
-        run: cargo test --workspace --all-features
       - name: Build CLI
-        run: cargo build --workspace --all-features --bin rustpost-cli
+        run: cargo build --locked --workspace --all-features --target ${{ matrix.target }} --bin rustpost-cli
+      - name: Run native terminal and CLI regressions
+        run: cargo test --locked --workspace --all-features --target ${{ matrix.target }}
+      - name: Verify native executable and architecture
+        shell: bash
+        env:
+          TARGET: ${{ matrix.target }}
+          SUFFIX: ${{ matrix.binary_suffix }}
+        run: |
+          set -euo pipefail
+          binary="target/${TARGET}/debug/rustpost-cli${SUFFIX}"
+          "$binary" --version
+          if [[ "$TARGET" == *apple-darwin ]]; then
+            if [[ "$TARGET" == x86_64-* ]]; then arch=x86_64; else arch=arm64; fi
+            lipo "$binary" -verify_arch "$arch"
+          fi

.github/workflows/container.yml

@@ -1,15 +1,32 @@
 name: Container
 
 on:
+  push:
+    tags: ['v*']
   workflow_dispatch:
+    inputs:
+      tag:
+        description: Published source tag to build (for example v1.1.0)
+        required: true
+        type: string
+
+env:
+  RUSTPOST_RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
 
 permissions:
   contents: read
-  packages: write
+
+concurrency:
+  group: container-${{ inputs.tag || github.ref_name }}
+  cancel-in-progress: false
 
 jobs:
   build:
     name: Build ${{ matrix.arch }}
+    timeout-minutes: 45
+    permissions:
+      contents: read
+      packages: write
     strategy:
       fail-fast: false
       matrix:
@@ -20,42 +37,52 @@ jobs:
             runner: ubuntu-24.04-arm
     runs-on: ${{ matrix.runner }}
     steps:
-      - uses: actions/checkout@v4
-      - name: Verify v1.0.0 application source
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ env.RUSTPOST_RELEASE_TAG }}
+      - name: Resolve and validate version
+        id: version
         run: |
-          git fetch --depth=1 origin tag v1.0.0
-          git diff --quiet v1.0.0 -- Cargo.toml Cargo.lock src
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/login-action@v3
+          version="${RUSTPOST_RELEASE_TAG#v}"
+          test "$(python3 -c 'import tomllib; print(tomllib.load(open("Cargo.toml", "rb"))["package"]["version"])')" = "$version"
+          echo "value=$version" >> "$GITHUB_OUTPUT"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: docker/build-push-action@v6
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           platforms: linux/${{ matrix.arch }}
           push: true
-          tags: ghcr.io/csd113/rustpost:1.0.0-${{ matrix.arch }}
+          tags: ghcr.io/csd113/rustpost:${{ steps.version.outputs.value }}-${{ matrix.arch }}
+          build-args: RUSTPOST_VERSION=${{ steps.version.outputs.value }}
           provenance: false
 
   publish:
     name: Publish version and latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      packages: write
     needs: build
     runs-on: ubuntu-24.04
     steps:
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/login-action@v3
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Create multi-platform tags
         run: |
-          docker buildx imagetools create \
-            --tag ghcr.io/csd113/rustpost:1.0.0 \
-            --tag ghcr.io/csd113/rustpost:latest \
-            ghcr.io/csd113/rustpost:1.0.0-amd64 \
-            ghcr.io/csd113/rustpost:1.0.0-arm64
+          version="${RUSTPOST_RELEASE_TAG#v}"
+          tags=(--tag "ghcr.io/csd113/rustpost:$version")
+          if [[ "$version" != *-* ]]; then tags+=(--tag ghcr.io/csd113/rustpost:latest); fi
+          docker buildx imagetools create "${tags[@]}" \
+            "ghcr.io/csd113/rustpost:$version-amd64" \
+            "ghcr.io/csd113/rustpost:$version-arm64"
       - name: Inspect published image
-        run: docker buildx imagetools inspect ghcr.io/csd113/rustpost:1.0.0
+        run: docker buildx imagetools inspect "ghcr.io/csd113/rustpost:${RUSTPOST_RELEASE_TAG#v}"