ci: adopt the fleet reusable workflow

.github/workflows/ci.yml

@@ -6,126 +6,28 @@ on:
   pull_request:
     branches: [main]
 
-env:
-  CARGO_TERM_COLOR: always
-  CARGO_INCREMENTAL: "0"
-  RUSTFLAGS: -Dwarnings
+permissions:
+  contents: read
 
 jobs:
-  fmt:
-    name: Format
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
-        with:
-          components: rustfmt
-      - run: cargo fmt --all --check
-
-  clippy:
-    name: Clippy
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
-        with:
-          components: clippy
-      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
-      - run: cargo clippy --all-targets -- -D warnings
-
-  test:
-    name: Test (${{ matrix.os }})
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
-      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
-      - run: cargo test --workspace
-
-  coverage:
-    name: Coverage (100% production lines)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
-        with:
-          components: llvm-tools-preview
-      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
-      - run: cargo install cargo-llvm-cov --locked
-      - name: Fail on any uncovered production line (DA:n,0), honoring cov:unreachable
-        run: |
-          cargo llvm-cov --workspace --lcov --output-path cov.lcov
-          python3 - <<'PY'
-          import sys
-          def marked(path, n):
-              try:
-                  return "cov:unreachable" in open(path).read().splitlines()[n - 1]
-              except Exception:
-                  return False
-          cur, bad = None, []
-          for line in open("cov.lcov").read().splitlines():
-              if line.startswith("SF:"):
-                  cur = line[3:]
-              elif line.startswith("DA:") and cur:
-                  if "/tests/" in cur or "/fuzz/" in cur:
-                      continue
-                  n, hits = line[3:].split(",")
-                  if hits == "0" and not marked(cur, int(n)):
-                      bad.append(f"{cur}:{n}")
-          if bad:
-              print("Uncovered production lines — add a test or // cov:unreachable:")
-              print("\n".join(f"  {b}" for b in bad))
-              sys.exit(1)
-          print("100% production line coverage — no uncovered DA:n,0")
-          PY
-
-  deny:
-    name: Cargo Deny
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
-
-  msrv:
-    name: MSRV (1.75)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: dtolnay/rust-toolchain@1.75
-      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
-      - run: cargo test
-
-  fuzz-check:
-    name: Fuzz (build check)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # nightly
-        with:
-          toolchain: nightly
-          components: rust-src
-      - run: cargo install cargo-fuzz --locked
-      - run: cargo +nightly fuzz build
-
-  secrets:
-    name: Secret Scan (gitleaks)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          fetch-depth: 0
-      - name: Install gitleaks
-        run: |
-          VERSION=$(curl -s https://api.github.com/repos/gitleaks/gitleaks/releases/latest | jq -r '.tag_name[1:]')
-          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_linux_x64.tar.gz" \
-            | tar xz -C /tmp gitleaks
-      - name: Run gitleaks
-        run: /tmp/gitleaks detect --source .
-
+  ci:
+    uses: SecurityRonin/fleet-ci/.github/workflows/rust-ci.yml@619094ad54edc586f5c2733358e00326b30790bd
+    with:
+      # The old MSRV job ran `cargo test` at 1.75, not a bare build. The
+      # default (`build`) would verify less than CI already did.
+      msrv-check: test
+      # The old coverage gate is the fleet per-line gate (strict, which is the
+      # default here) but it skipped test and fuzz scaffolding — written inside
+      # the inline Python as `if "/tests/" in cur or "/fuzz/" in cur: continue`,
+      # not as an --ignore-filename-regex flag. Same exclusion, expressed the
+      # way this workflow takes it. Verified load-bearing on origin/main:
+      #   tests/coverage.rs, fuzz/fuzz_targets/{fuzz_feed,fuzz_known_good}.rs
+      # all match, and re-running the shared gate's own rules over
+      # `cargo llvm-cov --workspace --all-features` with this regex gives
+      # 0 uncovered / 2 annotated exemptions — i.e. green, unchanged.
+      coverage-ignore-regex: "/tests/|/fuzz/"
+
+  # -- carried across verbatim from the previous ci.yml ---------------------
   geiger:
     name: Unsafe Audit (cargo-geiger)
     runs-on: ubuntu-latest
@@ -136,22 +38,3 @@ jobs:
       - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
       - run: cargo install cargo-geiger --locked
       - run: cargo geiger 2>&1 || true
-
-  vet:
-    name: Cargo Vet (supply-chain)
-    runs-on: ubuntu-latest
-    # Complements `deny` (known-bad advisories/licenses) with the supply-chain-
-    # injection layer: every dependency version must be human-source-reviewed or
-    # covered by an imported aggregate audit set (Google/Mozilla/Bytecode-Alliance/
-    # Embark). Config in supply-chain/{config,audits,imports}.toml.
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: dtolnay/rust-toolchain@stable
-      - name: Install cargo-vet
-        uses: taiki-e/install-action@59012be0884e296ca2da49b530610e72c49039ad # v2.81.6
-        with:
-          tool: cargo-vet
-      - name: Fetch dependencies
-        run: cargo fetch
-      - name: Check supply chain
-        run: cargo vet --locked

supply-chain/audits.toml

@@ -2,3 +2,57 @@
 # cargo-vet audits file
 
 [audits]
+
+[[trusted.ewf]]
+criteria = "safe-to-deploy"
+user-id = 347968
+start = "2026-03-05"
+end = "2027-08-08"
+
+[[trusted.forensic-vfs]]
+criteria = "safe-to-deploy"
+user-id = 347968
+start = "2026-07-07"
+end = "2027-08-08"
+
+[[trusted.forensicnomicon]]
+criteria = "safe-to-deploy"
+user-id = 347968
+start = "2026-06-05"
+end = "2027-08-08"
+
+[[trusted.forensicnomicon-core]]
+criteria = "safe-to-deploy"
+user-id = 347968
+start = "2026-06-28"
+end = "2027-08-08"
+
+[[trusted.forensicnomicon-data]]
+criteria = "safe-to-deploy"
+user-id = 347968
+start = "2026-06-28"
+end = "2027-08-08"
+
+[[trusted.jsonguard]]
+criteria = "safe-to-deploy"
+user-id = 347968
+start = "2026-05-21"
+end = "2027-08-08"
+
+[[trusted.safe-decode]]
+criteria = "safe-to-deploy"
+user-id = 347968
+start = "2026-08-02"
+end = "2027-08-08"
+
+[[trusted.safe-read]]
+criteria = "safe-to-deploy"
+user-id = 347968
+start = "2026-07-15"
+end = "2027-08-08"
+
+[[trusted.state-history-forensic]]
+criteria = "safe-to-deploy"
+user-id = 347968
+start = "2026-06-16"
+end = "2027-08-08"

supply-chain/config.toml

@@ -36,7 +36,7 @@ version = "2.4.1"
 criteria = "safe-to-run"
 
 [[exemptions.getrandom]]
-version = "0.4.3"
+version = "0.3.4"
 criteria = "safe-to-run"
 
 [[exemptions.libc]]
@@ -56,7 +56,7 @@ version = "1.21.4"
 criteria = "safe-to-run"
 
 [[exemptions.r-efi]]
-version = "6.0.0"
+version = "5.3.0"
 criteria = "safe-to-run"
 
 [[exemptions.rustix]]

supply-chain/imports.lock

@@ -1,6 +1,36 @@
 
 # cargo-vet imports lock
 
+[[publisher.wasip2]]
+version = "1.0.4+wasi-0.2.12"
+when = "2026-06-12"
+user-id = 1
+user-login = "alexcrichton"
+user-name = "Alex Crichton"
+
+[[publisher.wit-bindgen]]
+version = "0.57.1"
+when = "2026-04-17"
+trusted-publisher = "github:bytecodealliance/wit-bindgen"
+
+[[audits.bytecode-alliance.wildcard-audits.wasip2]]
+who = "Alex Crichton <alex@alexcrichton.com>"
+criteria = "safe-to-deploy"
+user-id = 1 # Alex Crichton (alexcrichton)
+start = "2025-08-10"
+end = "2026-08-21"
+notes = """
+This is a Bytecode Alliance authored crate.
+"""
+
+[[audits.bytecode-alliance.wildcard-audits.wit-bindgen]]
+who = "Alex Crichton <alex@alexcrichton.com>"
+criteria = "safe-to-deploy"
+trusted-publisher = "github:bytecodealliance/wit-bindgen"
+start = "2025-08-13"
+end = "2027-01-08"
+notes = "The Bytecode Alliance is the author of this crate"
+
 [audits.bytecode-alliance.audits]
 
 [audits.embark.audits]