Patch dependency advisories and modernize CI coverage

.githooks/pre-commit

@@ -1,6 +1,8 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-cargo fmt -- --check
-cargo clippy -- -D warnings
-cargo test --verbose
+cargo fmt --all -- --check
+cargo clippy --locked --all-targets --all-features -- -D warnings
+cargo clippy --locked --all-targets --no-default-features -- -D warnings
+cargo test --locked --all-features
+cargo test --locked --no-default-features

.github/dependabot.yml

@@ -0,0 +1,14 @@
+version: 2
+updates:
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns: ['*']

.github/workflows/audit.yml

@@ -0,0 +1,26 @@
+name: Dependency audit
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: '21 9 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # master
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          key: cargo-audit
+      - run: cargo install cargo-audit --version 0.22.2 --locked
+      - run: cargo audit --deny warnings

.github/workflows/ci.yml

@@ -2,32 +2,70 @@ name: Rust CI
 
 on:
   push:
-    branches: [ "main" ]
+    branches: [main]
   pull_request:
-    branches: [ "main" ]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 env:
   CARGO_TERM_COLOR: always
 
 jobs:
-  test:
+  quality:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # master
         with:
+          toolchain: stable
           components: rustfmt, clippy
-      - uses: Swatinem/rust-cache@v2
-
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - run: cargo fmt --all -- --check
+      - run: cargo clippy --locked --all-targets --all-features -- -D warnings
+      - run: cargo clippy --locked --all-targets --no-default-features -- -D warnings
 
-      - name: Check formatting
-        run: cargo fmt --all -- --check
-
-      - name: Lint code
-        run: cargo clippy --all-targets --all-features -- -D warnings
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # master
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - run: cargo test --locked --all-features
 
-      - name: Run all-feature tests
-        run: cargo test --all-features --verbose
+  features:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        feature: ["", lang-c, lang-cpp, lang-java, lang-python, lang-go, lang-swift, lang-php, lang-objc, lang-rust, lang-javascript, lang-typescript]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # master
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          key: feature-${{ matrix.feature }}
+      - run: cargo test --locked --no-default-features --features "${{ matrix.feature }}"
 
-      - name: Run minimal-feature tests
-        run: cargo test --no-default-features --verbose
+  msrv:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # master
+        with:
+          toolchain: '1.88.0'
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - run: cargo check --locked --all-targets --all-features

.github/workflows/release.yml

@@ -6,7 +6,7 @@ on:
       - "v*"
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   build-binaries:
@@ -32,13 +32,14 @@ jobs:
             ext: ""
             archive: tar.gz
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # master
         with:
+          toolchain: stable
           targets: ${{ matrix.target }}
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       - name: cargo build
-        run: cargo build --release --target ${{ matrix.target }}
+        run: cargo build --locked --release --target ${{ matrix.target }}
       - name: package
         shell: bash
         run: |
@@ -53,31 +54,35 @@ jobs:
             tar -czf "${dist}/cipherscope-${{ github.ref_name }}-${{ matrix.target }}.tar.gz" -C "target/${{ matrix.target }}/release" "${bin}"
           fi
       - name: upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: cipherscope-${{ matrix.target }}
           path: dist/*
           if-no-files-found: error
 
   publish:
+    permissions:
+      contents: write
     needs: build-binaries
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # master
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       - name: cargo test
-        run: cargo test
+        run: cargo test --locked --all-features
       - name: cargo publish
-        run: cargo publish --allow-dirty
+        run: cargo publish --locked
         env:
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
       - name: download artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           path: dist
       - name: GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           files: |
             dist/**/*.tar.gz

Cargo.toml

@@ -24,7 +24,7 @@ include = [
 ]
 
 [dependencies]
-anyhow = "1.0"
+anyhow = "1.0.103"
 ahash = { version = "0.8", features = ["serde"] }
 clap = { version = "4.5", features = ["derive"] }
 ignore = "0.4"

README.md

@@ -39,6 +39,8 @@ diagnostics go to stderr. Stdout may contain partial findings on failure. With
 successful scan, preserving any previous inventory on failure. Output must be a
 regular file, and existing source files or the custom patterns file cannot be
 used as the destination. The destination directory must be writable.
+On Windows, close open handles to an existing destination before scanning so it
+can be replaced atomically.
 
 ## Installation
 

benches/file_size_bench.rs

@@ -20,10 +20,13 @@ fn is_extended() -> bool {
 }
 
 fn run_scan(roots: &[PathBuf], threads: usize, patterns_path: &Path) {
-    let output = NamedTempFile::new().expect("create temp output file");
+    // Close the destination handle so Windows can atomically replace the output.
+    let output = NamedTempFile::new()
+        .expect("create temp output file")
+        .into_temp_path();
     let mut cmd = Command::new(assert_cmd::cargo::cargo_bin!("cipherscope"));
     cmd.arg("--output")
-        .arg(output.path())
+        .arg(output.as_os_str())
         .arg("--threads")
         .arg(threads.to_string())
         .arg("--patterns")

benches/large_fixture_bench.rs

@@ -21,10 +21,13 @@ fn is_extended() -> bool {
 }
 
 fn run_scan(roots: &[PathBuf], threads: usize, patterns_path: &Path) {
-    let output = NamedTempFile::new().expect("create temp output file");
+    // Close the destination handle so Windows can atomically replace the output.
+    let output = NamedTempFile::new()
+        .expect("create temp output file")
+        .into_temp_path();
     let mut cmd = Command::new(assert_cmd::cargo::cargo_bin!("cipherscope"));
     cmd.arg("--output")
-        .arg(output.path())
+        .arg(output.as_os_str())
         .arg("--threads")
         .arg(threads.to_string())
         .arg("--patterns")

benches/memory_bench.rs

@@ -26,14 +26,17 @@ fn run_scan_with_memory(
     threads: usize,
     patterns_path: &Path,
 ) -> (Duration, Option<u64>) {
-    let output = NamedTempFile::new().expect("create temp output file");
+    // Close the destination handle so Windows can atomically replace the output.
+    let output = NamedTempFile::new()
+        .expect("create temp output file")
+        .into_temp_path();
 
     let start = Instant::now();
     let result = Command::new("/usr/bin/time")
         .arg("-v")
         .arg(assert_cmd::cargo::cargo_bin!("cipherscope"))
         .arg("--output")
-        .arg(output.path())
+        .arg(output.as_os_str())
         .arg("--threads")
         .arg(threads.to_string())
         .arg("--patterns")
@@ -64,12 +67,15 @@ fn run_scan_with_memory(
     threads: usize,
     patterns_path: &Path,
 ) -> (Duration, Option<u64>) {
-    let output = NamedTempFile::new().expect("create temp output file");
+    // Close the destination handle so Windows can atomically replace the output.
+    let output = NamedTempFile::new()
+        .expect("create temp output file")
+        .into_temp_path();
 
     let start = Instant::now();
     let status = Command::new(assert_cmd::cargo::cargo_bin!("cipherscope"))
         .arg("--output")
-        .arg(output.path())
+        .arg(output.as_os_str())
         .arg("--threads")
         .arg(threads.to_string())
         .arg("--patterns")
@@ -85,10 +91,13 @@ fn run_scan_with_memory(
 }
 
 fn run_scan(roots: &[PathBuf], threads: usize, patterns_path: &Path) {
-    let output = NamedTempFile::new().expect("create temp output file");
+    // Close the destination handle so Windows can atomically replace the output.
+    let output = NamedTempFile::new()
+        .expect("create temp output file")
+        .into_temp_path();
     let mut cmd = Command::new(assert_cmd::cargo::cargo_bin!("cipherscope"));
     cmd.arg("--output")
-        .arg(output.path())
+        .arg(output.as_os_str())
         .arg("--threads")
         .arg(threads.to_string())
         .arg("--patterns")

benches/scale_bench.rs

@@ -20,10 +20,13 @@ fn is_extended() -> bool {
 }
 
 fn run_scan(roots: &[PathBuf], threads: usize, patterns_path: &Path) {
-    let output = NamedTempFile::new().expect("create temp output file");
+    // Close the destination handle so Windows can atomically replace the output.
+    let output = NamedTempFile::new()
+        .expect("create temp output file")
+        .into_temp_path();
     let mut cmd = Command::new(assert_cmd::cargo::cargo_bin!("cipherscope"));
     cmd.arg("--output")
-        .arg(output.path())
+        .arg(output.as_os_str())
         .arg("--threads")
         .arg(threads.to_string())
         .arg("--patterns")

benches/scan_bench.rs

@@ -6,10 +6,13 @@ use criterion::{BenchmarkId, Criterion, criterion_group, criterion_main};
 use tempfile::NamedTempFile;
 
 fn run_scan(roots: &[PathBuf], threads: usize, patterns_path: &Path) {
-    let output = NamedTempFile::new().expect("create temp output file");
+    // Close the destination handle so Windows can atomically replace the output.
+    let output = NamedTempFile::new()
+        .expect("create temp output file")
+        .into_temp_path();
     let mut cmd = Command::new(assert_cmd::cargo::cargo_bin!("cipherscope"));
     cmd.arg("--output")
-        .arg(output.path())
+        .arg(output.as_os_str())
         .arg("--threads")
         .arg(threads.to_string())
         .arg("--patterns")

benches/scan_large_bench.rs

@@ -6,10 +6,13 @@ use criterion::{BenchmarkId, Criterion, criterion_group, criterion_main};
 use tempfile::NamedTempFile;
 
 fn run_scan(roots: &[PathBuf], threads: usize, patterns_path: &Path) {
-    let output = NamedTempFile::new().expect("create temp output file");
+    // Close the destination handle so Windows can atomically replace the output.
+    let output = NamedTempFile::new()
+        .expect("create temp output file")
+        .into_temp_path();
     let mut cmd = Command::new(assert_cmd::cargo::cargo_bin!("cipherscope"));
     cmd.arg("--output")
-        .arg(output.path())
+        .arg(output.as_os_str())
         .arg("--threads")
         .arg(threads.to_string())
         .arg("--patterns")