ci: adopt the org-wide reusable Rust workflow

.github/workflows/main.yml

@@ -0,0 +1,95 @@
+# Thin caller for the org-wide reusable Rust CI workflow, matching the sibling
+# protocol repos (`uds_protocol`, `automotive_wire_codec`). This file owns the
+# triggers and repo-specific configuration; `luminartech/rust_workflow` owns the
+# jobs: pre-commit, lint, build, no_std canary, unit tests with coverage, miri,
+# MSRV, semver-checks, security audit, docs, a publish dry run, and the
+# release-plz automation.
+#
+# Releasing is not a separate workflow: `use-release-plz` below turns on the
+# two release-plz jobs in the reusable workflow, which maintain a release PR
+# on every `main` push and publish when it merges.
+name: CI
+
+on:
+  pull_request:
+  merge_group:
+  push:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      enable-comprehensive-tests:
+        description: 'Run comprehensive test suites (longer miri)'
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  ci:
+    uses: luminartech/rust_workflow/.github/workflows/rust-ci.yml@v1
+    # The test jobs downscope themselves to `contents: read`; this grant
+    # exists for the release-plz jobs, which push the release-PR branch and
+    # the release tag.
+    permissions:
+      contents: write
+      pull-requests: write
+    secrets:
+      cargo-registry-token: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+      release-plz-app-id: ${{ secrets.RELEASE_PLZ_APP_ID }}
+      release-plz-app-private-key: ${{ secrets.RELEASE_PLZ_APP_PRIVATE_KEY }}
+    with:
+      # release-plz owns versioning, the changelog, tags, GitHub releases and
+      # the publish -- matching `uds_protocol` and `automotive_wire_codec`.
+      # It also disables the workflow's tag-gated `Release & Publish` job, so
+      # the two paths cannot both fire.
+      use-release-plz: true
+      # Restrict publishing to the canonical repo so a fork never publishes
+      # under this crate's name.
+      publish-repository: luminartech/simple_doip
+
+      # The dry run stays on for pull requests: it is the check that the crate
+      # still packages, and it needs no credentials.
+      run-publish-dry-run: true
+
+      # OFF until the first version is on crates.io. `cargo-semver-checks`
+      # diffs against the published baseline, and there is none yet -- turn
+      # this on once the first release-plz publish has happened.
+      #
+      # Worth knowing when it is on: it reads the public API surface, so it
+      # catches a changed signature and not a changed behavior. A function
+      # that starts emitting different bytes passes it. Breaking changes of
+      # that kind still have to be marked `!` on the PR title by hand.
+      run-semver-checks: false
+
+      # OFF until the crate has cargo-fuzz targets. `cargo fuzz build` fails
+      # without a `fuzz/` directory; simple_doip#1 adds four targets, and this
+      # flips when that lands.
+      run-fuzz-tests: false
+
+      # OFF because this crate has no `prop_` tests. The filter would select
+      # nothing, and `cargo nextest` exits 4 on an empty selection -- so the
+      # job would fail rather than skip. Unit tests therefore run everything.
+      run-property-tests: false
+      unit-test-filter: 'all()'
+
+      # `thumbv7em-none-eabihf` rather than the workflow's `thumbv6m` default:
+      # it is the target this crate's bare-metal support is written and
+      # documented against, and `examples/bare_metal_codec` is built for it.
+      no-std-target: thumbv7em-none-eabihf
+
+      # `--lib` only: `tests/golden_vectors.rs` reads its `.hex` fixtures off
+      # disk, and miri's isolation refuses `open`. The lib tests are where the
+      # zero-copy decode paths worth checking for UB live -- 21 of them pass
+      # under miri today.
+      miri-args: '--lib'
+
+      # MSRV comes from `rust-version` in Cargo.toml, so it cannot drift from
+      # what the manifest promises.
+
+      comprehensive-tests: ${{ inputs.enable-comprehensive-tests || false }}

.github/workflows/pr-lint.yml

@@ -0,0 +1,54 @@
+# PR title linting lives in its own workflow so a title edit re-runs only this
+# check, not the whole verification suite.
+#
+# This matters more here than it looks: the repository merges by squash with
+# `squash_merge_commit_title: PR_TITLE`, so the PR title -- not the commits in
+# the branch -- is the commit subject that lands on `main`. The commit history
+# is the changelog, and this is what keeps its entries conventional.
+name: PR Lint
+
+on:
+  pull_request:
+    types: [opened, edited, reopened, synchronize]
+
+permissions:
+  pull-requests: read
+
+concurrency:
+  group: pr-lint-${{ github.head_ref }}
+  cancel-in-progress: true
+
+jobs:
+  pr-title-lint:
+    name: PR Title Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          # The action matches types case-sensitively, so both the lowercase
+          # (conventional-commit spec) and capitalized forms are listed.
+          types: |
+            feat
+            Feat
+            fix
+            Fix
+            perf
+            Perf
+            docs
+            Docs
+            refactor
+            Refactor
+            revert
+            Revert
+            style
+            Style
+            test
+            Test
+            chore
+            Chore
+            ci
+            CI
+            build
+            Build

.pre-commit-config.yaml

@@ -0,0 +1,71 @@
+# Mirrors the checks `luminartech/rust_workflow` runs, so a failure shows up
+# before the push rather than in CI. Install with `pre-commit install`.
+#
+# mdformat is deliberately absent, unlike the sibling protocol repos: it
+# escapes `[` and `]`, and this crate's README and ARCHITECTURE.md are full of
+# intra-doc-style references and tables that the escaping mangles.
+#
+# check-json is absent too: the only JSON here is `.vscode/launch.json`, which
+# is JSONC. Excluding it instead would leave the hook matching nothing, and
+# `check-hooks-apply` fails a hook that matches nothing.
+default_language_version:
+  python: python3.12
+default_stages: [pre-commit]
+default_install_hook_types: [pre-commit, prepare-commit-msg, commit-msg]
+repos:
+  # Squash-merge uses the PR title as the commit message, so the same grammar
+  # is checked on the commit locally.
+  - repo: https://github.com/compilerla/conventional-pre-commit
+    rev: v4.4.0
+    hooks:
+      - id: conventional-pre-commit
+        stages: [commit-msg]
+        args:
+          - --strict
+          - feat
+          - fix
+          - perf
+          - docs
+          - refactor
+          - revert
+          - style
+          - test
+          - chore
+          - ci
+          - build
+  - repo: meta
+    hooks:
+      - id: check-hooks-apply
+      - id: check-useless-excludes
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: trailing-whitespace
+        exclude_types:
+          - markdown
+      - id: end-of-file-fixer
+        exclude_types:
+          - rust
+      - id: check-yaml
+        args: [--allow-multiple-documents]
+      - id: check-added-large-files
+        args: [--maxkb=1024]
+      - id: check-merge-conflict
+      - id: mixed-line-ending
+        args: [--fix=lf]
+        exclude_types:
+          - batch
+  - repo: https://github.com/crate-ci/typos
+    rev: v1.39.1
+    hooks:
+      - id: typos
+        args: ["--config", ".typos.toml"]
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.29.0
+    hooks:
+      - id: gitleaks
+  - repo: https://github.com/FeryET/pre-commit-rust
+    rev: v1.2.1
+    hooks:
+      - id: fmt
+      - id: cargo-check

.typos.toml

@@ -0,0 +1,8 @@
+# Words this crate uses deliberately that `typos` reads as misspellings.
+[default.extend-words]
+# "response pending" is a DoIP/UDS message; a sequence of them is "pendings".
+pendings = "pendings"
+# From "catch-alls" -- the enum variants that absorb unknown wire values.
+alls = "alls"
+# From "mis-mapped".
+mis = "mis"

.vscode/launch.json

@@ -117,4 +117,4 @@
             "cwd": "${workspaceFolder}"
         }
     ]
-}
+}

CHANGELOG.md

@@ -31,6 +31,13 @@ changed rather than what was announced at the time.
   right source address. It stays `0x0000` before activation and after an
   activation the handler denied.
 
+### Security
+
+- The committed lockfile pinned three versions with RUSTSEC advisories against
+  them — `bytes 1.4.0`, `mio 0.8.8` and `tracing-subscriber 0.3.19`. All three
+  are refreshed past their patched versions. No manifest requirement changed;
+  every one was already permitted.
+
 ### Changed
 
 - docs.rs now builds with all features, so the `client`, `server` and `codec`

CONTRIBUTING.md

@@ -10,8 +10,13 @@ preserve when changing the crate.
 
 ## Building and testing
 
-The minimum supported Rust version is **1.88**. `default = []`, so a bare
-`cargo test` exercises only the `no_std` core:
+The minimum supported Rust version is **1.88**, declared as `rust-version` in
+`Cargo.toml`. There is deliberately no `rust-toolchain.toml`: a directory-local
+toolchain file overrides the toolchain CI installs, which silently turns the
+MSRV and miri jobs into no-ops. Use whatever stable you have, and name a
+toolchain explicitly (`cargo +1.88 build`) when you want to check the floor.
+
+`default = []`, so a bare `cargo test` exercises only the `no_std` core:
 
 ```sh
 cargo test --all-features                       # everything