chore: Update from _rust template

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,16 @@
+<!-- Thanks for helping out! -->
+
+### What does this PR try to solve?
+
+<!-- a maintainer-approved Issue is required for non-trivial changes -->
+Closes #<!-- Issue # -->
+
+### Notes to reviewers
+
+<!--
+Examples:
+- Larger context this fits within
+- Manual testing and why it wasn't automated
+-->
+
+LLM involvement: <!-- TODO -->

.github/renovate.json5

@@ -3,6 +3,8 @@
   schedule: [
     'before 5am on the first day of the month',
   ],
+  minimumReleaseAge: "3 days",
+  internalChecksFilter: "strict",
   semanticCommits: 'enabled',
   commitMessageLowerCase: 'never',
   configMigration: true,
@@ -66,9 +68,6 @@
         'prek',
       ],
       extractVersion: '^v(?<version>\\d+\\.\\d+\\.\\d+)',
-      schedule: [
-        '* * * * *',
-      ],
       automerge: true,
     },
     {

.github/workflows/audit.yml

@@ -43,7 +43,7 @@ jobs:
           - advisories
     steps:
     - name: Checkout repository
-      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
     - name: Lint advisories
@@ -63,7 +63,7 @@ jobs:
           - bans licenses sources
     steps:
     - name: Checkout repository
-      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
     - name: Lint bans
@@ -80,7 +80,7 @@ jobs:
       actions: read # only needed for private or internal repos
     steps:
     - name: Checkout repository
-      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
     - name: Run zizmor

.github/workflows/ci.yml

@@ -13,6 +13,8 @@ env:
   RUST_BACKTRACE: 1
   CARGO_TERM_COLOR: always
   CLICOLOR: 1
+  CARGO_INCREMENTAL: 0
+  RUST_TOOLCHAIN_STABLE: "1.98"  # STABLE
 
 concurrency:
   group: "${{ github.workflow }}-${{ github.ref }}"
@@ -43,13 +45,11 @@ jobs:
       CARGO_PROFILE_DEV_DEBUG: line-tables-only
     steps:
     - name: Checkout repository
-      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
     - name: Install Rust
-      uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
-      with:
-        toolchain: ${{ matrix.rust }}
+      run: rustup update --no-self-update ${{ matrix.rust }} && rustup default ${{ matrix.rust }}
     - name: Initialize cache
       uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
     - name: Install cargo-hack
@@ -68,13 +68,11 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout repository
-      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
     - name: Install Rust
-      uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
-      with:
-        toolchain: stable
+      run: rustup update --no-self-update stable && rustup default stable
     - name: Initialize cache
       uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
     - name: Install cargo-hack
@@ -91,17 +89,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout repository
-      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
     - name: Install stable Rust
-      uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
-      with:
-        toolchain: stable
+      run: rustup update --no-self-update stable && rustup default stable
     - name: Install nightly Rust
-      uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
-      with:
-        toolchain: nightly
+      run: rustup update --no-self-update nightly && rustup default nightly
     - name: Downgrade dependencies to minimal versions
       run: cargo +nightly generate-lockfile -Z minimal-versions
     - name: Compile with minimal versions
@@ -110,13 +104,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout repository
-      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
     - name: Install Rust
-      uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
-      with:
-        toolchain: stable
+      run: rustup update --no-self-update stable && rustup default stable
     - name: Initialize cache
       uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
     - name: "Is lockfile updated?"
@@ -126,32 +118,29 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout repository
-      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
     - name: Install Rust
-      uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
-      with:
-        toolchain: "1.98"  # STABLE
+      run: rustup update --no-self-update $RUST_TOOLCHAIN_STABLE && rustup default $RUST_TOOLCHAIN_STABLE
     - name: Initialize cache
       uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
     - name: Check documentation
       env:
-        RUSTDOCFLAGS: -D warnings
+        CARGO_BUILD_WARNINGS: deny
       run: cargo doc --workspace --all-features --no-deps --document-private-items --keep-going
   rustfmt:
     name: rustfmt
     runs-on: ubuntu-latest
     steps:
     - name: Checkout repository
-      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
     - name: Install Rust
-      uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
-      with:
-        toolchain: "1.98"  # STABLE
-        components: rustfmt
+      run: rustup update --no-self-update $RUST_TOOLCHAIN_STABLE && rustup default $RUST_TOOLCHAIN_STABLE
+    - name: Install rustfmt
+      run: rustup component add rustfmt
     - name: Initialize cache
       uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
     - name: Check formatting
@@ -163,14 +152,13 @@ jobs:
       security-events: write # to upload sarif results
     steps:
     - name: Checkout repository
-      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
     - name: Install Rust
-      uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
-      with:
-        toolchain: "1.98"  # STABLE
-        components: clippy
+      run: rustup update --no-self-update $RUST_TOOLCHAIN_STABLE && rustup default $RUST_TOOLCHAIN_STABLE
+    - name: Install clippy
+      run: rustup component add clippy
     - name: Initialize cache
       uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
     - name: Install SARIF tools
@@ -190,26 +178,30 @@ jobs:
         sarif_file: clippy-results.sarif
         wait-for-processing: true
     - name: Report status
-      run: cargo clippy --workspace --all-features --all-targets --keep-going -- -D warnings --allow deprecated
+      env:
+        CARGO_BUILD_WARNINGS: deny
+      run: cargo clippy --workspace --all-features --all-targets --keep-going -- --allow deprecated --allow renamed_and_removed_lints
   coverage:
     name: Coverage
     runs-on: ubuntu-latest
+    permissions:
+      code-quality: write
     steps:
     - name: Checkout repository
-      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
     - name: Install Rust
-      uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
-      with:
-        toolchain: stable
+      run: rustup update --no-self-update stable && rustup default stable
     - name: Initialize cache
       uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
     - name: Install cargo-tarpaulin
       run: cargo install cargo-tarpaulin
     - name: Gather coverage
-      run: cargo tarpaulin --output-dir coverage --out lcov
-    - name: Publish to Coveralls
-      uses: coverallsapp/github-action@09b709cf6a16e30b0808ba050c7a6e8a5ef13f8d # master
+      run: cargo tarpaulin --out xml
+    - name: Upload coverage report
+      if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+      uses: actions/upload-code-coverage@1c15be36fc3733ba839b1dd643bd9556e4426dc1 # v1.4.1
       with:
-        github-token: ${{ secrets.GITHUB_TOKEN }}
+        file: cobertura.xml
+        language: Rust

.github/workflows/committed.yml

@@ -21,9 +21,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout repository
-      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0
+        filter: "tree:0"
         persist-credentials: false
     - name: Lint Commits
       uses: crate-ci/committed@faeed42f2e10c244533a01525f13c4d8b6ce383f # v1.1.11

.github/workflows/pre-commit.yml

@@ -23,10 +23,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout repository
-      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
     - name: prek
-      uses: j178/prek-action@5337cb91e0fa35a7ff31b9ca345126d8bbbcdf16 # v2.0.6
+      uses: j178/prek-action@4e14d07f9231acabce116ccfca13b13dd9755ece # v3.0.0
       with:
         prek-version: '0.5.0'

.github/workflows/rust-next.yml

@@ -11,6 +11,7 @@ env:
   RUST_BACKTRACE: 1
   CARGO_TERM_COLOR: always
   CLICOLOR: 1
+  CARGO_INCREMENTAL: 0
 
 concurrency:
   group: "${{ github.workflow }}-${{ github.ref }}"
@@ -33,13 +34,11 @@ jobs:
       CARGO_PROFILE_DEV_DEBUG: line-tables-only
     steps:
     - name: Checkout repository
-      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
     - name: Install Rust
-      uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
-      with:
-        toolchain: ${{ matrix.rust }}
+      run: rustup update --no-self-update ${{ matrix.rust }} && rustup default ${{ matrix.rust }}
     - name: Initialize cache
       uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
     - name: Install cargo-hack
@@ -60,13 +59,11 @@ jobs:
       CARGO_RESOLVER_INCOMPATIBLE_RUST_VERSIONS: allow
     steps:
     - name: Checkout repository
-      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
     - name: Install Rust
-      uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
-      with:
-        toolchain: stable
+      run: rustup update --no-self-update stable && rustup default stable
     - name: Initialize cache
       uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
     - name: Install cargo-hack

.github/workflows/spelling.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout Actions Repository
-      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
     - name: Spell Check Repo

.github/workflows/template.yml

@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout repository
-      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0
         persist-credentials: true # to push the branch and create PR

.pre-commit-config.yaml

@@ -18,6 +18,6 @@ repos:
     hooks:
     - id: committed
   - repo: https://github.com/zizmorcore/zizmor-pre-commit
-    rev: v1.26.1
+    rev: v1.28.0
     hooks:
     - id: zizmor

AI_POLICY.md

@@ -0,0 +1,58 @@
+# AI policy
+
+Project maintainers are responsible for any code that is published as part of a release.
+Contributors are responsible for their contributions, both in terms of communications and code.
+This responsibility is for both understanding of and the quality of their contributions.
+
+## Personal use
+
+You are free to use an AI locally for your own purposes,
+including to answer your questions, analyze, distill, refine, check, suggest, and review.
+
+## Communication
+
+**AI should not be used to generate comments when communicating with maintainers.**
+We expect comments on our projects to be written by humans.
+We may hide or delete any comments where we believe AI generation was involved.
+
+If you are opening an issue,
+we expect you to have personally reproduced the problem and to describe it in your own words.
+
+If you are opening a pull request,
+we expect you to be able to explain the proposed changes in your own words.
+This includes the pull request body and responses to questions.
+**Do not copy responses from an AI when replying to questions from maintainers.**
+Do not run agents or bots on pull requests without first getting approval.
+
+We understand that AI is useful when communicating as a non-native English speaker.
+If you are using AI to edit your comments for this purpose,
+please take the time to ensure it reflects your own voice and ideas.
+If using AI for translation, we recommend writing in your native language and including the AI translation in a [`<details>` block].
+
+If you wish to include context from an interaction with AI in your comments,
+it must be in a [`<details>` block] and disclosed as such.
+The block must include human commentary explaining the relevance and implications of the context.
+The content of your comment must stand on its own even without the quoted content.
+Do not share long snippets.
+
+## Code
+
+Using AI as tools for coding requires receiving permission on the relevant issue before a PR is posted.
+
+This project requires a human in the loop who understands the work produced by AI.
+**We do not allow autonomous agents to be used for contributing to this project**.
+We will close any pull requests that we believe were created **without meaningful involvement** from the contributor.
+Contributions should not "read" as being written by an AI.
+
+Some areas require specific expertise or care when touching.
+AI generated code, even with human review, is prohibited for:
+- none
+
+We view AI as providing a way to improve quality and will hold AI-assisted contributions to a higher standard.
+We will be more free in asking for changes.
+
+The involvement of AI assistance must be disclosed in PRs.
+
+For documentation, including comments in code, see [Communication](#communication).
+
+[`<details>` block]: https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/organizing-information-with-collapsed-sections)