Refactor CI pipelines

.github/actions/cargo-binstall/action.yaml

@@ -0,0 +1,18 @@
+name: Install cargo binaries
+description: Install cargo binaries using cargo-binstall
+inputs:
+  binstall:
+    description: "Programs to install with binstall"
+    required: true
+runs:
+  using: "composite"
+  steps:
+    - name: Install cargo-binstall
+      shell: bash
+      run: >
+        curl -L --proto '=https' --tlsv1.3 -sSf https://github.com/cargo-bins/cargo-binstall/releases/latest/download/cargo-binstall-x86_64-unknown-linux-musl.tgz | sudo tar -xzv -C /usr/bin
+
+    - name: Install cargo bins
+      shell: bash
+      run: >
+        cargo-binstall --no-confirm --min-tls-version 1.3 ${{ inputs.binstall }}

.github/actions/setup-ci/action.yaml

@@ -0,0 +1,19 @@
+name: Setup CI environment
+inputs:
+  rust-cache-key:
+    description: "An additional cache key that is added alongside the automatic `job`-based cache key and can be used to further differentiate jobs."
+    required: false
+  rust-cache-shared-key:
+    description: "A cache key that is used instead of the automatic `job`-based key, and is stable over multiple jobs."
+    required: false
+runs:
+  using: "composite"
+  steps:
+    - name: Install rust toolchain
+      shell: bash
+      run: rustup show
+
+    - uses: Swatinem/rust-cache@23bce251a8cd2ffc3c1075eaa2367cf899916d84 # v2
+      with:
+        key: "${{ inputs.rust-cache-key }}"
+        shared-key: "${{ inputs.rust-cache-shared-key }}"

.github/renovate.json5

@@ -11,6 +11,18 @@
         enabled: true,
         automerge: true
     },
+    "customManagers": [
+      {
+        "customType": "regex",
+        "fileMatch": ["^rust-toolchain\\.toml?$"],
+        "matchStrings": [
+          "channel\\s*=\\s*\"(?<currentValue>\\d+\\.\\d+(\\.\\d+)?)\""
+        ],
+        "depNameTemplate": "rust",
+        "packageNameTemplate": "rust-lang/rust",
+        "datasourceTemplate": "github-releases"
+      },
+    ],
     packageRules: [
         {
             matchCategories: ["rust"],

.github/workflows/ci.yml

@@ -0,0 +1,108 @@
+name: CI tests
+on: [push]
+
+jobs:
+  populate-rust-cache:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+      - uses: ./.github/actions/setup-ci
+        with:
+          rust-cache-shared-key: "base"
+      - run: cargo check --all-targets --all-features
+        continue-on-error: true
+
+  matrix-jobs:
+    name: ${{ matrix.job }}
+    runs-on: ubuntu-latest
+    needs: populate-rust-cache
+    strategy:
+      matrix:
+        job:
+          - cargo fmt --all -- --check
+          - cargo test
+          - cargo clippy -- -D warnings
+          - cargo deny --all-features check advisories
+          - cargo deny --all-features check bans licenses sources
+      fail-fast: false
+    steps:
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+      - uses: ./.github/actions/setup-ci
+        with:
+          rust-cache-shared-key: "base"
+      - run: ${{ matrix.job }}
+
+  deny:
+    name: ${{ matrix.job }}
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        job:
+          - cargo deny --all-features check advisories
+          - cargo deny --all-features check bans licenses sources
+      fail-fast: false
+    # Prevent sudden announcement of a new advisory from failing CI:
+    continue-on-error: ${{ endsWith(matrix.job, 'check advisories') }}
+    steps:
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+      - uses: ./.github/actions/cargo-binstall
+        with:
+          binstall: "cargo-deny"
+      - run: ${{ matrix.job }}
+
+  pre-commit:
+    name: Run pre-commit
+    runs-on: ubuntu-latest
+    needs: populate-rust-cache
+    env:
+      # These hooks are expensive and already run as dedicated jobs above
+      SKIP: "tests,clippy"
+    steps:
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+
+      - uses: ./.github/actions/setup-ci
+        with:
+          rust-cache-shared-key: "base"
+
+      - uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5
+      - name: set PYVERSION
+        run: echo "PYVERSION=$(python --version | tr ' ' '-')" >> $GITHUB_ENV
+
+      - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
+        with:
+          path: ~/.cache/pre-commit
+          # Changes to pre-commit-config.yaml may require the installation of
+          # new binaries/scripts. When a cache hit occurs, changes to the cache
+          # aren't persisted at the end of the run, so making the key dependent
+          # on the configuration file ensures we always persist a complete cache.
+          key: pre-commit-${{ env.PYVERSION }}-${{ hashFiles('.pre-commit-config.yaml') }}
+
+      - run: pip install pre-commit
+      - run: pre-commit run --all --color=always --show-diff-on-failure
+
+  test-windows:
+    name: Test on Windows
+    runs-on: windows-latest
+    steps:
+      - run: git config --system core.autocrlf false && git config --system core.eol lf
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+      - uses: ./.github/actions/setup-ci
+      - run: cargo test
+
+  coverage:
+    name: Code coverage
+    runs-on: ubuntu-latest
+    needs: populate-rust-cache
+    steps:
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+      - uses: ./.github/actions/setup-ci
+      - uses: actions-rs/tarpaulin@044a1e5bdace8dd2f727b1af63c1d9a1d3572068 # v0.1
+        with:
+          # Constrained by https://github.com/actions-rs/tarpaulin/pull/23
+          version: "0.22.0"
+          args: "--ignore-tests"
+          out-type: "Html"
+      - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4
+        with:
+          name: tarpaulin-report
+          path: tarpaulin-report.html