ci: standardize CI workflows and git hooks

Add ci.yml (compile/fmt/lint/test/audit/machete), nightly.yml (geiger
unsafe audit), deny.toml (license/ban/source policy), and Justfile with
pre-commit, prepush, ci, and install-hooks recipes.

.github/workflows/ci.yml

@@ -0,0 +1,67 @@
+name: CI
+
+on:
+  push:
+    branches: [main, "feature/*", "hotfix/*", "chore/*"]
+  pull_request:
+    branches: [main]
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  compile-check:
+    name: Compile, Format & Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo check --workspace
+      - run: cargo fmt --all --check
+      - run: cargo clippy --workspace -- -D warnings
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    needs: compile-check
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-nextest
+      - run: cargo nextest run --workspace
+
+  audit:
+    name: Audit & Deny
+    runs-on: ubuntu-latest
+    needs: compile-check
+    if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/feature/') || startsWith(github.ref, 'refs/heads/hotfix/')
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - uses: EmbarkStudios/cargo-deny-action@v2
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-audit
+      - run: cargo audit
+
+  machete:
+    name: Unused Dependencies
+    runs-on: ubuntu-latest
+    needs: compile-check
+    if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/feature/') || startsWith(github.ref, 'refs/heads/hotfix/')
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-machete
+      - run: cargo machete

.github/workflows/nightly.yml

@@ -0,0 +1,28 @@
+name: Nightly
+
+on:
+  schedule:
+    - cron: "0 2 * * *"
+  workflow_dispatch:
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  geiger:
+    name: Unsafe Audit (geiger)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo install cargo-geiger --locked
+      - run: cargo geiger --workspace 2>&1 | tee geiger-report.txt
+      - run: |
+          echo "## Geiger Unsafe Audit" >> $GITHUB_STEP_SUMMARY
+          tee -a $GITHUB_STEP_SUMMARY < geiger-report.txt
+      - uses: actions/upload-artifact@v4
+        with:
+          name: geiger-report
+          path: geiger-report.txt
+          retention-days: 30

Justfile

@@ -0,0 +1,20 @@
+pre-commit:
+    cargo fmt --all --check
+    cargo clippy --workspace -- -D warnings
+
+prepush:
+    cargo nextest run --workspace
+
+ci:
+    cargo fmt --all --check
+    cargo clippy --workspace -- -D warnings
+    cargo nextest run --workspace
+
+install-hooks:
+    #!/usr/bin/env sh
+    printf '#!/bin/sh\njust pre-commit\n' > .git/hooks/pre-commit
+    chmod +x .git/hooks/pre-commit
+    printf '#!/bin/sh\njust prepush\n' > .git/hooks/pre-push
+    chmod +x .git/hooks/pre-push
+    printf '#!/bin/sh\ncommit_regex="^(feat|fix|docs|style|refactor|perf|test|chore|ci|build|revert)((.+))?: .+"\nif ! grep -qE "$commit_regex" "$1"; then\n  echo "warning: commit message does not follow conventional commits (non-blocking)"\nfi\n' > .git/hooks/commit-msg
+    chmod +x .git/hooks/commit-msg

deny.toml

@@ -0,0 +1,30 @@
+[advisories]
+ignore = []
+
+[licenses]
+allow = [
+  "MIT",
+  "Apache-2.0",
+  "Apache-2.0 WITH LLVM-exception",
+  "BSD-2-Clause",
+  "BSD-3-Clause",
+  "ISC",
+  "Unicode-3.0",
+  "Unicode-DFS-2016",
+  "Zlib",
+  "MPL-2.0",
+  "CC0-1.0",
+]
+confidence-threshold = 0.8
+
+[licenses.private]
+ignore = false
+
+[bans]
+multiple-versions = "warn"
+wildcards = "allow"
+
+[sources]
+unknown-registry = "warn"
+unknown-git = "warn"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]