Merge pull request #9 from Carabryx/ci/codecov-org-setup

ci: standardize Codecov org token setup and add Dependabot

Author: AriajSarkar

.gitattributes

@@ -0,0 +1,2 @@
+# Enforce LF line endings for all text files
+* text=auto eol=lf

.github/dependabot.yml

@@ -0,0 +1,22 @@
+version: 2
+updates:
+  - package-ecosystem: cargo
+    directory: "/"
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: deps
+    labels:
+      - dependencies
+    open-pull-requests-limit: 10
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: ci
+    labels:
+      - dependencies
+      - github-actions
+    open-pull-requests-limit: 10

.github/workflows/ci.yml

@@ -89,21 +89,26 @@ jobs:
   coverage:
     name: Code Coverage
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
         with:
           cache-on-failure: true
       - name: Install tarpaulin
-        run: cargo install cargo-tarpaulin
+        run: cargo install cargo-tarpaulin --locked
       - name: Generate coverage
         run: cargo tarpaulin --all-features --out Xml --timeout 300
       - name: Upload coverage
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v6
         with:
           files: ./cobertura.xml
-          fail_ci_if_error: false
+          token: ${{ secrets.CODECOV_TOKEN }}
+          slug: ${{ github.repository }}
+          fail_ci_if_error: true
+          verbose: true
 
   docs:
     name: Documentation

.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,33 @@
+name: Dependabot Auto Merge
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
+
+concurrency:
+  group: dependabot-auto-merge-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  auto-merge:
+    if: >
+      github.event.pull_request.user.login == 'dependabot[bot]' &&
+      github.event.pull_request.draft == false
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Wait for PR checks
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh pr checks ${{ github.event.pull_request.number }} --watch --interval 10
+
+      - name: Merge Dependabot PR
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh pr merge ${{ github.event.pull_request.number }} --squash --delete-branch

Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "crabgraph"
 version = "0.4.0-pre"
-authors = ["Raj Sarkar <ariajsarkar@gmail.com>"]
+authors = ["Ariaj Sarkar <ariajsarkar@gmail.com>"]
 edition = "2021"
 rust-version = "1.70"
 description = "A safe, ergonomic, high-performance cryptographic library for Rust built on audited primitives"

codecov.yml

@@ -0,0 +1,17 @@
+codecov:
+  require_ci_to_pass: true
+
+coverage:
+  precision: 2
+  round: down
+  range: "70...100"
+
+comment:
+  layout: "reach,diff,flags,tree"
+  behavior: default
+  require_changes: true
+
+ignore:
+  - "benches/**"
+  - "examples/**"
+  - "fuzz/**"

examples/key_wrapping_example.rs

@@ -108,11 +108,7 @@ fn demo_multiple_sizes() -> CrabResult<()> {
     let kek256 = Kw256::generate_kek()?;
     let wrapper256 = Kw256::new(&kek256)?;
     let wrapped256 = wrapper256.wrap_key(&test_key)?;
-    println!(
-        "Kw256: Wrapped {} bytes → {} bytes (RECOMMENDED)",
-        test_key.len(),
-        wrapped256.len()
-    );
+    println!("Kw256: Wrapped {} bytes → {} bytes (RECOMMENDED)", test_key.len(), wrapped256.len());
 
     // Verify all unwrap correctly
     assert_eq!(wrapper128.unwrap_key(&wrapped128)?, test_key);

rustfmt.toml

@@ -1,48 +1,26 @@
-# CrabGraph Rustfmt Configuration
+# CrabGraph — rustfmt (stable `cargo fmt` compatible)
+# Run: cargo fmt --all
 
-# Edition
 edition = "2021"
 
-# Formatting
+# Primary line length.
 max_width = 100
-hard_tabs = false
-tab_spaces = 4
-newline_style = "Auto"
-
-# Imports
-imports_granularity = "Crate"
-group_imports = "StdExternalCrate"
-
-# Function calls
-use_small_heuristics = "Default"
-fn_call_width = 80
-fn_single_line = false
-
-# Chains
+# Break method / builder chains sooner (sub-limit of max_width).
 chain_width = 80
 
-# Comments
-comment_width = 100
-wrap_comments = true
-normalize_comments = true
-normalize_doc_attributes = true
+# "Off" = stricter wrapping at max_width (fewer very long lines than "Default").
+use_small_heuristics = "Off"
 
-# Attributes
-reorder_impl_items = false
-
-# Match
-match_block_trailing_comma = false
-match_arm_blocks = true
-match_arm_leading_pipes = "Never"
-
-# Spacing
-spaces_around_ranges = false
-type_punctuation_density = "Wide"
+hard_tabs = false
+tab_spaces = 4
+newline_style = "Auto"
 
-# Misc
 reorder_imports = true
 reorder_modules = true
-remove_nested_parens = true
-format_code_in_doc_comments = true
-format_macro_matchers = true
-format_macro_bodies = true
+
+# --- Nightly rustfmt only (ignored on stable; use `cargo +nightly fmt --all`) ---
+# imports_granularity = "Module"
+# group_imports = "StdExternalCrate"
+# wrap_comments = true
+# comment_width = 80
+# format_code_in_doc_comments = true

src/aead/aes_gcm.rs

@@ -42,7 +42,9 @@ impl AesGcm128 {
         let cipher = Aes128Gcm::new_from_slice(key)
             .map_err(|e| CrabError::key_error(format!("Invalid AES-128 key: {}", e)))?;
 
-        Ok(Self { cipher })
+        Ok(Self {
+            cipher,
+        })
     }
 
     /// Generates a random 16-byte key suitable for AES-128-GCM.
@@ -172,7 +174,9 @@ impl AesGcm256 {
         let cipher = Aes256Gcm::new_from_slice(key)
             .map_err(|e| CrabError::key_error(format!("Invalid AES-256 key: {}", e)))?;
 
-        Ok(Self { cipher })
+        Ok(Self {
+            cipher,
+        })
     }
 
     /// Generates a random 32-byte key suitable for AES-256-GCM.

src/aead/chacha20poly1305.rs

@@ -58,7 +58,9 @@ impl ChaCha20Poly1305 {
         let cipher = ChaCha20Poly1305Cipher::new_from_slice(key)
             .map_err(|e| CrabError::key_error(format!("Invalid ChaCha20-Poly1305 key: {}", e)))?;
 
-        Ok(Self { cipher })
+        Ok(Self {
+            cipher,
+        })
     }
 
     /// Generates a random 32-byte key suitable for ChaCha20-Poly1305.