chore: production readiness P0/P1 improvements

.cargo/audit.toml

@@ -0,0 +1,7 @@
+# Track known transitive advisories until upstream fixes land.
+# See: https://github.com/Tuntii/RustAPI/issues/200
+[advisories]
+ignore = [
+    "RUSTSEC-2026-0185", # quinn-proto – HTTP/3 optional dep; upgrade tracked in #200
+    "RUSTSEC-2023-0071", # rsa – transitive, no fixed upgrade available
+]

.env → .env.example

@@ -1,8 +1,8 @@
-# Placeholder environment variables for local documentation/examples
-# Replace with real values before running database-backed samples.
+# Placeholder environment variables for local documentation/examples.
+# Copy to .env and replace with real values before running database-backed samples.
 DATABASE_URL=postgres://postgres:postgres@localhost:5432/rustapi_dev
 REDIS_URL=redis://127.0.0.1:6379
 OAUTH_CLIENT_ID=replace-me
 OAUTH_CLIENT_SECRET=replace-me
 OAUTH_REDIRECT_URI=http://127.0.0.1:3000/auth/callback
-OIDC_ISSUER_URL=https://accounts.google.com
+OIDC_ISSUER_URL=https://accounts.google.com

.gitattributes

@@ -1,4 +1,3 @@
-# Auto detect text files and perform LF normalization
-* text=auto
-api/public/*.txt text eol=lf
-.github/scripts/*.sh text eol=lf
+# Large binary assets — use Git LFS for PNGs over 500 KB
+assets/*.png filter=lfs diff=lfs merge=lfs -text
+assets/**/*.png filter=lfs diff=lfs merge=lfs -text

.github/scripts/prune_stale_branches.ps1

@@ -0,0 +1,78 @@
+# Prune stale local and remote branches for RustAPI.
+# Usage:
+#   .\.github\scripts\prune_stale_branches.ps1 -DryRun
+#   .\.github\scripts\prune_stale_branches.ps1
+#   .\.github\scripts\prune_stale_branches.ps1 -DeleteRemote
+
+param(
+    [switch]$DryRun,
+    [switch]$DeleteRemote,
+    [int]$StaleDays = 30
+)
+
+$ErrorActionPreference = "Stop"
+$repoRoot = git -C $PSScriptRoot rev-parse --show-toplevel
+Set-Location $repoRoot
+
+$protected = @("main", "master", "gh-pages", "Production-baseline")
+$stalePatterns = @("^copilot/", "^copilot-", "^sentinel-", "^secure-")
+
+function Test-StaleBranchName([string]$Name) {
+    foreach ($pattern in $stalePatterns) {
+        if ($Name -match $pattern) { return $true }
+    }
+    return $false
+}
+
+Write-Host "Scanning branches older than $StaleDays days..."
+$cutoff = (Get-Date).AddDays(-$StaleDays)
+
+$localBranches = git for-each-ref --format="%(refname:short)|%(committerdate:iso8601)" refs/heads/ |
+    ForEach-Object {
+        $parts = $_ -split '\|', 2
+        [PSCustomObject]@{ Name = $parts[0]; Date = [datetime]$parts[1] }
+    }
+
+$candidates = $localBranches |
+    Where-Object { $protected -notcontains $_.Name } |
+    Where-Object { $_.Date -lt $cutoff -or (Test-StaleBranchName $_.Name) }
+
+if (-not $candidates) {
+    Write-Host "No stale branches found."
+    exit 0
+}
+
+Write-Host ""
+Write-Host "Stale branch candidates:"
+$candidates | ForEach-Object { Write-Host "  $($_.Name) (last commit: $($_.Date.ToString('yyyy-MM-dd')))" }
+
+if ($DryRun) {
+    Write-Host ""
+    Write-Host "Dry run - no branches deleted."
+    exit 0
+}
+
+foreach ($branch in $candidates) {
+    Write-Host "Deleting local branch: $($branch.Name)"
+    git branch -D $branch.Name
+}
+
+if ($DeleteRemote) {
+    if (-not (Get-Command gh -ErrorAction SilentlyContinue)) {
+        Write-Error "gh CLI not found. Install GitHub CLI or omit -DeleteRemote."
+    }
+    $repo = gh repo view --json nameWithOwner -q .nameWithOwner
+    $remoteBranches = git for-each-ref --format="%(refname:short)" refs/remotes/origin/ |
+        ForEach-Object { $_ -replace '^origin/', '' } |
+        Where-Object { $_ -ne "HEAD" -and $protected -notcontains $_ } |
+        Where-Object { Test-StaleBranchName $_ }
+
+    foreach ($branch in $remoteBranches) {
+        Write-Host "Deleting remote branch: origin/$branch"
+        gh api -X DELETE "repos/$repo/git/refs/heads/$branch"
+    }
+}
+
+Write-Host ""
+Write-Host "Done. Enable GitHub stale branch archiving:"
+Write-Host "  Repository Settings - Branches - Add branch ruleset (archive after 30 days)"

.github/workflows/audit.yml

@@ -0,0 +1,53 @@
+name: Security Audit
+
+on:
+  schedule:
+    # Weekly on Monday at 06:00 UTC
+    - cron: "0 6 * * 1"
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  cargo-audit:
+    name: Cargo Audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --locked
+
+      - name: Run cargo audit
+        run: cargo audit
+        # Informational on PRs until transitive advisories are resolved (quinn-proto, rsa).
+        continue-on-error: ${{ github.event_name == 'pull_request' }}
+
+  public-api-label-gate:
+    name: Public API Label Gate
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Enforce breaking/feature label on snapshot changes
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          PR_LABELS: ${{ join(github.event.pull_request.labels.*.name, ',') }}
+          GITHUB_EVENT_PATH: ${{ github.event_path }}
+        run: bash .github/scripts/public_api_label_gate.sh

.gitignore

@@ -1,5 +1,10 @@
 /target
 /memories
+
+# Environment files (never commit secrets)
+.env
+.env.*
+!.env.example
 /scripts
 # /benches
 /.kiro

README.md

@@ -8,6 +8,9 @@
   [![Crates.io](https://img.shields.io/crates/v/rustapi-rs.svg)](https://crates.io/crates/rustapi-rs)
   [![Docs](https://img.shields.io/badge/docs-cookbook-brightgreen)](docs/cookbook/src/SUMMARY.md)
   [![License](https://img.shields.io/badge/license-MIT%2FApache--2.0-blue.svg)](LICENSE)
+  [![MSRV](https://img.shields.io/badge/MSRV-1.85-orange)](Cargo.toml)
+  [![Security Audit](https://github.com/Tuntii/RustAPI/actions/workflows/audit.yml/badge.svg)](https://github.com/Tuntii/RustAPI/actions/workflows/audit.yml)
+  [![Coverage](https://img.shields.io/badge/coverage-tarpaulin-blue)](https://github.com/Tuntii/RustAPI/actions/workflows/ci.yml)
   [![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/Tuntii/RustAPI)
 </div>