ci: nextest, coverage, cargo-deny licenses, PR-merge comment workflow

- test job: use cargo-nextest for faster runs on ubuntu/macos/windows
- coverage job: llvm-cov + Codecov upload (CODECOV_TOKEN optional)
- cargo-deny: add [licenses] allow list + exceptions for ring, unicode-ident
- pr-merge-comment: on PR merge, comment on issues linked via Closes/Fixes/Resolves
- fix actionlint: pass PR body via env, single GITHUB_OUTPUT redirect

Made-with: Cursor

Author: haasonsaas

.github/workflows/ci.yml

@@ -51,16 +51,16 @@ jobs:
         run: cargo audit
 
   cargo-deny:
-    name: cargo-deny (advisories)
+    name: cargo-deny (advisories + licenses)
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@1.88.0
       - uses: Swatinem/rust-cache@v2
       - name: Install cargo-deny
         run: cargo install cargo-deny --locked
-      - name: Check advisories
-        run: cargo deny check advisories
+      - name: Check advisories and licenses
+        run: cargo deny check advisories licenses
 
   test:
     runs-on: ${{ matrix.os }}
@@ -76,8 +76,36 @@ jobs:
         run: cd web && npm ci && npm run build
       - uses: dtolnay/rust-toolchain@1.88.0
       - uses: Swatinem/rust-cache@v2
+      - name: Install cargo-nextest
+        run: cargo install cargo-nextest --locked
       - name: Test
-        run: cargo test
+        run: cargo nextest run
+
+  coverage:
+    name: Coverage (llvm-cov)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: '20'
+      - name: Build frontend
+        run: cd web && npm ci && npm run build
+      - uses: dtolnay/rust-toolchain@1.88.0
+        with:
+          components: llvm-tools-preview
+      - uses: Swatinem/rust-cache@v2
+      - name: Install cargo-llvm-cov
+        uses: taiki-e/install-action@cargo-llvm-cov
+      - name: Generate coverage
+        run: cargo llvm-cov test --no-fail-fast --lcov --output-path lcov.info
+      - name: Upload to Codecov
+        uses: codecov/codecov-action@v4
+        with:
+          files: lcov.info
+          fail_ci_if_error: false
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   mutation:
     runs-on: ubuntu-latest

.github/workflows/pr-merge-comment.yml

@@ -0,0 +1,48 @@
+# When a PR is merged, comment on linked issues (Closes #N, Fixes #N, etc.).
+name: PR merge — comment on linked issues
+
+on:
+  pull_request:
+    types: [closed]
+
+jobs:
+  comment-linked-issues:
+    name: Comment on linked issues
+    if: github.event.pull_request.merged == true
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - name: Extract linked issue numbers
+        id: issues
+        env:
+          PR_BODY: ${{ github.event.pull_request.body }}
+          PR_NUM: ${{ github.event.pull_request.number }}
+        run: |
+          ISSUES=$(echo "$PR_BODY" | grep -ioE '(closes?|fixes?|resolves?)\s+#[0-9]+' | grep -oE '#[0-9]+' | tr -d '#' | sort -nu)
+          {
+            if [ -z "$ISSUES" ]; then
+              echo "ids="
+            else
+              echo "ids<<EOF"
+              echo "$ISSUES"
+              echo "EOF"
+            fi
+            echo "pr_num=$PR_NUM"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Comment on each linked issue
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUM: ${{ steps.issues.outputs.pr_num }}
+          ISSUE_IDS: ${{ steps.issues.outputs.ids }}
+        run: |
+          if [ -z "$ISSUE_IDS" ]; then
+            echo "No linked issues to comment on."
+            exit 0
+          fi
+          for id in $ISSUE_IDS; do
+            echo "Commenting on issue #$id..."
+            gh issue comment "$id" --body "Shipped in PR #${PR_NUM} (merged to main)."
+          done

Cargo.lock

@@ -1,7 +1,29 @@
 # cargo-deny: https://embarkstudios.github.io/cargo-deny/
-# CI runs: cargo deny check advisories (licenses optional; expand allow list to enable).
+# CI runs: cargo deny check advisories licenses
 
 [advisories]
 version = 2
 unmaintained = "workspace"
 yanked = "warn"
+
+[licenses]
+version = 2
+allow = [
+  "Apache-2.0",
+  "BSD-2-Clause",
+  "BSD-3-Clause",
+  "CDLA-Permissive-2.0",
+  "ISC",
+  "MIT",
+  "MPL-2.0",
+  "Unicode-3.0",
+  "Zlib",
+]
+# Compound expressions: allow via exceptions for specific crates.
+[[licenses.exceptions]]
+allow = ["Apache-2.0", "ISC"]
+crate = "ring"
+
+[[licenses.exceptions]]
+allow = ["MIT", "Apache-2.0", "Unicode-3.0"]
+crate = "unicode-ident"