Refactor CI/CD workflows and branch protection

Update dependabot to target dependencies branch. Remove branch
protection rulesets and add dedicated audit workflow. Simplify CI
matrix and split test job from checks. Add lite CI for dependencies
branch and sync workflow from master.

Author: nerjs

.github/dependabot.yml

@@ -4,7 +4,7 @@ updates:
     directory: /
     schedule:
       interval: weekly
-      time: "06:00"
+    target-branch: "dependencies"
     open-pull-requests-limit: 5
     assignees:
       - nerjs
@@ -21,7 +21,7 @@ updates:
     directory: /
     schedule:
       interval: weekly
-      time: "06:00"
+    target-branch: "dependencies"
     open-pull-requests-limit: 5
     assignees:
       - nerjs

.github/rulesets/master-merge-queue.json

@@ -0,0 +1,27 @@
+name: "audit"
+
+on:
+  schedule:
+    - cron: "0 6 * * 1"
+  push:
+    paths:
+      - "**/Cargo.toml"
+      - "**/Cargo.lock"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-audit
+      - run: cargo audit

.github/rulesets/master.json

@@ -27,9 +27,19 @@ jobs:
   checks:
     uses: ./.github/workflows/checks.yml
 
-  bump:
+  test:
     needs: checks
     runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo test --all-features
+
+  bump:
+    needs: 
+      - checks
+      - test
+    runs-on: ubuntu-latest
     outputs:
       tag: ${{ steps.tag.outputs.tag }}
     steps:

.github/workflows/audit.yml

@@ -1,14 +1,5 @@
 name: Checks
 
-# Reusable gate: fmt, clippy and tests on the dev toolchain, auto-installed by
-# rustup from rust-toolchain.toml. Deleting that file silently falls back to
-# the runner's bundled Rust. Called by bump-and-release and the publish
-# workflows so nothing ships without passing checks, even if a tag points at a
-# commit that never went through the PR CI. Jobs run in parallel.
-#
-# This is a smoke gate on the dev toolchain only; the full version x distro
-# matrix runs in ci.yml on PRs.
-
 on:
   workflow_call:
 
@@ -29,9 +20,9 @@ jobs:
       - uses: Swatinem/rust-cache@v2
       - run: cargo clippy --all-targets --all-features -- -D warnings
 
-  test:
+  check:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
       - uses: Swatinem/rust-cache@v2
-      - run: cargo test --all-features
+      - run: cargo check --all-features

.github/workflows/bump-and-release.yml

@@ -0,0 +1,30 @@
+name: "CI (lite): dependencies"
+
+on:
+  workflow_dispatch:
+  push:
+    branches: 
+      - dependencies
+  pull_request:
+    branches: 
+      - dependencies
+
+permissions:
+  contents: read
+  
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  checks:
+    uses: ./.github/workflows/checks.yml
+
+  test:
+    needs: checks
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo test --all-features
+        

.github/workflows/checks.yml

@@ -3,10 +3,11 @@ name: CI
 on:
   workflow_dispatch:
   push:
-    branches: [master]
+    branches: 
+      - master
   pull_request:
-    branches: [master]
-  merge_group:
+    branches: 
+      - master
 
 permissions:
   contents: read
@@ -16,68 +17,33 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  # fmt, clippy and build run on the dev toolchain, auto-installed by rustup
-  # from rust-toolchain.toml. Only the test matrix pins explicit versions.
-  fmt:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - run: cargo fmt --all --check
-
-  clippy:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - uses: Swatinem/rust-cache@v2
-      - run: cargo clippy --all-targets --all-features -- -D warnings
-
+  checks:
+    uses: ./.github/workflows/checks.yml
+    
   test:
     needs: [fmt, clippy]
     strategy:
       fail-fast: false
       matrix:
-        # Pinned floor (dev version from rust-toolchain.toml plus the three
-        # below it) tests the toolchains you develop and ship on; "stable" and
-        # "beta" track the moving channels. beta is allowed to fail, see
-        # continue-on-error below. Raise the pinned list and rust-toolchain.toml
-        # together by hand.
-        rust: ["stable", "beta", "1.95", "1.94", "1.93", "1.92"]
+        # More extensive checks would be desirable, but we're running up against the g limits
+        rust: ["stable", "beta"]
         env:
           - name: ubuntu
             container: ""
-          - name: debian
-            container: "debian:12"
           - name: arch
             container: "archlinux:latest"
-          - name: alpine
-            container: "rust:1-alpine"
     name: test (${{ matrix.env.name }} / ${{ matrix.rust }})
     runs-on: ubuntu-latest
-    # beta tracks the upcoming release; an upstream regression there must not
-    # block the merge queue. ci-success counts a continued job as success.
     continue-on-error: ${{ matrix.rust == 'beta' }}
     container: ${{ matrix.env.container }}
     env:
       RUSTUP_TOOLCHAIN: ${{ matrix.rust }}
     steps:
-      - name: Prep (debian)
-        if: matrix.env.name == 'debian'
-        run: |
-          apt-get update
-          apt-get install -y --no-install-recommends \
-            git curl ca-certificates build-essential pkg-config libssl-dev
-
       - name: Prep (arch)
         if: matrix.env.name == 'arch'
         run: |
           pacman -Syu --noconfirm git curl base-devel openssl pkgconf
 
-      - name: Prep (alpine)
-        if: matrix.env.name == 'alpine'
-        shell: sh
-        run: |
-          apk add --no-cache git curl ca-certificates bash nodejs musl-dev
-
       - uses: actions/checkout@v7
 
       # Explicit per-version install: RUSTUP_TOOLCHAIN overrides

.github/workflows/ci-dependencies.yml

@@ -0,0 +1,25 @@
+name: "SYNC: dependencies <- master"
+
+on:
+  push:
+    branches: 
+      - master
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: sync-dependencies
+  cancel-in-progress: false
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: nerjs/branch-sync-action@master
+        with:
+          token: ${{ secrets.PUBLISH_TOKEN }}
+          base: master
+          head: dependencies