From a4d1e11f4d3f86915ab96daa367ad0e445a15bed Mon Sep 17 00:00:00 2001
From: JuliDi <julian@systemscape.de>
Date: Thu, 6 Aug 2026 15:07:05 +0200
Subject: [PATCH 1/3] Replace cargo-make with just and modernize CI

- Split the single job into test, lint and feature powerset jobs
- Use actions-rust-lang/setup-rust-toolchain, which sets up the toolchain,
  the cache and the problem matchers in one step
- Run doctests, which nextest skips
- Check every meaningful feature combination with cargo-hack
- Deny rustdoc warnings, and fix the bare URL in README.md this found
- Add a weekly cargo-deny audit workflow and deny.toml
- Add a justfile mirroring the CI commands, replacing Makefile.toml
---
 .github/workflows/audit.yml | 28 ++++++++++++
 .github/workflows/ci.yml    | 65 +++++++++++++++++----------
 .gitignore                  |  1 +
 Makefile.toml               | 78 --------------------------------
 deny.toml                   | 30 +++++++++++++
 justfile                    | 88 +++++++++++++++++++++++++++++++++++++
 6 files changed, 189 insertions(+), 101 deletions(-)
 create mode 100644 .github/workflows/audit.yml
 delete mode 100644 Makefile.toml
 create mode 100644 deny.toml
 create mode 100644 justfile

diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
new file mode 100644
index 0000000..ce0b8f6
--- /dev/null
+++ b/.github/workflows/audit.yml
@@ -0,0 +1,28 @@
+name: Audit
+
+on:
+  schedule:
+    - cron: "0 6 * * 1"
+  push:
+    branches: [main]
+    paths: ["Cargo.toml", "deny.toml", ".github/workflows/audit.yml"]
+  pull_request:
+    paths: ["Cargo.toml", "deny.toml", ".github/workflows/audit.yml"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+
+jobs:
+  deny:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      # Runs `cargo deny --all-features check` against deny.toml, in a container
+      # that brings its own Rust and cargo-deny.
+      - uses: EmbarkStudios/cargo-deny-action@v2
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d76160d..c648cc9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,46 +7,65 @@ on:
   pull_request:
     paths-ignore: ["**.md"]
 
+permissions:
+  contents: read
+
 env:
   CARGO_TERM_COLOR: always
+  CARGO_INCREMENTAL: 0
+  RUST_BACKTRACE: 1
 
 concurrency:
   cancel-in-progress: true
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
 
 jobs:
-  check:
-    name: Check Suite
+  test:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout Repository
-        uses: actions/checkout@v7
+      - uses: actions/checkout@v7
+
+      # Installs the toolchain, sets up Swatinem/rust-cache and the problem
+      # matchers, and sets RUSTFLAGS to `-D warnings`.
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+
+      - uses: taiki-e/install-action@nextest
+
+      # `network-tests` calls the live Turnstile API with Cloudflare's dummy keys.
+      - run: cargo nextest run --features network-tests,idempotency
 
-      - name: Register Problem Matchers
-        uses: r7kamura/rust-problem-matchers@v1
+      # nextest does not run doctests.
+      - run: cargo test --doc --all-features
 
-      - run: rustup toolchain install stable --profile minimal
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
 
-      - name: Rust Cache
-        uses: Swatinem/rust-cache@v2
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          components: clippy, rustfmt
 
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
+      - run: cargo fmt --all --check
 
-      - name: Install Cargo Make
-        uses: davidB/rust-cargo-make@v1
+      - run: cargo clippy --all-targets --all-features -- -D warnings
 
-      - name: Install nextest
-        uses: taiki-e/install-action@nextest
+      - run: cargo doc --no-deps --all-features
+        env:
+          RUSTDOCFLAGS: -D warnings
 
-      - name: Run Formatter
-        run: cargo make format-ci
+  features:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
 
-      - name: Run Clippy
-        run: cargo make lint-ci
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
 
-      - name: Build
-        run: cargo build --release --all-features
+      - uses: taiki-e/install-action@cargo-hack
 
-      - name: Run Unit Tests
-        run: cargo make test-ci
+      # `--at-least-one-of` skips the TLS-less combinations that `compile_error!`.
+      # The excluded features only gate `#[cfg(test)]` code, which `check` skips.
+      - run: |
+          cargo hack check --feature-powerset \
+            --exclude-features integration,network-tests \
+            --at-least-one-of rustls-native-roots,rustls-webpki-roots,native-tls
diff --git a/.gitignore b/.gitignore
index ffc3118..0a2a065 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 /target
 /Cargo.lock
 .env
+/lcov.info
diff --git a/Makefile.toml b/Makefile.toml
deleted file mode 100644
index ecb347b..0000000
--- a/Makefile.toml
+++ /dev/null
@@ -1,78 +0,0 @@
-[tasks.setup]
-script = '''
-    echo # things required for `cargo make test`
-    cargo install cargo-nextest
-
-    echo # things required by `cargo make coverage`
-    rustup component add llvm-tools-preview
-    cargo install cargo-llvm-cov
-'''
-
-[tasks.lint]
-install_crate = "clippy"
-command = "cargo"
-args = ["clippy", "--tests", "--examples", "--all-targets", "--all-features"]
-
-[tasks.lint-ci]
-install_crate = "clippy"
-command = "cargo"
-args = [
-  "clippy",
-  "--tests",
-  "--examples",
-  "--all-targets",
-  "--all-features",
-  "--",
-  "-D",
-  "warnings",
-]
-
-[tasks.format]
-install_crate = "rustfmt"
-command = "cargo"
-args = ["fmt", "--all"]
-
-[tasks.fmt]
-alias = "format"
-
-[tasks.format-ci]
-install_crate = "rustfmt"
-command = "cargo"
-args = ["fmt", "--all", "--", "--check"]
-
-
-[tasks.test]
-env = { "RUN_MODE" = "test", "RUST_LOG" = "info" }
-command = "cargo"
-args = ["nextest", "run", "--features", "network-tests", "${@}"]
-
-[tasks.test-ci]
-env = { "RUN_MODE" = "ci", "RUST_LOG" = "info" }
-command = "cargo"
-args = ["nextest", "run", "--features", "network-tests"]
-
-[tasks.cov]
-command = "cargo"
-env = { "RUN_MODE" = "test" }
-args = ["llvm-cov", "nextest", "${@}"]
-
-[tasks.cov-ci]
-command = "cargo"
-env = { "RUN_MODE" = "ci" }
-args = ["llvm-cov", "nextest", "--lcov", "--output-path", "lcov.info"]
-
-[tasks.docs]
-command = "cargo"
-args = ["doc", "--no-deps", "--all-features", "--document-private-items"]
-
-[tasks.docs-watch]
-command = "cargo"
-args = ["doc", "--no-deps", "--all-features", "--document-private-items"]
-watch = true
-
-[tasks.timings]
-script = '''
-    cargo clean
-    cargo build --release --quiet --timings
-	open /target/cargo-timings/cargo-timing.html
-'''
diff --git a/deny.toml b/deny.toml
new file mode 100644
index 0000000..7a2e98c
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,30 @@
+# Policy for `cargo deny`, run by `just audit` and .github/workflows/audit.yml.
+# https://embarkstudios.github.io/cargo-deny/
+
+[graph]
+# Each TLS backend pulls in a different subtree.
+all-features = true
+
+[advisories]
+# Accepted advisories go here, each with a note saying why.
+ignore = []
+
+[licenses]
+allow = [
+  "Apache-2.0",
+  "Apache-2.0 WITH LLVM-exception",
+  "BSD-3-Clause",
+  "CDLA-Permissive-2.0", # webpki-roots
+  "ISC",
+  "MIT",
+  "Unicode-3.0",
+]
+
+[bans]
+# Usually a transitive dependency's choice, so warn rather than fail.
+multiple-versions = "warn"
+wildcards = "deny"
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
diff --git a/justfile b/justfile
new file mode 100644
index 0000000..55254db
--- /dev/null
+++ b/justfile
@@ -0,0 +1,88 @@
+# Development commands for cf-turnstile. Run `just` to list them and `just setup`
+# to install the tools they need.
+
+# The feature set CI tests with: the defaults plus the optional API surface.
+test_features := "network-tests,idempotency"
+
+# At least one of these is required for the crate to build.
+tls_backends := "rustls-native-roots,rustls-webpki-roots,native-tls"
+
+# List the available recipes.
+default:
+    @just --list
+
+# Run everything CI runs.
+verify: fmt-check lint test doc features
+
+# Build with all features enabled.
+build *args:
+    cargo build --all-features {{ args }}
+
+# Type-check the crate, its tests and its examples.
+check *args:
+    cargo check --all-targets --all-features {{ args }}
+
+# Format all code in place.
+fmt:
+    cargo fmt --all
+
+# Fail if anything is unformatted.
+fmt-check:
+    cargo fmt --all --check
+
+# Lint with clippy, denying warnings.
+lint *args:
+    cargo clippy --all-targets --all-features {{ args }} -- -D warnings
+
+# Run the tests and doctests. Needs network access.
+test *args:
+    cargo nextest run --features {{ test_features }} {{ args }}
+    cargo test --doc --all-features
+
+# Run only the tests that work offline.
+test-offline *args:
+    cargo nextest run {{ args }}
+
+# Verify a real token. Needs the TURNSTILE_* environment variables.
+test-integration:
+    cargo nextest run --features integration --no-capture test_integration
+
+# Check that every meaningful feature combination compiles.
+features:
+    cargo hack check --feature-powerset \
+        --exclude-features integration,network-tests \
+        --at-least-one-of {{ tls_backends }}
+
+# Build the docs, denying warnings.
+doc *args:
+    RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --all-features {{ args }}
+
+# Build the docs and open them in a browser.
+doc-open: (doc "--open")
+
+# Report test coverage in the terminal.
+cov *args:
+    cargo llvm-cov nextest --features {{ test_features }} {{ args }}
+
+# Write an lcov coverage report to lcov.info.
+cov-lcov:
+    cargo llvm-cov nextest --features {{ test_features }} --lcov --output-path lcov.info
+
+# Check dependencies for advisories, disallowed licenses and banned crates.
+audit:
+    cargo deny check
+
+# Install the components and tools the other recipes need.
+setup:
+    rustup component add clippy rustfmt llvm-tools-preview
+    cargo install --locked cargo-nextest cargo-hack cargo-llvm-cov cargo-deny
+
+# Profile a clean release build.
+timings:
+    cargo clean
+    cargo build --release --all-features --timings
+    @echo "Report written to target/cargo-timings/cargo-timing.html"
+
+# Remove build artifacts.
+clean:
+    cargo clean

From e350ae33b4cdc3d6105218ae141a04f5893139c7 Mon Sep 17 00:00:00 2001
From: JuliDi <julian@systemscape.de>
Date: Fri, 7 Aug 2026 09:51:00 +0200
Subject: [PATCH 2/3] remove coverage commands from justfile, not necessary

---
 justfile | 22 ----------------------
 1 file changed, 22 deletions(-)

diff --git a/justfile b/justfile
index 55254db..4779dec 100644
--- a/justfile
+++ b/justfile
@@ -57,18 +57,6 @@ features:
 doc *args:
     RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --all-features {{ args }}
 
-# Build the docs and open them in a browser.
-doc-open: (doc "--open")
-
-# Report test coverage in the terminal.
-cov *args:
-    cargo llvm-cov nextest --features {{ test_features }} {{ args }}
-
-# Write an lcov coverage report to lcov.info.
-cov-lcov:
-    cargo llvm-cov nextest --features {{ test_features }} --lcov --output-path lcov.info
-
-# Check dependencies for advisories, disallowed licenses and banned crates.
 audit:
     cargo deny check
 
@@ -76,13 +64,3 @@ audit:
 setup:
     rustup component add clippy rustfmt llvm-tools-preview
     cargo install --locked cargo-nextest cargo-hack cargo-llvm-cov cargo-deny
-
-# Profile a clean release build.
-timings:
-    cargo clean
-    cargo build --release --all-features --timings
-    @echo "Report written to target/cargo-timings/cargo-timing.html"
-
-# Remove build artifacts.
-clean:
-    cargo clean

From c16d5e1122f3418fec41ba8b22c0eb96241b1c48 Mon Sep 17 00:00:00 2001
From: JuliDi <julian@systemscape.de>
Date: Fri, 7 Aug 2026 09:51:57 +0200
Subject: [PATCH 3/3] run audit as part of just verify

---
 justfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/justfile b/justfile
index 4779dec..47eb42a 100644
--- a/justfile
+++ b/justfile
@@ -12,7 +12,7 @@ default:
     @just --list
 
 # Run everything CI runs.
-verify: fmt-check lint test doc features
+verify: fmt-check lint test doc features audit
 
 # Build with all features enabled.
 build *args: