feat: replace cargo-make with just and modernize CI

.github/workflows/audit.yml

@@ -0,0 +1,28 @@
+name: Audit
+
+on:
+  schedule:
+    - cron: "0 6 * * 1"
+  push:
+    branches: [main]
+    paths: ["Cargo.toml", "deny.toml", ".github/workflows/audit.yml"]
+  pull_request:
+    paths: ["Cargo.toml", "deny.toml", ".github/workflows/audit.yml"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+
+jobs:
+  deny:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      # Runs `cargo deny --all-features check` against deny.toml, in a container
+      # that brings its own Rust and cargo-deny.
+      - uses: EmbarkStudios/cargo-deny-action@v2

.github/workflows/ci.yml

@@ -7,46 +7,65 @@ on:
   pull_request:
     paths-ignore: ["**.md"]
 
+permissions:
+  contents: read
+
 env:
   CARGO_TERM_COLOR: always
+  CARGO_INCREMENTAL: 0
+  RUST_BACKTRACE: 1
 
 concurrency:
   cancel-in-progress: true
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
 
 jobs:
-  check:
-    name: Check Suite
+  test:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout Repository
-        uses: actions/checkout@v7
+      - uses: actions/checkout@v7
+
+      # Installs the toolchain, sets up Swatinem/rust-cache and the problem
+      # matchers, and sets RUSTFLAGS to `-D warnings`.
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+
+      - uses: taiki-e/install-action@nextest
+
+      # `network-tests` calls the live Turnstile API with Cloudflare's dummy keys.
+      - run: cargo nextest run --features network-tests,idempotency
 
-      - name: Register Problem Matchers
-        uses: r7kamura/rust-problem-matchers@v1
+      # nextest does not run doctests.
+      - run: cargo test --doc --all-features
 
-      - run: rustup toolchain install stable --profile minimal
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
 
-      - name: Rust Cache
-        uses: Swatinem/rust-cache@v2
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          components: clippy, rustfmt
 
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
+      - run: cargo fmt --all --check
 
-      - name: Install Cargo Make
-        uses: davidB/rust-cargo-make@v1
+      - run: cargo clippy --all-targets --all-features -- -D warnings
 
-      - name: Install nextest
-        uses: taiki-e/install-action@nextest
+      - run: cargo doc --no-deps --all-features
+        env:
+          RUSTDOCFLAGS: -D warnings
 
-      - name: Run Formatter
-        run: cargo make format-ci
+  features:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
 
-      - name: Run Clippy
-        run: cargo make lint-ci
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
 
-      - name: Build
-        run: cargo build --release --all-features
+      - uses: taiki-e/install-action@cargo-hack
 
-      - name: Run Unit Tests
-        run: cargo make test-ci
+      # `--at-least-one-of` skips the TLS-less combinations that `compile_error!`.
+      # The excluded features only gate `#[cfg(test)]` code, which `check` skips.
+      - run: |
+          cargo hack check --feature-powerset \
+            --exclude-features integration,network-tests \
+            --at-least-one-of rustls-native-roots,rustls-webpki-roots,native-tls

.gitignore

@@ -1,3 +1,4 @@
 /target
 /Cargo.lock
 .env
+/lcov.info

deny.toml

@@ -0,0 +1,30 @@
+# Policy for `cargo deny`, run by `just audit` and .github/workflows/audit.yml.
+# https://embarkstudios.github.io/cargo-deny/
+
+[graph]
+# Each TLS backend pulls in a different subtree.
+all-features = true
+
+[advisories]
+# Accepted advisories go here, each with a note saying why.
+ignore = []
+
+[licenses]
+allow = [
+  "Apache-2.0",
+  "Apache-2.0 WITH LLVM-exception",
+  "BSD-3-Clause",
+  "CDLA-Permissive-2.0", # webpki-roots
+  "ISC",
+  "MIT",
+  "Unicode-3.0",
+]
+
+[bans]
+# Usually a transitive dependency's choice, so warn rather than fail.
+multiple-versions = "warn"
+wildcards = "deny"
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"

justfile

@@ -0,0 +1,66 @@
+# Development commands for cf-turnstile. Run `just` to list them and `just setup`
+# to install the tools they need.
+
+# The feature set CI tests with: the defaults plus the optional API surface.
+test_features := "network-tests,idempotency"
+
+# At least one of these is required for the crate to build.
+tls_backends := "rustls-native-roots,rustls-webpki-roots,native-tls"
+
+# List the available recipes.
+default:
+    @just --list
+
+# Run everything CI runs.
+verify: fmt-check lint test doc features audit
+
+# Build with all features enabled.
+build *args:
+    cargo build --all-features {{ args }}
+
+# Type-check the crate, its tests and its examples.
+check *args:
+    cargo check --all-targets --all-features {{ args }}
+
+# Format all code in place.
+fmt:
+    cargo fmt --all
+
+# Fail if anything is unformatted.
+fmt-check:
+    cargo fmt --all --check
+
+# Lint with clippy, denying warnings.
+lint *args:
+    cargo clippy --all-targets --all-features {{ args }} -- -D warnings
+
+# Run the tests and doctests. Needs network access.
+test *args:
+    cargo nextest run --features {{ test_features }} {{ args }}
+    cargo test --doc --all-features
+
+# Run only the tests that work offline.
+test-offline *args:
+    cargo nextest run {{ args }}
+
+# Verify a real token. Needs the TURNSTILE_* environment variables.
+test-integration:
+    cargo nextest run --features integration --no-capture test_integration
+
+# Check that every meaningful feature combination compiles.
+features:
+    cargo hack check --feature-powerset \
+        --exclude-features integration,network-tests \
+        --at-least-one-of {{ tls_backends }}
+
+# Build the docs, denying warnings.
+doc *args:
+    RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --all-features {{ args }}
+
+audit:
+    cargo deny check
+
+# Install the components and tools the other recipes need.
+setup:
+    rustup component add clippy rustfmt llvm-tools-preview
+    cargo install --locked cargo-nextest cargo-hack cargo-llvm-cov cargo-deny