ci: adopt the fleet reusable workflow

.github/workflows/ci.yml

@@ -6,44 +6,33 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
+# Retained for the repo-specific jobs BELOW `ci:` only — a called workflow does
+# not inherit the caller's `env:`, so this block governs nothing in `ci:`. The
+# old ci.yml ran the coverage/package/geiger jobs under `-D warnings`; dropping
+# it here would quietly relax them.
 env:
   CARGO_TERM_COLOR: always
   RUSTFLAGS: -D warnings
 
 jobs:
-  fmt:
-    name: Format
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          components: rustfmt
-      - run: cargo fmt --check
+  ci:
+    uses: SecurityRonin/fleet-ci/.github/workflows/rust-ci.yml@f9802dca64a95eb881fd05dd3f4f16e53b97f2b3
+    with:
+      # The old coverage job gated on FUNCTIONS (`--fail-under-functions 100`),
+      # which no input here can express — a line gate is a different assertion,
+      # and inheriting the `strict` default would impose a 100%-LINE gate this
+      # repo has never met (measured 97.02% lines / 100% functions). The original
+      # job is preserved verbatim below; turning the shared one off keeps it the
+      # single coverage gate, exactly as before.
+      coverage-gate: "off"
 
-  clippy:
-    name: Clippy
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          components: clippy
-      - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8
-      - run: cargo clippy --all-targets --all-features -- -D warnings
-
-  test:
-    name: Test (${{ matrix.os }})
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8
-      - run: cargo test # default features
-      - run: cargo test --all-features # serde JSON output
+  # ---------------------------------------------------------------------------
+  # Copied VERBATIM from the pre-adoption ci.yml. Each expresses something the
+  # shared workflow has no input for.
+  # ---------------------------------------------------------------------------
 
   coverage:
     name: Coverage
@@ -62,36 +51,6 @@ jobs:
       # the function gate is the meaningful invariant.
       - run: cargo llvm-cov --all-features --fail-under-functions 100 --show-missing-lines
 
-  msrv:
-    name: MSRV (1.96)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: dtolnay/rust-toolchain@1.96.0
-      - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8
-      - run: cargo test --all-features
-
-  # The published libraries promise a LOW MSRV (a crates.io compatibility signal),
-  # distinct from the dev toolchain pin and the app's MSRV above. Build ONLY the
-  # libs against the floor; the CLI app legitimately requires the newer toolchain.
-  msrv-libs:
-    name: Library MSRV (1.80)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: dtolnay/rust-toolchain@1.80.0
-      - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8
-      - run: cargo build -p sqlite-core -p sqlite-forensic --all-features
-
-  deny:
-    name: cargo-deny
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: EmbarkStudios/cargo-deny-action@v2 # renovate: pin digest
-        with:
-          command: check
-
   # crates.io only gates description + license fields, not the README/LICENSE
   # files — assert every publishable crate actually packages both.
   package:
@@ -112,35 +71,6 @@ jobs:
             echo "✓ $p packages README.md + LICENSE"
           done
 
-  fuzz-check:
-    name: Fuzz targets compile (nightly)
-    runs-on: ubuntu-latest
-    # cargo-fuzz builds with the host nightly; warnings in its own deps must not
-    # fail the install, so this job does not deny warnings.
-    env:
-      RUSTFLAGS: ""
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: dtolnay/rust-toolchain@nightly
-      - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8
-      - run: cargo install cargo-fuzz
-      - run: cargo +nightly fuzz check
-
-  secrets:
-    name: Secret Scan (gitleaks)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          fetch-depth: 0
-      - name: Install gitleaks
-        run: |
-          VERSION=$(curl -s https://api.github.com/repos/gitleaks/gitleaks/releases/latest | jq -r '.tag_name[1:]')
-          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_linux_x64.tar.gz" \
-            | tar xz -C /tmp gitleaks
-      - name: Run gitleaks
-        run: /tmp/gitleaks detect --source .
-
   geiger:
     name: Unsafe Audit (cargo-geiger)
     runs-on: ubuntu-latest
@@ -151,12 +81,3 @@ jobs:
       - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8
       - run: cargo install cargo-geiger --locked
       - run: cargo geiger 2>&1 || true
-
-  docs:
-    name: Docs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8
-      - run: RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --all-features

supply-chain/audits.toml

@@ -9,32 +9,68 @@ user-id = 347968 # Albert Hui (h4x0r)
 start = "2026-07-11"
 end = "2027-08-01"
 
+[[trusted.ewf]]
+criteria = "safe-to-deploy"
+user-id = 347968 # Albert Hui (h4x0r)
+start = "2026-03-05"
+end = "2027-08-07"
+
 [[trusted.forensic-carve]]
 criteria = "safe-to-deploy"
 user-id = 347968 # Albert Hui (h4x0r)
 start = "2026-07-23"
 end = "2027-08-01"
 
+[[trusted.forensic-vfs]]
+criteria = "safe-to-deploy"
+user-id = 347968 # Albert Hui (h4x0r)
+start = "2026-07-07"
+end = "2027-08-07"
+
 [[trusted.forensicnomicon]]
 criteria = "safe-to-deploy"
 user-id = 347968 # Albert Hui (h4x0r)
 start = "2026-06-05"
-end = "2027-08-01"
+end = "2027-08-07"
 
 [[trusted.forensicnomicon-core]]
 criteria = "safe-to-deploy"
 user-id = 347968 # Albert Hui (h4x0r)
 start = "2026-06-28"
-end = "2027-08-01"
+end = "2027-08-07"
 
 [[trusted.forensicnomicon-data]]
 criteria = "safe-to-deploy"
 user-id = 347968 # Albert Hui (h4x0r)
 start = "2026-06-28"
-end = "2027-08-01"
+end = "2027-08-07"
+
+[[trusted.jsonguard]]
+criteria = "safe-to-deploy"
+user-id = 347968 # Albert Hui (h4x0r)
+start = "2026-05-21"
+end = "2027-08-07"
 
 [[trusted.protobuf-forensic-core]]
 criteria = "safe-to-deploy"
 user-id = 347968 # Albert Hui (h4x0r)
 start = "2026-07-11"
 end = "2027-08-01"
+
+[[trusted.safe-decode]]
+criteria = "safe-to-deploy"
+user-id = 347968 # Albert Hui (h4x0r)
+start = "2026-08-02"
+end = "2027-08-07"
+
+[[trusted.safe-read]]
+criteria = "safe-to-deploy"
+user-id = 347968 # Albert Hui (h4x0r)
+start = "2026-07-15"
+end = "2027-08-07"
+
+[[trusted.state-history-forensic]]
+criteria = "safe-to-deploy"
+user-id = 347968 # Albert Hui (h4x0r)
+start = "2026-06-16"
+end = "2027-08-07"