Major update - DAYS 3 to 18

.cargo/config.toml

@@ -0,0 +1,2 @@
+[alias]
+xtask = "run --package xtask --"

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: cargo
+    directory: "/"
+    schedule:
+      interval: weekly
+  - package-ecosystem: cargo
+    directory: "/eck/fuzz"
+    schedule:
+      interval: weekly

.github/workflows/ci.yml

@@ -0,0 +1,85 @@
+name: CI
+
+on:
+  push:
+    branches: [dev, main]
+    paths-ignore:
+      - "doc/**"
+      - "**.md"
+  pull_request:
+    branches: [dev, main]
+    paths-ignore:
+      - "doc/**"
+      - "**.md"
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  # Static checks, tests, rustdoc, audit
+  checks:
+    name: fmt · clippy · test · doc · audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+
+      - uses: Swatinem/rust-cache@v2
+
+      - name: Check formatting
+        run: cargo fmt --all -- --check
+
+      - name: Clippy (all targets, warnings as errors)
+        run: cargo clippy --all-targets -- -D warnings
+
+      - name: Run tests (eck_tests harness)
+        run: cargo xtask test
+
+      - name: Build rustdoc (warnings as errors)
+        run: RUSTDOCFLAGS="-D warnings" cargo doc --no-deps
+
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --locked
+
+      - name: cargo audit (allowlist in audit.toml)
+        run: cargo audit
+
+  # Bounded fuzz smoke (blocking)
+  fuzz:
+    name: fuzz smoke (${{ matrix.target }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [decompress, compress_roundtrip, metadata]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@nightly
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: eck/fuzz
+
+      - name: Install cargo-fuzz
+        run: cargo install cargo-fuzz --locked
+
+      - name: Fuzz smoke — ${{ matrix.target }}
+        run: cargo +nightly xtask fuzz ${{ matrix.target }} -- -max_total_time=60
+
+  # OS keyring roundtrip (macOS only)
+  keyring:
+    name: OS keyring roundtrip (macOS)
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: Swatinem/rust-cache@v2
+
+      - name: Keyring roundtrip (#[ignore]d test)
+        run: cargo test --test=eck_tests encrypt_decrypt_os_keytype_roundtrip -- --ignored

.github/workflows/release.yml

@@ -0,0 +1,108 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  build:
+    name: ${{ matrix.name }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: linux-x86_64
+            os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+            bin: eck
+            suffix: ""
+          - name: linux-aarch64
+            os: ubuntu-24.04-arm
+            target: aarch64-unknown-linux-gnu
+            bin: eck
+            suffix: ""
+          - name: macos-x86_64
+            os: macos-13
+            target: x86_64-apple-darwin
+            bin: eck
+            suffix: ""
+          - name: macos-arm64
+            os: macos-latest
+            target: aarch64-apple-darwin
+            bin: eck
+            suffix: ""
+          - name: windows-x86_64
+            os: windows-latest
+            target: x86_64-pc-windows-msvc
+            bin: eck.exe
+            suffix: ".exe"
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - uses: Swatinem/rust-cache@v2
+
+      - name: Build release binary
+        run: cargo build --release --target ${{ matrix.target }}
+
+      - name: Upload binary artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: eck-${{ matrix.target }}${{ matrix.suffix }}
+          path: target/${{ matrix.target }}/release/${{ matrix.bin }}
+          if-no-files-found: error
+
+  # ---- Draft GitHub release with checksums ----
+  release:
+    name: Draft release
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download all build artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+          merge-multiple: true
+
+      - name: Generate checksums
+        run: |
+          cd artifacts
+          for f in *; do
+            sha256sum "$f" > "$f.sha256"
+          done
+          ls -la
+
+      - name: Create draft release
+        uses: softprops/action-gh-release@v2
+        with:
+          draft: true
+          generate_release_notes: true
+          files: |
+            artifacts/*
+          body: |
+            ## Enkryptit! ${{ github.ref_name }}
+
+            > [!WARNING]
+            > Gatekeeper note (macOS)
+            > Release binaries are **not notarized/signed**. On first launch macOS may
+            > warn "cannot be opened because the developer cannot be verified".
+            > Workarounds: right-click => *Open*, or from a terminal:
+            > `xattr -dr com.apple.quarantine eck`
+            >
+            > Windows: SmartScreen may show an "unrecognized app" warning — click
+            > *More info : Run anyway*.
+
+            Checksums are provided as `*.sha256` files next to each binary.

.gitignore

@@ -1,5 +1,20 @@
 # Rust :
 /target
+/supply-chain
+
+# eck (Enkryptit!) :
+/eck/target
+
+# xtask :
+/xtask/target
+
+# eck fuzz (cargo-fuzz) :
+/eck/fuzz/target
+/eck/fuzz/corpus
+/eck/fuzz/artifacts
 
 # MacOS :
-.DS_Store
+.DS_Store
+
+# My personal checklist
+TODO.md

CONTRIBUTING.md

@@ -72,15 +72,17 @@ Contributors should be able to explain:
 
 For Enkryptit!, human review and security awareness take precedence over development speed.
 
-## Code Style
+## Code
 
 General expectations:
 
-* Follow idiomatic Rust practices.
+* Follow idiomatic Rust practices (`cargo fmt` and `cargo clippy`)
 * Prefer readable and maintainable code.
 * Avoid unnecessary complexity.
 * Add comments when the intent is not obvious.
+* Document your contribution with **RustDoc** comments.
 * Keep public APIs consistent and well documented.
+* Launch `cargo audit` before and after coding.
 
 Additional coding guidelines may be added as the project evolves.