key-vault 1.0.0

Enterprise-grade key management vault for Rust. 9-layer defense-in-depth: fragmentation, decoy bytes, codex transform, mlock + zeroize, constant-time ops, security monitoring. Pluggable key fetchers (TPM, keychain, file, env). Sub-microsecond access. REPS-compliant.
Documentation
name: CI

on:
  push:
    branches: [main, dev]
  pull_request:
    branches: [main, dev]

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: "-D warnings"

jobs:
  check:
    name: Check
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        rust: [stable, "1.85.0"]
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ matrix.rust }}
          components: clippy, rustfmt
      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.os }}-${{ matrix.rust }}
      - run: cargo fmt --all -- --check
      - run: cargo clippy --all-targets --all-features -- -D warnings
      - run: cargo test --all-features
      - run: cargo doc --no-deps --all-features
        env:
          RUSTDOCFLAGS: "-D warnings"

  # Supply-chain checks. REPS §Dependency Management requires both
  # `cargo audit` (RustSec advisory database) and `cargo deny check`
  # (license / source / version policy) in CI. We use
  # `taiki-e/install-action` which installs precompiled binaries —
  # this sidesteps the compile-from-source MSRV churn that
  # `rustsec/audit-check@v2` runs into when transitive deps of
  # `cargo-audit` bump their own MSRV ahead of the runner's stable
  # toolchain.
  supply-chain:
    name: Supply-chain audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          key: supply-chain
      - name: Install cargo-audit + cargo-deny (precompiled)
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-audit,cargo-deny
      - name: cargo audit
        run: cargo audit
      - name: cargo deny
        run: cargo deny --all-features check