lens3329 0.2.1

Cryptographic inventory scanner: crypto library discovery, lockfile version resolution (Cargo/npm/PyPI), offline advisory/CVE correlation, and CycloneDX CBOM / SARIF export.
Documentation
name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: always
  # Warnings are now errors everywhere. The tree is rustc-clean, clippy-clean and
  # rustfmt-clean as of this commit, so the ratchet starts here: the cost of
  # keeping it that way is one lint at a time, and the cost of not doing so is
  # the 21-lint backlog this just cleared.
  #
  # Note the trade-off this accepts: `dtolnay/rust-toolchain@stable` floats, so a
  # new stable release that adds or widens a lint will fail CI on a commit that
  # changed nothing. That is the intended alarm, not a malfunction — fix the lint,
  # or pin the toolchain here if the interruptions outweigh the discipline.
  RUSTFLAGS: -D warnings

jobs:
  # Portability is a product claim, so prove it on every push. There is no
  # assembly and no build.rs here, so one build configuration covers all three.
  test:
    name: test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Build
        run: cargo build --locked --all-targets
      - name: Test
        run: cargo test --locked

  # The library must stay usable without the CLI/TUI stack — this is what the
  # `cli` feature gate exists to guarantee, and what the hosted backend consumes.
  lib-only:
    name: lib-only (no default features)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo check --locked --no-default-features
      - run: cargo test --locked --no-default-features

  # Catch metadata problems here rather than at `cargo publish` time.
  package:
    name: package
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - run: cargo package --locked

  # Blocking since the formatting and lint backlog inherited from the monorepo
  # was cleared. It was advisory until then because reformatting during the
  # extraction would have destroyed the verbatim-move property that made the
  # port reviewable; that constraint is spent, so the job enforces now.
  style:
    name: style
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@v2
      - name: rustfmt
        run: cargo fmt --check
      - name: clippy
        run: cargo clippy --locked --all-targets