Develop

.github/actions/setup-synapsis/action.yml

@@ -0,0 +1,16 @@
+name: Setup Synapsis
+description: Checkout synapsis-core sibling dep and patch Cargo.toml for CI
+
+runs:
+  using: composite
+  steps:
+    - name: Patch sibling deps for CI
+      shell: bash
+      run: |
+        mkdir -p deps
+        sed -i.bak 's|\.\./synapsis-core|deps/synapsis-core|g' Cargo.toml
+        sed -i.bak '/^\[patch.*Arca\]/,/^$/d' Cargo.toml
+    - uses: actions/checkout@v4
+      with:
+        repository: MethodWhite/synapsis-core
+        path: deps/synapsis-core

.github/workflows/ci.yml

@@ -4,7 +4,7 @@ on:
   push:
     branches: [main, develop]
   pull_request:
-    branches: [main]
+    branches: [main, develop]
 
 permissions:
   contents: read
@@ -16,18 +16,20 @@ env:
 
 jobs:
   test:
-    name: Test (${{ matrix.os }})
+    name: Test (Linux / macOS)
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        os: [ubuntu-latest, macos-latest]
     runs-on: ${{ matrix.os }}
-    timeout-minutes: 45
+    timeout-minutes: 60
     steps:
       - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-synapsis
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
-      - run: cargo test -- --test-threads=1
+      - name: Run tests
+        run: cargo test -- --test-threads=1
         env:
           RUST_BACKTRACE: 1
       - uses: actions/upload-artifact@v4
@@ -36,12 +38,27 @@ jobs:
           name: test-output-${{ matrix.os }}
           path: /tmp/synapsis-test.log
 
+  test-windows:
+    name: Test (Windows)
+    runs-on: windows-latest
+    timeout-minutes: 60
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - name: Build check (Windows)
+        run: cargo check --all-targets
+        env:
+          RUST_BACKTRACE: 1
+
   fmt:
     name: Format
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-synapsis
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt
@@ -53,6 +70,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-synapsis
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy
@@ -64,6 +82,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-synapsis
       - uses: dtolnay/rust-toolchain@1.95.0
       - run: cargo check
 
@@ -81,8 +100,10 @@ jobs:
     name: Security audit
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    continue-on-error: true
     steps:
       - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-synapsis
       - uses: rustsec/audit-check@v2.0.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -94,13 +115,34 @@ jobs:
     continue-on-error: true
     steps:
       - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-synapsis
       - uses: dtolnay/rust-toolchain@stable
       - uses: taiki-e/install-action@v2
         with:
           tool: cargo-deny
       - name: Check licenses and advisories
         run: cargo deny check
 
+  sbom:
+    name: SBOM (Supply Chain)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-synapsis
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Generate CycloneDX SBOM
+        run: |
+          cargo install cargo-cyclonedx 2>/dev/null || true
+          cargo cyclonedx 2>/dev/null || echo "SBOM generation skipped"
+      - name: Upload SBOM
+        uses: actions/upload-artifact@v4
+        with:
+          name: sbom
+          path: "*.cdx.*"
+        continue-on-error: true
+
   secrets:
     name: Gitleaks (Secret Scanning)
     runs-on: ubuntu-latest
@@ -120,9 +162,8 @@ jobs:
     continue-on-error: true
     steps:
       - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-synapsis
       - uses: dtolnay/rust-toolchain@stable
-      - name: Clean cargo cache
-        run: cargo clean
       - uses: taiki-e/install-action@v2
         with:
           tool: cargo-geiger
@@ -131,37 +172,11 @@ jobs:
           cargo geiger --output-format GitHub --update-readme || true
           cargo geiger --output-format Json > geiger-report.json || true
           cargo geiger --deny-warn --manifest-path Cargo.toml || true
-  codeql:
-    name: CodeQL
-    runs-on: ubuntu-latest
-    timeout-minutes: 75
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-    strategy:
-      fail-fast: false
-      matrix:
-        language: ['rust']
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
-        with:
-          languages: ${{ matrix.language }}
-          queries: security-extended
-      - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
-        with:
-          category: "/language:${{ matrix.language }}"
 
   ci-status:
     name: ci
     if: always()
-    needs: [test, fmt, clippy, msrv, actionlint, security, secrets, geiger, codeql]
+    needs: [test, test-windows, fmt, clippy, msrv, actionlint, security, secrets, geiger]
     runs-on: ubuntu-latest
     permissions:
       contents: read

.github/workflows/osv-scanner.yml

@@ -30,17 +30,16 @@ permissions:
 jobs:
   scan-scheduled:
     if: ${{ github.event_name == 'push' || github.event_name == 'schedule' }}
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.8"
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v1.9.2"
     with:
       scan-args: |-
         -r
         --skip-git
         ./
   scan-pr:
     if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }}
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.3.8"
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v1.9.2"
     with:
-      # Example of specifying custom arguments
       scan-args: |-
         -r
         --skip-git

.gitignore

@@ -27,6 +27,9 @@ dist/
 *.log
 synapsis_*.log
 
+# Local cargo config (generated by scripts/dev-setup.sh)
+.cargo/
+
 # Keep Cargo.lock committed for reproducible builds
 crates/core
 __pycache__/