ci: migrate project automation to Just (#442)

* ci: migrate project automation to Just

Centralize build, test, release, dependency, hook, and website commands in Just recipes. Pin workflow tooling, use the repository toolchain, and run the complete validation set in CI.

* ci: codex being codex

* docs: update CLAUDE.md for just task runner migration

Reflect the switch to just recipes for build/test/clippy/fmt, note
dprint replacing raw rustfmt, and add a cross-platform code requirement.

* fix: resolve clippy warnings breaking CI on ubuntu and windows

Use clone() instead of implicit to_string() on already-owned String
values, gate the windows-only unused make_file_at import behind
cfg(posix), and fix unused mut / manual assign-op in the windows-only
localhost test.

* fix: fmt

.github/ISSUE_TEMPLATE/bug_report.md

@@ -4,7 +4,6 @@ about: Create a report of the bug you've encountered
 title: "[BUG] - ISSUE_TITLE"
 labels: bug
 assignees: veeso
-
 ---
 
 ## Description

.github/ISSUE_TEMPLATE/copy.md

@@ -4,7 +4,6 @@ about: Report a typo/error in a repository document
 title: "[COPY] - ISSUE_TITLE"
 labels: documentation
 assignees: veeso
-
 ---
 
 ## Report

.github/ISSUE_TEMPLATE/feature_request.md

@@ -4,7 +4,6 @@ about: Suggest an idea to improve termscp
 title: "[Feature Request] - FEATURE_TITLE"
 labels: "new feature"
 assignees: veeso
-
 ---
 
 ## Description

.github/ISSUE_TEMPLATE/question.md

@@ -4,5 +4,4 @@ about: Ask what you want about the project
 title: "[QUESTION] - TITLE"
 labels: question
 assignees: veeso
-
 ---

.github/ISSUE_TEMPLATE/security.md

@@ -4,7 +4,6 @@ about: Create a report of a security vulnerability
 title: "[SECURITY] - ISSUE_TITLE"
 labels: security
 assignees: veeso
-
 ---
 
 ## Description

.github/PULL_REQUEST_TEMPLATE.md

@@ -29,12 +29,12 @@ Please select relevant options.
 - [ ] I formatted the code with `cargo fmt`
 - [ ] I checked my code using `cargo clippy` and reports no warnings
 - [ ] I have added tests that prove my fix is effective or that my feature works
-- [ ] I have introduced no new *C-bindings*
+- [ ] I have introduced no new _C-bindings_
 - [ ] The changes I've made are Windows, MacOS, UNIX, Linux compatible (or I've handled them using `cfg target_os`)
 - [ ] I increased or maintained the code coverage for the project, compared to the previous commit
 
 ## Acceptance tests
 
-wait for a *project maintainer* to fulfill this section...
+wait for a _project maintainer_ to fulfill this section...
 
 - [ ] regression test: ...

.github/workflows/ci.yml

@@ -5,12 +5,12 @@ on:
     branches: [main]
     paths-ignore:
       - "*.md"
-      - "./site/**/*"
+      - "site/**"
   push:
     branches: [main]
     paths-ignore:
       - "*.md"
-      - "./site/**/*"
+      - "site/**"
 
 env:
   CARGO_TERM_COLOR: always
@@ -19,50 +19,120 @@ permissions:
   contents: read
 
 jobs:
-  build:
-    name: build-(${{ matrix.os }})
+  toolchain:
+    runs-on: ubuntu-latest
+    outputs:
+      channel: ${{ steps.extract.outputs.result }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Extract toolchain channel from rust-toolchain.toml
+        id: extract
+        uses: mikefarah/yq@c14f446382944492701b16c1ddb48bb9dbe683e3 # v4.53.6
+        with:
+          cmd: yq '.toolchain.channel' rust-toolchain.toml
+
+  fmt:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install Rust (nightly)
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        with:
+          toolchain: nightly
+          components: rustfmt
+      - name: Check formatting
+        uses: dprint/check@9cb3a2b17a8e606d37aae341e49df3654933fc23 # v2.3
+
+  install-scripts:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install just
+        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
+      - name: Check install scripts
+        run: just check_install_scripts
+
+  crates:
+    needs: toolchain
+    name: crates-${{ matrix.os }}
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install Linux dependencies
         if: runner.os == 'Linux'
-        run: sudo apt update && sudo apt install -y libdbus-1-dev libsmbclient-dev
+        run: sudo apt-get update && sudo apt-get install -y libdbus-1-dev libsmbclient-dev
       - name: Install macOS dependencies
         if: runner.os == 'macOS'
         run: |
           brew update
           brew install \
-          pkg-config \
-          samba
+            pkg-config \
+            samba
           brew link --force samba
-      - name: Install nightly toolchain
-        if: runner.os == 'Linux'
-        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
-          toolchain: nightly
-          components: rustfmt
-      - name: Format
-        if: runner.os == 'Linux'
-        run: cargo +nightly fmt --all -- --check
-      - name: Install stable toolchain
-        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
-        with:
-          toolchain: stable
+          toolchain: ${{ needs.toolchain.outputs.channel }}
           components: clippy
+      - name: Install just
+        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
       - name: Build
-        if: runner.os != 'Linux'
-        run: cargo build
-      - name: Run tests (Linux)
+        run: just build_crates
+      - name: Test (Linux)
         if: runner.os == 'Linux'
-        run: cargo test --no-default-features --features github-actions --no-fail-fast
-      - name: Run tests
+        run: just test "--no-default-features --features github-actions --no-fail-fast"
+      - name: Test
         if: runner.os != 'Linux'
-        run: cargo test --verbose --features github-actions
+        run: just test "--verbose --features github-actions"
       - name: Clippy
-        run: cargo clippy -- -Dwarnings
+        run: just clippy "-- -D warnings"
+
+  doc:
+    needs: toolchain
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install Linux dependencies
+        run: sudo apt-get update && sudo apt-get install -y libdbus-1-dev libsmbclient-dev
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        with:
+          toolchain: ${{ needs.toolchain.outputs.channel }}
+      - name: Install just
+        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
+      - name: Build documentation
+        run: just doc
+
+  deny:
+    needs: toolchain
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        with:
+          toolchain: ${{ needs.toolchain.outputs.channel }}
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@37f7c5781271959fb65b6b35224e28652ff2b63d # v2.87.0
+        with:
+          tool: cargo-deny
+      - name: Install just
+        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
+      - name: Check dependencies
+        run: just deny

.github/workflows/install.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install termscp from script

.github/workflows/pages.yml

@@ -26,7 +26,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install mdBook
@@ -58,9 +58,9 @@ jobs:
           <a href="./en-US/">termscp documentation</a>
           HTML
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: site_out
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

.github/workflows/release.yml

@@ -22,23 +22,35 @@ jobs:
     outputs:
       version: ${{ inputs.version }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           token: ${{ secrets.RELEASE_PAT }}
           persist-credentials: true
           fetch-depth: 0
           fetch-tags: true
 
+      - name: Validate version
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          if [[ ! "$VERSION" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
+            echo "invalid release version: $VERSION (expected MAJOR.MINOR.PATCH)" >&2
+            exit 2
+          fi
+
       - name: Configure git identity
         run: |
           git config user.name "veeso"
           git config user.email "christian.visintin@veeso.dev"
 
       - name: Install git-cliff
-        uses: taiki-e/install-action@56545b37b57562edd73171cb6c62cc509db4c34e # v2
+        uses: taiki-e/install-action@37f7c5781271959fb65b6b35224e28652ff2b63d # v2.87.0
         with:
           tool: git-cliff
 
+      - name: Install just
+        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
+
       - name: Bump version
         env:
           VERSION: ${{ inputs.version }}
@@ -47,7 +59,7 @@ jobs:
       - name: Generate CHANGELOG
         env:
           VERSION: ${{ inputs.version }}
-        run: git-cliff --tag "v$VERSION" -o CHANGELOG.md
+        run: just changelog "$VERSION"
 
       - name: Generate release notes
         env:
@@ -55,7 +67,7 @@ jobs:
         run: git-cliff --unreleased --tag "v$VERSION" --strip header -o RELEASE_NOTES.md
 
       - name: Upload release notes
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: release-notes
           path: RELEASE_NOTES.md
@@ -111,15 +123,20 @@ jobs:
       TARGET: ${{ matrix.target }}
       FEATURES: ${{ matrix.features }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.dry_run && github.sha || 'main' }}
           persist-credentials: false
           fetch-depth: 0
           fetch-tags: true
-      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
-        with:
-          targets: ${{ matrix.target }}
+      - name: Install just
+        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
+      - name: Install Rust target
+        if: matrix.kind != 'windows'
+        run: rustup target add "$TARGET"
+      - name: Install Rust target
+        if: matrix.kind == 'windows'
+        run: rustup target add "$env:TARGET"
 
       # ---- Linux: native per-arch build (x86_64 on ubuntu-latest, aarch64 on ubuntu-24.04-arm) ----
       - name: Install dependencies (Linux)
@@ -156,10 +173,10 @@ jobs:
           cargo install cargo-deb
       - name: Build (Linux)
         if: matrix.kind == 'linux'
-        run: cargo build --release --features smb-vendored --target "$TARGET"
+        run: just build_release "$TARGET" "--features smb-vendored"
       - name: Build deb (Linux)
         if: matrix.kind == 'linux'
-        run: cargo deb --no-build --target "$TARGET" --features smb-vendored
+        run: just package_deb "$TARGET"
 
       # ---- macOS ----
       - name: Install deps (macOS)
@@ -173,12 +190,12 @@ jobs:
           cpanm Parse::Yapp::Driver
       - name: Build (macOS)
         if: matrix.kind == 'macos'
-        run: cargo build --release $FEATURES --target "$TARGET"
+        run: just build_release "$TARGET" "$FEATURES"
 
       # ---- Windows ----
       - name: Build (Windows)
         if: matrix.kind == 'windows'
-        run: cargo build --release --features smb-vendored --target "$env:TARGET"
+        run: just build_release "$env:TARGET" "--features smb-vendored"
 
       # ---- Package posix (tar.gz) ----
       - name: Package (posix)
@@ -204,7 +221,7 @@ jobs:
         run: cp target/"$TARGET"/debian/*.deb artifact/
 
       - name: Upload build artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: build-${{ matrix.target }}
           path: artifact/*
@@ -218,14 +235,14 @@ jobs:
       VERSION: ${{ needs.prepare.outputs.version }}
     steps:
       - name: Download build artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: build-*
           path: dl
           merge-multiple: true
 
       - name: Checkout homebrew tap
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: veeso/homebrew-termscp
           token: ${{ secrets.RELEASE_PAT }}
@@ -316,21 +333,21 @@ jobs:
     env:
       VERSION: ${{ needs.prepare.outputs.version }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           token: ${{ secrets.RELEASE_PAT }}
           ref: ${{ inputs.dry_run && github.sha || 'main' }}
           persist-credentials: true
 
       - name: Download build artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: build-*
           path: dl
           merge-multiple: true
 
       - name: Download release notes
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: release-notes
           path: notes
@@ -355,7 +372,7 @@ jobs:
 
       - name: Upload assets artifact (dry run)
         if: ${{ inputs.dry_run }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: release-assets-dryrun
           path: out/*
@@ -380,13 +397,14 @@ jobs:
     env:
       VERSION: ${{ needs.prepare.outputs.version }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
           persist-credentials: false
           fetch-depth: 0
           fetch-tags: true
-      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+      - name: Install just
+        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
 
       - name: Install dependencies (Linux)
         run: |
@@ -421,12 +439,12 @@ jobs:
 
       - name: Authenticate to crates.io
         id: auth
-        uses: rust-lang/crates-io-auth-action@bbd81622f20ce9e2dd9622e3218b975523e45bbe # v1.0.4
+        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
 
       - name: Publish to crates.io
         env:
           CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
-        run: cargo publish --features smb-vendored
+        run: just publish_crate
 
   publish-choco:
     needs: [prepare, release]

.github/workflows/site.yml

@@ -9,30 +9,28 @@ on:
 permissions:
   contents: read
 
-defaults:
-  run:
-    working-directory: site
-
 jobs:
   build-site:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: npm
           cache-dependency-path: site/package-lock.json
+      - name: Install just
+        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
       - name: Install dependencies
-        run: npm ci
+        run: just site_install
       - name: Format
-        run: npm run format:check
+        run: just site_fmt_check
       - name: Lint
-        run: npm run check
+        run: just site_check
       - name: Test
-        run: npm test --if-present
+        run: just site_test
       - name: Build
-        run: npm run build
+        run: just site_build

.github/workflows/stale.yml

@@ -13,7 +13,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/stale@a20b814fb01b71def3bd6f56e7494d667ddf28da # v4.1.1
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
         with:
           days-before-issue-stale: 30
           days-before-issue-close: 7