ci: add automated checks and contributor workflows

.github/dependabot.yml

@@ -0,0 +1,10 @@
+# Set update schedule for GitHub Actions
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      # Check for updates to GitHub Actions every week
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/pull_request_template.md

@@ -0,0 +1,20 @@
+<!-- You can erase any parts of this template not applicable to your Pull Request. -->
+
+### Description
+
+<!-- Describe the purpose of this PR, what's being adding and/or fixed -->
+
+### Notes to the reviewers
+
+<!-- In this section you can include notes directed to the reviewers, like explaining why some parts
+of the PR were done in a specific way -->
+
+### Changelog notice
+
+<!-- Notice the release manager should include in the release tag message changelog -->
+<!-- See https://keepachangelog.com/en/1.0.0/ for examples -->
+
+### Before submitting
+
+- [ ] I followed the [contribution guidelines](https://github.com/bitcoindevkit/electrum_streaming_client/blob/master/CONTRIBUTING.md)
+- [ ] This PR breaks the existing API

.github/workflows/audit.yml

@@ -0,0 +1,38 @@
+name: Audit
+
+# Audits the committed Cargo.lock against RustSec nightly, after dependency
+# or audit configuration changes on master, and on manual dispatch.
+# On master, creates or updates issues for findings and closes resolved ones.
+# Findings are tracked through issues; this workflow is not a PR gate.
+
+on:
+  push:
+    branches: [master]
+    paths:
+      - ".github/workflows/audit.yml"
+      - "**/Cargo.toml"
+      - "**/Cargo.lock"
+      - "**/audit.toml"
+  schedule:
+    - cron: "0 0 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  audit:
+    name: Audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      issues: write # Create and close advisory issues.
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Audit Rust dependencies
+        uses: actions-rust-lang/audit@72c09e02f132669d52284a3323acdb503cfc1a24 # v1.2.7

.github/workflows/code_coverage.yml

@@ -0,0 +1,80 @@
+name: Code Coverage
+
+# Combines coverage from both feature configurations, including doctests and
+# branches. LCOV and HTML reports are saved as an artifact; Codecov upload
+# errors do not fail the job. Public fork PRs can upload without a token.
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+env:
+  CARGO_TERM_COLOR: always
+  RUST_BACKTRACE: "1"
+
+jobs:
+  Coverage:
+    name: Coverage
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
+        with:
+          toolchain: nightly-2026-09-01
+          components: llvm-tools-preview
+          cache: true
+          cache-key: coverage
+          rustflags: ""
+
+      - name: Install cargo-llvm-cov
+        uses: taiki-e/install-action@d438492cf8a250514fa2d34b30bc3c0dc37c65ff # v2.87.8
+        with:
+          tool: cargo-llvm-cov@0.9.1
+
+      - name: Generate coverage
+        run: |
+          cargo llvm-cov clean --workspace
+
+          cargo llvm-cov --locked --no-default-features \
+            --no-report --doctests --branch
+          cargo llvm-cov --locked --all-features \
+            --no-report --doctests --branch
+
+          cargo llvm-cov report --doctests --branch \
+            --lcov --output-path lcov.info
+          cargo llvm-cov report --doctests --branch --html
+
+      - name: Upload coverage artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: coverage-report
+          path: |
+            lcov.info
+            target/llvm-cov/html
+          if-no-files-found: error
+          retention-days: 14
+
+      - name: Codecov upload
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        with:
+          version: v11.3.1
+          files: ./lcov.info
+          flags: rust
+          name: codecov-electrum-streaming-client
+          token: ${{ secrets.CODECOV_TOKEN }}
+          fail_ci_if_error: false

.github/workflows/cont_integration.yml

@@ -0,0 +1,192 @@
+name: CI
+
+# Builds and tests both feature configurations on MSRV and pinned Rust.
+# Checks formatting, Clippy and documentation with the pinned toolchain.
+# Checks that pull request commits are signed.
+# Latest-dependency compatibility runs separately in latest_deps.yml.
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+env:
+  CARGO_TERM_COLOR: always
+  RUST_BACKTRACE: "1"
+
+jobs:
+  build-test:
+    name: Build and test (${{ matrix.rust }}, ${{ matrix.features }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        rust: [msrv, pinned]
+        features: ["--no-default-features", "--all-features"]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Read MSRV
+        if: matrix.rust == 'msrv'
+        id: msrv
+        run: |
+          msrv=$(sed -n 's/^rust-version = "\(.*\)"/\1/p' Cargo.toml)
+          if [ -z "$msrv" ]; then
+            echo "failed to read package rust-version from Cargo.toml" >&2
+            exit 1
+          fi
+          echo "msrv=$msrv" >> "$GITHUB_OUTPUT"
+
+      # MSRV overrides rust-toolchain.toml; an empty toolchain uses its pinned version.
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
+        with:
+          toolchain: ${{ matrix.rust == 'msrv' && steps.msrv.outputs.msrv || '' }}
+          cache: true
+          cache-key: ${{ matrix.rust }}-${{ matrix.features }}
+          rustflags: ""
+
+      - name: Pin dependencies for MSRV
+        if: matrix.rust == 'msrv'
+        run: ./ci/pin-msrv.sh
+
+      - name: Build and test
+        env:
+          FEATURES: ${{ matrix.features }}
+        run: |
+          cargo build --locked --lib "$FEATURES"
+          cargo test --locked --all-targets "$FEATURES"
+          cargo test --locked --doc "$FEATURES"
+
+  fmt:
+    name: Rustfmt
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
+        with:
+          cache: false
+          rustflags: ""
+      - name: Check formatting
+        run: cargo fmt --all --check
+
+  clippy:
+    name: Clippy (${{ matrix.features }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        features: ["--no-default-features", "--all-features"]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
+        with:
+          cache: true
+          cache-key: clippy-${{ matrix.features }}
+          rustflags: ""
+      - name: Clippy
+        env:
+          FEATURES: ${{ matrix.features }}
+        run: cargo clippy --locked --all-targets "$FEATURES" -- -D warnings
+
+  docs:
+    name: Docs (${{ matrix.features }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        features: ["--no-default-features", "--all-features"]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
+        with:
+          cache: true
+          cache-key: docs-${{ matrix.features }}
+          rustflags: ""
+      - name: Check docs
+        env:
+          RUSTDOCFLAGS: "-D warnings"
+          FEATURES: ${{ matrix.features }}
+        run: cargo doc --locked --no-deps "$FEATURES"
+
+  signed-commits:
+    name: Signed commits
+    # PRs only; push/workflow_dispatch skip this job (treated as skipped by CI success).
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Check commits are signed
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: ./ci/check-signed-commits.sh "$BASE_SHA" "$HEAD_SHA"
+
+  CI-success:
+    name: CI success
+    # Always evaluate results so failed or cancelled jobs cannot skip the required check.
+    if: ${{ always() }}
+    needs: [build-test, fmt, clippy, docs, signed-commits]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Require all needed jobs
+        env:
+          BUILD_TEST: ${{ needs.build-test.result }}
+          FMT: ${{ needs.fmt.result }}
+          CLIPPY: ${{ needs.clippy.result }}
+          DOCS: ${{ needs.docs.result }}
+          SIGNED_COMMITS: ${{ needs.signed-commits.result }}
+        run: |
+          failed=0
+          check() {
+            printf '%s: %s\n' "$1" "$2"
+            if [ "$2" != success ]; then
+              failed=1
+            fi
+          }
+          # PR-only job: skipped on push is OK.
+          check_pr_only() {
+            printf '%s: %s\n' "$1" "$2"
+            if [ "$2" != success ] && [ "$2" != skipped ]; then
+              failed=1
+            fi
+          }
+          check build-test "$BUILD_TEST"
+          check fmt "$FMT"
+          check clippy "$CLIPPY"
+          check docs "$DOCS"
+          check_pr_only signed-commits "$SIGNED_COMMITS"
+          exit "$failed"

.github/workflows/latest_deps.yml

@@ -0,0 +1,52 @@
+name: Latest dependencies
+
+# Weekly compatibility check: `cargo update` the whole graph and build/test
+# on the current stable compiler. A failure here can be caused by a new rustc
+# or by new dependency releases; it is informational and not part of the
+# required CI success aggregate.
+
+on:
+  schedule:
+    - cron: "0 3 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+  RUST_BACKTRACE: "1"
+
+jobs:
+  latest:
+    name: Latest dependencies
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
+        with:
+          toolchain: stable
+          cache: true
+          cache-key: latest-stable
+          rustflags: ""
+
+      - name: Update dependencies
+        run: cargo update
+
+      - name: Build and test (no default features)
+        run: |
+          cargo build --locked --lib --no-default-features
+          cargo test --locked --all-targets --no-default-features
+          cargo test --locked --doc --no-default-features
+
+      - name: Build and test (all features)
+        run: |
+          cargo build --locked --lib --all-features
+          cargo test --locked --all-targets --all-features
+          cargo test --locked --doc --all-features