ci,test: harden CI and close coverage gaps with fault-injection tests

.github/workflows/rust.yml

@@ -7,16 +7,78 @@ on:
   pull_request:
     types: [ opened, synchronize, reopened ]
     branches:
-      - master
+      - '**'
+
+  # Weekly run so new RustSec advisories surface without waiting for a push.
+  schedule:
+    - cron: '17 4 * * 1'
+
+# Third-party actions are pinned to full commit SHAs (tag comments alongside)
+# so a moved tag cannot inject code into this workflow.
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
-  CARGO_TERM_COLOR: auto
+  CARGO_TERM_COLOR: always
+  RUST_BACKTRACE: 1
   DATABASE_TEST_URL: postgres://postgres:password@localhost:5432/postgres
 
 jobs:
+  fmt:
+    name: Rustfmt
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        with:
+          toolchain: stable
+          components: rustfmt
+      - name: Check formatting
+        run: cargo fmt --all -- --check
+
+  clippy:
+    name: Clippy
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        with:
+          toolchain: stable
+          components: clippy
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - name: Clippy (all targets, deny warnings)
+        run: cargo clippy --all-targets -- -Dwarnings
+
+  docs:
+    name: Docs
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - name: Build docs (deny warnings, including private items)
+        run: cargo doc --no-deps --document-private-items
+        env:
+          RUSTDOCFLAGS: -D warnings
+
   test:
-    name: Test suite
+    name: Test suite (${{ matrix.rust }})
     runs-on: ubuntu-latest
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        rust: [ stable, beta ]
     services:
       postgres:
         image: postgres:14
@@ -32,31 +94,89 @@ jobs:
         ports:
           - 5432:5432
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
-      - name: Test
-        run: cargo test -- --show-output
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        with:
+          toolchain: ${{ matrix.rust }}
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - name: Test (all targets)
+        run: cargo test --all-targets -- --show-output
+      - name: Doc tests
+        run: cargo test --doc
 
-  fmt-clippy:
-    name: Check
+  msrv:
+    name: MSRV (1.88)
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # 1.88
         with:
-          components: rustfmt, clippy
-      - uses: Swatinem/rust-cache@v2
-      - name: Check fmt
-        run: cargo fmt --all -- --check
-      - name: Clippy
-        run: cargo clippy --all-targets -- -Dwarnings
+          toolchain: '1.88'
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - name: Check with the minimum supported Rust version
+        run: cargo check --all-targets
 
-  audit:
+  coverage:
+    name: Coverage gate
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    services:
+      postgres:
+        image: postgres:14
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: password
+          POSTGRES_DB: postgres
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+        ports:
+          - 5432:5432
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        with:
+          toolchain: stable
+          components: llvm-tools-preview
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - uses: taiki-e/install-action@7f4eb899022d8fe70b20c4f3de697aa85c309026 # v2
+        with:
+          tool: cargo-llvm-cov
+      - name: Measure coverage (fails under 97% line coverage)
+        run: cargo llvm-cov --workspace --fail-under-lines 97 --lcov --output-path lcov.info
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: coverage-lcov
+          path: lcov.info
+
+  deny:
     name: Audit dependencies
     runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: taiki-e/install-action@7f4eb899022d8fe70b20c4f3de697aa85c309026 # v2
+        with:
+          tool: cargo-deny
+      - name: cargo deny (advisories, licenses, bans, sources)
+        run: cargo deny check
+
+  cross-check:
+    name: Check (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ macos-latest, windows-latest ]
     steps:
-      - uses: actions/checkout@v4
-      - uses: rustsec/audit-check@v2
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          toolchain: stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - name: Check (all targets)
+        run: cargo check --all-targets

Cargo.toml

@@ -2,6 +2,8 @@
 name = "bdk_sqlx"
 version = "0.0.1"
 edition = "2021"
+rust-version = "1.88"
+license = "MIT"
 
 [dependencies]
 bdk_wallet = { version = "1.2.0" }

deny.toml

@@ -0,0 +1,42 @@
+# cargo-deny configuration — enforced by the `deny` CI job.
+# https://embarkstudios.github.io/cargo-deny/
+
+[graph]
+all-features = true
+
+[advisories]
+# Any RustSec advisory (vulnerability, unmaintained, unsound, notice) fails CI.
+version = 2
+yanked = "deny"
+
+[licenses]
+version = 2
+# Licenses acceptable for this project's dependency tree.
+allow = [
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "CC0-1.0",
+    # Mozilla CA bundle data shipped by webpki-roots (rustls dev-dependency).
+    "CDLA-Permissive-2.0",
+    "ISC",
+    "MIT",
+    # MIT +no-false-attribs, used by hex_lit; as permissive as MIT.
+    "MITNFA",
+    "MPL-2.0",
+    "Unicode-3.0",
+    "Zlib",
+]
+confidence-threshold = 0.93
+
+[bans]
+# Duplicate crate versions bloat builds and hide supply-chain drift; surface
+# them without failing CI, since the sqlx/bitcoin trees legitimately lag.
+multiple-versions = "warn"
+wildcards = "deny"
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]

src/sqlite.rs

@@ -162,7 +162,7 @@ impl crate::SqliteStoreBuilder {
     /// each sqlite connection gets its *own* private in-memory database, so a
     /// multi-connection pool silently reads and writes different databases (and
     /// per-connection `PRAGMA`s only apply to the connection that ran them).
-    /// Use [`SqliteStoreBuilder::build_with_url`] with `None` instead, which
+    /// Use [`crate::SqliteStoreBuilder::build_with_url`] with `None` instead, which
     /// configures a single-connection pool correctly.
     pub fn pool(mut self, pool: Pool<Sqlite>) -> Self {
         self.pool = Some(pool);