refactor: kind of everything

.github/workflows/checks.yml

@@ -49,6 +49,13 @@ jobs:
       - name: Cache dependencies
         uses: Swatinem/rust-cache@v2
 
+        # Use miri instead of this, this is temporary see https://github.com/rust-lang/miri/issues/602
+        # there is a security workflow for this
+      - name: Run tests
+        run: |
+          cargo install cargo-nextest
+          cargo nextest run && cargo test --doc
+
       - name: Build release
         run: ./scripts/build/toolchain cargo build --release
 

.github/workflows/coverage.yml

@@ -0,0 +1,114 @@
+name: Coverage Check
+
+on:
+  pull_request_target:
+  push:
+    branches: [ main ]
+
+jobs:
+  coverage:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
+
+    steps:
+    - uses: actions/checkout@v5
+      with:
+        ref: ${{ github.event.pull_request.head.sha }}
+        fetch-depth: 0
+
+    - name: Cache dependencies
+      uses: Swatinem/rust-cache@v2
+
+    - uses: dtolnay/rust-toolchain@master
+      with:
+        toolchain: nightly
+
+    - name: Install cargo-llvm-cov and nextest
+      run: |
+        cargo install cargo-llvm-cov cargo-nextest
+
+    - name: Run llvm-cov on current branch
+      run: |
+        mkdir -p ./current-coverage
+        cargo llvm-cov --no-report nextest
+        cargo llvm-cov --no-report --doc
+        cargo llvm-cov report --json --summary-only --doctests --output-path ./current-coverage/coverage.json
+
+    - name: Checkout base branch
+      run: git checkout ${{ github.event.pull_request.base.sha }}
+
+    - name: Cache base coverage
+      uses: actions/cache@v4
+      id: base-cache
+      with:
+        path: ./base-coverage
+        key: coverage-${{ github.event.pull_request.base.sha }}
+
+    - name: Run llvm-cov on base branch
+      if: steps.base-cache.outputs.cache-hit != 'true'
+      run: |
+        mkdir -p ./base-coverage
+        cargo llvm-cov --no-report nextest
+        cargo llvm-cov --no-report --doc
+        cargo llvm-cov report --json --summary-only --doctests --output-path ./base-coverage/coverage.json
+
+    - name: Compare coverage
+      id: compare
+      continue-on-error: true
+      run: |
+        current=$(jq '.totals.lines.percent // .data[0].totals.lines.percent // .lines.percent // 0' ./current-coverage/coverage.json)
+        base=$(jq '.totals.lines.percent // .data[0].totals.lines.percent // .lines.percent // 0' ./base-coverage/coverage.json)
+        diff=$(echo "$current - $base" | bc -l)
+        if (( $(echo "$current < $base" | bc -l) )); then
+          echo "Coverage decreased from $base% to $current%"
+          echo "FAILED" > coverage_status.txt
+        fi
+
+    - name: Post or update PR comment
+      uses: actions/github-script@v8
+      with:
+        script: |
+          const fs = require('fs');
+          const currentData = JSON.parse(fs.readFileSync('./current-coverage/coverage.json', 'utf8'));
+          const baseData = JSON.parse(fs.readFileSync('./base-coverage/coverage.json', 'utf8'));
+          const currentTotals = currentData.totals || currentData.data?.[0]?.totals || {};
+          const baseTotals = baseData.totals || baseData.data?.[0]?.totals || {};
+          const currentLines = currentTotals.lines?.percent || 0;
+          const baseLines = baseTotals.lines?.percent || 0;
+          const currentFunctions = currentTotals.functions?.percent || 0;
+          const baseFunctions = baseTotals.functions?.percent || 0;
+          const currentRegions = currentTotals.regions?.percent || 0;
+          const baseRegions = baseTotals.regions?.percent || 0;
+          const diff = (currentLines - baseLines).toFixed(6);
+          const failed = fs.existsSync('./coverage_status.txt');
+          const status = failed ? '❌ Decreased' : currentLines > baseLines ? '✅ Increased' : '➡️ No change';
+          const body = `## Coverage Report\n\n### Overall Metrics\n- **Lines:** ${currentLines.toFixed(2)}% (base: ${baseLines.toFixed(2)}%)\n- **Functions:** ${currentFunctions.toFixed(2)}% (base: ${baseFunctions.toFixed(2)}%)\n- **Regions:** ${currentRegions.toFixed(2)}% (base: ${baseRegions.toFixed(2)}%)\n\n### Summary\n- **Difference:** ${diff}%\n- **Status:** ${status}\n\n${failed ? '⚠️ Coverage regression detected. Please add tests to maintain or increase coverage.' : ''}`;
+
+          const comments = await github.rest.issues.listComments({
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            issue_number: context.issue.number,
+          });
+
+          const existing = comments.data.find(c => c.body.includes('## Coverage Report'));
+          if (existing) {
+            await github.rest.issues.updateComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              comment_id: existing.id,
+              body: body
+            });
+          } else {
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              body: body
+            });
+          }
+
+    - name: Fail if coverage decreased
+      if: steps.compare.outcome == 'failure'
+      run: exit 1

.github/workflows/security.yml

@@ -49,6 +49,7 @@ jobs:
       - name: Run comprehensive security checks
         shell: bash
         run: |
+          cargo install cargo-nextest
           # The security script will auto-detect CI environment and install missing tools
           # Exit with proper code to fail CI if security tests fail
           if ! ./scripts/security.sh; then

.typos.toml

@@ -1,5 +1,6 @@
 [default.extend-words]
 enew = "enew"
+Ba = "Ba"
 
 [files]
 extend-exclude = ["CHANGELOG.md"]