ci: add GitHub Actions workflows and pre-commit configs

.github/actions/setup-patched-deps/action.yml

@@ -0,0 +1,25 @@
+name: Setup Patched Dependencies
+description: Clone and patch orchard and sapling-crypto repositories
+
+runs:
+  using: composite
+  steps:
+    - name: Clone orchard
+      shell: bash
+      run: |
+        git clone --branch v0.11.0 --single-branch \
+          https://github.com/zcash/orchard.git .patched-orchard
+    - name: Patch orchard
+      shell: bash
+      run: |
+        git -C .patched-orchard apply "../nix/airdrop-orchard-nullifier.patch"
+    - name: Clone sapling-crypto
+      shell: bash
+      run: |
+        git clone --branch v0.5.0 --single-branch \
+          https://github.com/zcash/sapling-crypto.git .patched-sapling-crypto
+    - name: Patch sapling-crypto
+      shell: bash
+      run: |
+        git -C .patched-sapling-crypto apply \
+          "../nix/airdrop-sapling-nullifier.patch"

.github/actions/setup-protoc/action.yml

@@ -0,0 +1,9 @@
+name: Setup Protoc
+description: Install the Protocol Buffers compiler
+
+runs:
+  using: composite
+  steps:
+    - name: Install protoc
+      shell: bash
+      run: sudo apt-get update && sudo apt-get install -y protobuf-compiler

.github/actions/setup-rust-build/action.yml

@@ -0,0 +1,37 @@
+name: Setup Rust Build
+description: Install protoc, setup patched deps, install Rust toolchain, and configure cache
+
+inputs:
+  toolchain:
+    description: Rust toolchain to install (e.g., nightly, stable, 1.88.0)
+    required: true
+  components:
+    description: Additional Rust components to install (e.g., clippy, rustfmt)
+    required: false
+    default: ""
+  shared-key:
+    description: Shared key for Rust cache
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Install protoc
+      uses: ./.github/actions/setup-protoc
+    - name: Setup patched dependencies
+      uses: ./.github/actions/setup-patched-deps
+    - name: Install toolchain
+      uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # branch=master
+      id: toolchain
+      with:
+        toolchain: ${{ inputs.toolchain }}
+        components: ${{ inputs.components }}
+    - name: Set toolchain override
+      shell: bash
+      run: rustup override set "${TOOLCHAIN}"
+      env:
+        TOOLCHAIN: ${{ steps.toolchain.outputs.name }}
+    - name: Setup Rust cache
+      uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # tag: v2.8.2
+      with:
+        shared-key: ${{ inputs.shared-key }}

.github/workflows/ci.yml

@@ -0,0 +1,180 @@
+# CI runs when a PR is opened/ready or before merging.
+#
+#  | Event                           | When                       |
+#  |---------------------------------|----------------------------|
+#  | pull_request (opened)           | PR created (draft or not)  |
+#  | pull_request (ready_for_review) | Draft PR marked ready      |
+#  | merge_group                     | Merge queue (before merge) |
+#  | workflow_dispatch               | Manual trigger             |
+#
+# Note: `synchronize` is intentionally omitted to avoid workflow runs on
+# every push.
+
+name: ci
+on:
+  pull_request:
+    types: [opened, ready_for_review]
+    branches:
+      - main
+  merge_group:
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  fmt:
+    name: nightly / fmt
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # tag: v6.0.1
+      - name: Install nightly
+        uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # branch=master
+        id: toolchain
+        with:
+          toolchain: nightly
+          components: rustfmt
+      - name: Toolchain override
+        run: rustup override set "${TOOLCHAIN}"
+        env:
+          TOOLCHAIN: ${{steps.toolchain.outputs.name}}
+      - name: cargo fmt --all --check
+        run: cargo fmt --all --check
+  lint:
+    name: nightly / clippy, test and docs
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # tag: v6.0.1
+        with:
+          submodules: recursive
+      - name: Setup Rust build environment
+        uses: ./.github/actions/setup-rust-build
+        with:
+          toolchain: nightly
+          components: clippy
+          shared-key: lint-all-features
+      - name: cargo clippy
+        run: cargo clippy --locked --all-targets --all-features -- -D warnings
+      - name: Install cargo-hack
+        uses: taiki-e/install-action@b9c5db3aef04caffaf95a1d03931de10fb2a140f # tag: v2.65.1
+        with:
+          tool: cargo-hack
+      - name: cargo hack
+        run: cargo hack --no-dev-deps --feature-powerset check --locked
+      - name: cargo test
+        run: cargo test --locked --all-features
+      - name: Check Documentation
+        run: cargo doc --locked --no-deps --workspace --all-features --document-private-items
+        env:
+          RUSTDOCFLAGS: -D warnings
+  build:
+    name: stable / build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # tag: v6.0.1
+        with:
+          submodules: recursive
+      - name: Setup Rust build environment
+        uses: ./.github/actions/setup-rust-build
+        with:
+          toolchain: stable
+          shared-key: build-release
+      - name: cargo build --release
+        run: cargo build --release --locked
+  msrv:
+    name: MSRV / 1.88.0
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # tag: v6.0.1
+        with:
+          submodules: recursive
+      - name: Setup Rust build environment
+        uses: ./.github/actions/setup-rust-build
+        with:
+          toolchain: "1.88.0"
+          shared-key: msrv
+      - name: cargo check
+        run: cargo check --locked --all-targets --all-features
+  cargo-deny:
+    name: Check licenses & security
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # tag: v6.0.1
+        with:
+          submodules: recursive
+      - name: Setup patched dependencies
+        uses: ./.github/actions/setup-patched-deps
+      - name: Check licenses
+        uses: EmbarkStudios/cargo-deny-action@76cd80eb775d7bbbd2d80292136d74d39e1b4918 # tag: v2.0.14
+        with:
+          command: check licenses
+      - name: Install cargo-audit
+        uses: taiki-e/install-action@b9c5db3aef04caffaf95a1d03931de10fb2a140f # tag: v2.65.1
+        with:
+          tool: cargo-audit
+      - name: cargo audit
+        run: cargo audit
+  machete:
+    name: Check unused dependencies
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # tag: v6.0.1
+      - name: Install cargo-machete
+        uses: taiki-e/install-action@b9c5db3aef04caffaf95a1d03931de10fb2a140f # tag: v2.65.1
+        with:
+          tool: cargo-machete
+      - name: cargo machete
+        run: cargo machete
+  toml-fmt:
+    name: toml fmt
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # tag: v6.0.1
+      - name: Install taplo
+        uses: taiki-e/install-action@b9c5db3aef04caffaf95a1d03931de10fb2a140f # tag: v2.65.1
+        with:
+          tool: taplo
+      - name: taplo fmt --check
+        run: taplo fmt --check
+  markdown-lint:
+    name: markdown lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # tag: v6.0.1
+      - name: Lint markdown
+        uses: DavidAnson/markdownlint-cli2-action@07035fd053f7be764496c0f8d8f9f41f98305101 # tag: v22.0.0
+  yaml-lint:
+    name: yaml lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # tag: v6.0.1
+      - name: Lint YAML
+        uses: ibiqlik/action-yamllint@2576378a8e339169678f9939646ee3ee325e845c # tag: v3.1.1
+  typos:
+    name: typos
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # tag: v6.0.1
+      - name: Check typos
+        uses: crate-ci/typos@2d0ce569feab1f8752f1dde43cc2f2aa53236e06 # tag: v1.40.0

.markdownlint.json

@@ -0,0 +1,4 @@
+{
+  "MD013": false,
+  "MD024": false
+}

.yamllint.yml

@@ -0,0 +1,11 @@
+---
+extends: default
+
+rules:
+  document-start: disable
+  truthy:
+    check-keys: false
+  line-length:
+    max: 120
+  comments:
+    min-spaces-from-content: 1

Cargo.toml

@@ -9,7 +9,7 @@ members = [
 
 [workspace.package]
 edition = "2024"
-rust-version = "1.91.1"
+rust-version = "1.88.0"
 repository = "https://github.com/eigerco/zcash-namada-airdrop"
 license = "MIT"
 
@@ -73,3 +73,6 @@ unused_qualifications = "warn"
 arithmetic_side_effects = "deny"
 indexing_slicing = "deny"
 unwrap_used = "deny"
+
+[workspace.lints.rustdoc]
+broken_intra_doc_links = "deny"

crates/airdrop/Cargo.toml

@@ -2,7 +2,8 @@
 name = "airdrop"
 version = "0.1.0"
 edition.workspace = true
-license = "MIT"
+license.workspace = true
+rust-version.workspace = true
 
 [features]
 default = []

crates/light-wallet-api/Cargo.toml

@@ -2,7 +2,8 @@
 name = "light-wallet-api"
 version = "0.1.0"
 edition.workspace = true
-license = "MIT"
+license.workspace = true
+rust-version.workspace = true
 
 [dependencies]
 prost = { workspace = true }

crates/mnemonic-to-fvks/Cargo.toml

@@ -2,7 +2,8 @@
 name = "mnemonic-to-fvks"
 version = "0.1.0"
 edition.workspace = true
-license = "MIT"
+license.workspace = true
+rust-version.workspace = true
 
 [dependencies]
 bip39 = { workspace = true }

crates/non-membership-proofs/Cargo.toml

@@ -2,7 +2,8 @@
 name = "non-membership-proofs"
 version = "0.1.0"
 edition.workspace = true
-license = "MIT"
+license.workspace = true
+rust-version.workspace = true
 
 [dependencies]
 async-stream = { workspace = true }

docs/USAGE.md

@@ -69,7 +69,7 @@ The `.bin` snapshot files use a simple binary format:
 - Nullifiers must be **sorted in ascending lexicographic order**
 - File size must be a multiple of 32 bytes
 
-```
+```console
 ┌──────────────────┬──────────────────┬─────┬──────────────────┐
 │  Nullifier 0     │  Nullifier 1     │ ... │  Nullifier N     │
 │    (32 bytes)    │    (32 bytes)    │     │    (32 bytes)    │

nix/devshell.nix

@@ -42,6 +42,7 @@
         cargo-machete # Check for unused dependencies
         cargo-deny # Cargo plugin for linting your dependencies
         cargo-llvm-cov # Code coverage
+        cargo-msrv # Check minimum supported Rust version
 
         # General development tools
         git