Add CI workflows, rustfmt, clippy, and cargo-deny configs

CI workflow (ci.yml):
- Format check (cargo fmt --check)
- Clippy with -D warnings
- Tests on ubuntu + macos
- cargo-deny for license/advisory/ban checks
- Swatinem/rust-cache with save-if for PRs
- Concurrency control (cancel in-progress on new push)

Security workflow (security.yml):
- Weekly advisory scan + on Cargo.toml changes

Also fixes all clippy warnings:
- Row::is_empty added
- match → if let in column_map
- map_or → is_some_and in planner
- Doc comment formatting in pagination module

Author: benaiad

.github/workflows/ci.yml

@@ -0,0 +1,60 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  fmt:
+    name: Format
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt
+      - run: cargo fmt --all -- --check
+
+  clippy:
+    name: Clippy
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+      - uses: Swatinem/rust-cache@v2
+        with:
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+      - run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
+
+  test:
+    name: Test (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: test-${{ matrix.os }}
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+      - run: cargo test --workspace --all-features --locked
+
+  deny:
+    name: Deny
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: EmbarkStudios/cargo-deny-action@v2

.github/workflows/security.yml

@@ -0,0 +1,19 @@
+name: Security audit
+
+on:
+  schedule:
+    - cron: '0 0 * * 1'
+  push:
+    paths:
+      - '**/Cargo.toml'
+      - '**/Cargo.lock'
+
+jobs:
+  audit:
+    name: Advisories
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          command: check advisories

clippy.toml

@@ -0,0 +1,6 @@
+msrv = "1.85"
+cognitive-complexity-threshold = 25
+too-many-arguments-threshold = 7
+too-many-lines-threshold = 100
+allow-unwrap-in-tests = true
+allow-expect-in-tests = true

crates/sqlize-core/examples/github_query.rs

@@ -49,11 +49,16 @@ async fn main() {
         match execute(&plan, &auth, &client).await {
             Ok(result) => {
                 let json = result_set_to_json(&result);
-                let toon = result_set_to_toon(&result).unwrap_or_else(|e| format!("TOON error: {e}"));
+                let toon =
+                    result_set_to_toon(&result).unwrap_or_else(|e| format!("TOON error: {e}"));
 
                 println!("--- JSON ({} bytes) ---", json.len());
                 println!("{json}");
-                println!("\n--- TOON ({} bytes, {:.0}% smaller) ---", toon.len(), (1.0 - toon.len() as f64 / json.len() as f64) * 100.0);
+                println!(
+                    "\n--- TOON ({} bytes, {:.0}% smaller) ---",
+                    toon.len(),
+                    (1.0 - toon.len() as f64 / json.len() as f64) * 100.0
+                );
                 println!("{toon}");
             }
             Err(e) => {

crates/sqlize-core/src/catalog/ddl.rs

@@ -17,22 +17,13 @@ pub fn table_ddl(table: &VirtualTable) -> String {
     let required: Vec<_> = table.required_params().collect();
     if !required.is_empty() {
         let names: Vec<_> = required.iter().map(|c| c.name.as_str()).collect();
-        writeln!(
-            out,
-            "-- Required WHERE clause: {}",
-            names.join(" AND ")
-        )
-        .unwrap();
+        writeln!(out, "-- Required WHERE clause: {}", names.join(" AND ")).unwrap();
     }
 
     writeln!(out, "CREATE TABLE {} (", table.name).unwrap();
 
     for (i, col) in table.columns.iter().enumerate() {
-        let trailing_comma = if i + 1 < table.columns.len() {
-            ","
-        } else {
-            ""
-        };
+        let trailing_comma = if i + 1 < table.columns.len() { "," } else { "" };
         let nullable = if col.nullable { "" } else { " NOT NULL" };
 
         let origin_tag = match col.role {

crates/sqlize-core/src/catalog/mod.rs

@@ -28,7 +28,9 @@ impl Catalog {
             map.insert(table.name.clone(), table);
         }
         if map.is_empty() {
-            tracing::warn!("catalog is empty — no tables were generated from the spec (check your tag filter)");
+            tracing::warn!(
+                "catalog is empty — no tables were generated from the spec (check your tag filter)"
+            );
         }
         Ok(Self { tables: map })
     }
@@ -50,5 +52,4 @@ impl Catalog {
         self.get(name)
             .ok_or_else(|| Error::TableNotFound(name.clone()))
     }
-
 }

crates/sqlize-core/src/catalog/types.rs

@@ -47,12 +47,18 @@ impl fmt::Display for TableName {
 pub struct ApiParamName(String);
 
 impl ApiParamName {
-    pub fn new(s: impl Into<String>) -> Self { Self(s.into()) }
-    pub fn as_str(&self) -> &str { &self.0 }
+    pub fn new(s: impl Into<String>) -> Self {
+        Self(s.into())
+    }
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
 }
 
 impl fmt::Display for ApiParamName {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { f.write_str(&self.0) }
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(&self.0)
+    }
 }
 
 /// A validated, non-empty column name containing only `[a-z0-9_]`.
@@ -121,11 +127,7 @@ impl PathTemplate {
     pub fn placeholders(&self) -> Vec<&str> {
         self.0
             .split('/')
-            .filter_map(|segment| {
-                segment
-                    .strip_prefix('{')
-                    .and_then(|s| s.strip_suffix('}'))
-            })
+            .filter_map(|segment| segment.strip_prefix('{').and_then(|s| s.strip_suffix('}')))
             .collect()
     }
 
@@ -204,7 +206,10 @@ impl ColumnRole {
 
     /// Whether a WHERE `=` filter on this column can be pushed to the API.
     pub fn is_pushable(&self) -> bool {
-        matches!(self, Self::PathParam | Self::QueryParam | Self::QueryParamAndResponse)
+        matches!(
+            self,
+            Self::PathParam | Self::QueryParam | Self::QueryParamAndResponse
+        )
     }
 
     /// Whether this column appears in query results.
@@ -234,7 +239,10 @@ impl Column {
     /// The key to use when sending this column's value as an API parameter.
     /// Falls back to the SQL column name when no explicit API name is set.
     pub fn api_param_key(&self) -> &str {
-        self.api_name.as_ref().map(|n| n.as_str()).unwrap_or(self.name.as_str())
+        self.api_name
+            .as_ref()
+            .map(|n| n.as_str())
+            .unwrap_or(self.name.as_str())
     }
 }
 
@@ -371,7 +379,10 @@ pub fn truncate_str(s: &str, max_chars: usize) -> String {
     if first_line.chars().count() <= max_chars {
         first_line.to_owned()
     } else {
-        let truncated: String = first_line.chars().take(max_chars.saturating_sub(3)).collect();
+        let truncated: String = first_line
+            .chars()
+            .take(max_chars.saturating_sub(3))
+            .collect();
         format!("{truncated}...")
     }
 }
@@ -421,6 +432,10 @@ impl Row {
         self.0.len()
     }
 
+    pub fn is_empty(&self) -> bool {
+        self.0.is_empty()
+    }
+
     pub fn values(&self) -> &[Scalar] {
         &self.0
     }

crates/sqlize-core/src/error.rs

@@ -19,10 +19,16 @@ pub enum Error {
     TableNotFound(TableName),
 
     #[error("column {column} not found in table {table}")]
-    ColumnNotFound { table: TableName, column: ColumnName },
+    ColumnNotFound {
+        table: TableName,
+        column: ColumnName,
+    },
 
     #[error("missing required parameter {column} for table {table}")]
-    MissingRequiredParam { table: TableName, column: ColumnName },
+    MissingRequiredParam {
+        table: TableName,
+        column: ColumnName,
+    },
 
     #[error("duplicate table name: {0}")]
     DuplicateTable(TableName),
@@ -52,7 +58,11 @@ pub enum Error {
 
     // ---- Execution ----
     #[error("API returned {status}: {body}")]
-    ApiError { status: u16, url: String, body: String },
+    ApiError {
+        status: u16,
+        url: String,
+        body: String,
+    },
 
     #[error("failed to resolve URL: missing path parameters")]
     UnresolvedUrl,

crates/sqlize-core/src/exec/mod.rs

@@ -21,20 +21,14 @@ pub struct AuthConfig {
 }
 
 /// Execute a query plan against live APIs.
-pub async fn execute(
-    plan: &QueryPlan,
-    auth: &AuthConfig,
-    client: &Client,
-) -> Result<ResultSet> {
+pub async fn execute(plan: &QueryPlan, auth: &AuthConfig, client: &Client) -> Result<ResultSet> {
     let fetch_limit = plan.post.limit.map(|l| {
         let offset = plan.post.offset.unwrap_or(0);
         l + offset
     });
 
     let mut result = match &plan.source {
-        PlanSource::ApiCall(call) => {
-            execute_api_call(call, client, auth, fetch_limit).await?
-        }
+        PlanSource::ApiCall(call) => execute_api_call(call, client, auth, fetch_limit).await?,
     };
 
     postprocess::apply(&plan.post, &mut result);
@@ -96,14 +90,18 @@ async fn execute_api_call(
         is_first_page = false;
     }
 
-    Ok(ResultSet { columns: all_columns, rows: all_rows })
+    Ok(ResultSet {
+        columns: all_columns,
+        rows: all_rows,
+    })
 }
 
 fn resolve_url(call: &ApiCall) -> Result<String> {
     call.endpoint
         .url(|placeholder| {
             // Find the column whose API name matches this URL placeholder
-            call.columns.iter()
+            call.columns
+                .iter()
                 .find(|c| c.api_param_key() == placeholder)
                 .and_then(|c| {
                     let key = ApiParamName::new(c.api_param_key());
@@ -151,15 +149,18 @@ async fn fetch_page(
 
     if is_first_page {
         // Extract query params (non-path pushable params) and stringify for HTTP
-        let query_params: Vec<(String, String)> = call.columns.iter()
+        let query_params: Vec<(String, String)> = call
+            .columns
+            .iter()
             .filter(|c| c.role.is_pushable() && !c.role.is_required())
             .filter_map(|c| {
                 let key = ApiParamName::new(c.api_param_key());
                 let val = call.params.get(&key)?;
                 Some((key.as_str().to_owned(), val.to_string()))
             })
             .collect();
-        let query_refs: Vec<(&str, &str)> = query_params.iter()
+        let query_refs: Vec<(&str, &str)> = query_params
+            .iter()
             .map(|(k, v)| (k.as_str(), v.as_str()))
             .collect();
         request = request.query(&query_refs);
@@ -208,4 +209,3 @@ fn unwrap_response<'a>(
         None => body,
     }
 }
-