ci: enforce Conventional Commits and modernize all workflows

.github/workflows/pr-title.yml

@@ -0,0 +1,39 @@
+name: PR title
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - edited
+      - synchronize
+      - reopened
+
+permissions:
+  pull-requests: read
+
+jobs:
+  # Enforce Conventional Commits in the PR title so the squash-merge commit
+  # message produces clean changelog entries for release-plz.
+  conventional-commits:
+    name: Conventional Commits
+    runs-on: ubuntu-latest
+    steps:
+      - uses: amannn/action-semantic-pull-request@v6
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          types: |
+            feat
+            fix
+            chore
+            docs
+            refactor
+            perf
+            test
+            build
+            ci
+            revert
+          requireScope: false
+          subjectPattern: ^[A-Za-z].+[^.]$
+          subjectPatternError: |
+            The subject "{subject}" must start with a letter and not end with a period.

.github/workflows/release-plz.yml

@@ -5,18 +5,25 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
-  # Tag the release commit, create a GitHub release, and publish to crates.io.
+  # Tag the release commit, create a GitHub release, and publish to crates.io
+  # via crates.io trusted publishing (OIDC).
   release-plz-release:
     name: Release-plz release
     runs-on: ubuntu-latest
     permissions:
       contents: write
       pull-requests: read
       id-token: write
+    concurrency:
+      group: release-plz-release-${{ github.ref }}
+      cancel-in-progress: false
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -37,11 +44,11 @@ jobs:
       contents: write
       pull-requests: write
     concurrency:
-      group: release-plz-${{ github.ref }}
+      group: release-plz-pr-${{ github.ref }}
       cancel-in-progress: false
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
           persist-credentials: false

.github/workflows/rust.yml

@@ -1,45 +1,68 @@
-name: Check and run tests
+name: CI
 
 on:
   push:
-    branches: [ main ]
+    branches: [main]
   pull_request:
-    branches: [ main ]
+
+permissions:
+  contents: read
+
+# Cancel superseded PR runs; never cancel a main run mid-flight.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
 env:
   CARGO_TERM_COLOR: always
 
 jobs:
-  build:
+  fmt:
+    name: Rustfmt
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt
+      - run: cargo fmt --all --check
+
+  clippy:
+    name: Clippy
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo clippy --all-targets --all-features -- -D warnings
+
+  test:
+    name: Integration tests
     runs-on: ubuntu-latest
+    env:
+      RUN_INTEGRATION_TESTS: "1"
     steps:
-    - uses: actions/checkout@v2
-    - name: Check
-      run: cargo check --verbose
-    - name: Check code style
-      run: cargo fmt -- --check
-    - run: rustup component add clippy
-    - uses: actions-rs/clippy-check@v1
-      with:
-        token: ${{ secrets.GITHUB_TOKEN }}
-        args: --all-features
-    - name: Install irma server
-      run: |
-        mkdir workflow_bin
-        echo "$GITHUB_WORKSPACE/workflow_bin" >> $GITHUB_PATH
-        wget https://github.com/privacybydesign/irmago/releases/download/v0.8.0/irma-master-linux-amd64 -O workflow_bin/irma
-        chmod +x workflow_bin/irma
-    - name: Create directory structure
-      run: mkdir -p temp_testing/client temp_testing/irma_configuration
-    - name: Download schemes
-      run: irma scheme download temp_testing/irma_configuration
-    - name: Build test tool
-      run: |
-        cd test_tools/client_emulator
-        go build
-      env:
-        GO111MODULE: "on"
-    - name: Run tests
-      run: cargo test --verbose
-      env:
-        RUN_INTEGRATION_TESTS: "1"
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - uses: actions/setup-go@v6
+        with:
+          go-version: stable
+      - name: Install IRMA server
+        run: |
+          mkdir -p "$RUNNER_TEMP/irma-bin"
+          echo "$RUNNER_TEMP/irma-bin" >> "$GITHUB_PATH"
+          curl -fsSL https://github.com/privacybydesign/irmago/releases/download/v0.8.0/irma-master-linux-amd64 \
+            -o "$RUNNER_TEMP/irma-bin/irma"
+          chmod +x "$RUNNER_TEMP/irma-bin/irma"
+      - name: Set up IRMA configuration
+        run: |
+          mkdir -p temp_testing/client temp_testing/irma_configuration
+          irma scheme download temp_testing/irma_configuration
+      - name: Build test client emulator
+        working-directory: test_tools/client_emulator
+        run: go build
+      - name: Run tests
+        run: cargo test --all-features

src/sessionrequest.rs

@@ -206,12 +206,12 @@ impl BaseRequestBuilder {
     }
 
     fn return_url(&mut self, return_url: String) {
-        debug_assert!(self.base.return_url == None);
+        debug_assert!(self.base.return_url.is_none());
         self.base.return_url = Some(return_url);
     }
 
     fn augmented_return_url(&mut self, return_url: String) {
-        debug_assert!(self.base.return_url == None);
+        debug_assert!(self.base.return_url.is_none());
         self.base.return_url = Some(return_url);
         self.base.augment_return = true;
     }
@@ -485,7 +485,7 @@ mod tests {
         assert_eq!(
             format!(
                 "{{\"credential\":\"a.b.c\",\"validity\":{},\"attributes\":{{\"d\":\"e\"}}}}",
-                cred2.validity.clone().unwrap()
+                cred2.validity.unwrap()
             ),
             serde_json::to_string(&cred2).unwrap()
         );