add github workflow

Author: joske

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/audit.yml

@@ -0,0 +1,21 @@
+name: Security Audit
+on:
+  push:
+    paths:
+      - Cargo.lock
+  pull_request:
+    paths:
+      - Cargo.lock
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Install Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@v2
+      - name: Install cargo-audit
+        run: cargo install cargo-audit
+      - name: Run audit
+        run: cargo audit

.github/workflows/ci.yml

@@ -0,0 +1,30 @@
+name: CI
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+  workflow_call:
+env:
+  CARGO_TERM_COLOR: always
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Install additional packages
+        run: sudo apt-get update && sudo apt-get install -y build-essential libgtksourceview-5-dev
+      - name: Install Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          components: clippy, rustfmt
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@v2
+      - name: Check formatting
+        run: cargo fmt -- --check
+      - name: Clippy
+        run: cargo clippy --all-targets -- -D warnings -W clippy::pedantic
+      - name: Build
+        run: cargo build --locked
+      - name: Run tests
+        run: cargo test --all-targets --locked

.github/workflows/publish.yml

@@ -0,0 +1,63 @@
+name: Publish to crates.io
+on:
+  workflow_dispatch:
+jobs:
+  checks:
+    runs-on: ubuntu-latest
+    if: false
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - name: Check HEAD has a tag
+        id: get_tag
+        run: |
+          TAG=$(git tag --points-at HEAD | head -n1)
+          if [ -z "$TAG" ]; then
+            echo "Error: HEAD commit has no tag. Please tag this commit before publishing."
+            exit 1
+          fi
+          echo "Found tag: $TAG"
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+      - name: Check tag matches Cargo.toml version
+        run: |
+          TAG="${{ steps.get_tag.outputs.tag }}"
+          # Strip leading 'v' if present (v0.4.1 -> 0.4.1)
+          VERSION="${TAG#v}"
+          CARGO_VERSION=$(grep -m1 '^version' Cargo.toml | sed 's/.*"\(.*\)".*/\1/')
+          if [ "$VERSION" != "$CARGO_VERSION" ]; then
+            echo "Error: Tag version ($VERSION) does not match Cargo.toml version ($CARGO_VERSION)"
+            exit 1
+          fi
+          echo "Tag matches Cargo.toml version: $VERSION"
+      - name: Check version not already on crates.io
+        run: |
+          TAG="${{ steps.get_tag.outputs.tag }}"
+          # Strip leading 'v' if present (v0.4.1 -> 0.4.1)
+          VERSION="${TAG#v}"
+          echo "Checking if $VERSION exists on crates.io..."
+
+          CRATE_NAME=$(grep -m1 '^name' Cargo.toml | sed 's/.*"\(.*\)".*/\1/')
+          HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://crates.io/api/v1/crates/$CRATE_NAME/$VERSION")
+          if [ "$HTTP_STATUS" = "200" ]; then
+            echo "Error: Version $VERSION already exists on crates.io"
+            exit 1
+          fi
+          echo "Version $VERSION not yet published, proceeding."
+  ci:
+    needs: checks
+    uses: ./.github/workflows/ci.yml
+  publish:
+    needs: ci
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        # TODO: check which packages are needed, if any
+      - name: Install packages needed for build
+        run: sudo apt-get update && sudo apt-get install -y build-essential
+      - name: Install Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+      - name: Publish to crates.io
+        run: cargo publish
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}