feat(ci): add a justfile and GitHub Actions (#10)

* feat(ci): add `justfile`

* feat(ci): add GitHub CI workflows

Adds 4 workflows:
- Monthly run of dependabot for cargo dependencies and GH Actions
- Run `cargo-audit` on every PR
- Run `just check` on every PR
- Run Zizmor Security Analysis on every PR

Author: luisschwab

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "monthly"

.github/workflows/audit.yml

@@ -0,0 +1,38 @@
+name: Security Audit
+
+on:
+  pull_request:
+  merge_group:
+  push:
+    branches: [master]
+
+env:
+  CARGO_TERM_COLOR: always
+
+permissions: {}
+
+jobs:
+  supply-chain:
+    name: 'cargo-audit'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
+        with:
+          persist-credentials: false
+
+      - uses: dtolnay/rust-toolchain@22a6a5b0f9f487c5f5587025ae9d4a1caf2a8a78 # clippy
+
+      - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2
+        with:
+          cache-on-failure: true
+
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --force --locked
+
+      - name: Check for audit warnings
+        run: cargo audit -D warnings
+        continue-on-error: true
+
+      - name: Check for vulnerabilities
+        run: cargo audit

.github/workflows/ci.yml

@@ -0,0 +1,36 @@
+name: CI
+
+env:
+  CARGO_TERM_COLOR: always
+
+on:
+  push:
+    branches:
+      - master
+  pull_request: {}
+  workflow_dispatch: null
+
+permissions: {}
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: checkout code
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
+        with:
+          persist-credentials: false
+
+      - name: setup rust
+        uses: dtolnay/rust-toolchain@b95584d8105b9ab200e15821fa671848cf2b7017 # nightly
+        with:
+          components: clippy, rustfmt
+
+      - name: setup just
+        uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3
+
+      - name: rust cache
+        uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2
+
+      - name: check
+        run: just check

.github/workflows/zizmor.yml

@@ -0,0 +1,23 @@
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+  pull_request:
+    branches: ["**"]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: zizmor
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
+        with:
+          persist-credentials: false
+
+      - name: Install the latest version of uv
+        uses: astral-sh/setup-uv@d9e0f98d3fc6adb07d1e3d37f3043649ddad06a1 # v5
+
+      - name: Run zizmor 🌈
+        run: uvx zizmor .

justfile

@@ -0,0 +1,48 @@
+alias b := build
+alias c := check
+alias d := delete
+alias e := example
+alias f := fmt
+
+_default:
+    @just --list
+
+# Build bdk_floresta
+build:
+    cargo build
+
+# Check code: formatting, compilation, linting, and commit signature
+check:
+    cargo +nightly fmt --all -- --check
+    cargo check --workspace
+    cargo clippy --all-targets -- -D warnings
+    @[ "$(git log --pretty='format:%G?' -1 HEAD)" = "N" ] && \
+       echo "\n⚠️  Unsigned commit: bdk_floresta requires commits to be signed." || \
+       true
+
+# Delete files: bitcoin, signet, testnet4, target, lockfile
+delete item="data":
+    just _delete-{{ item }}
+
+_delete-bitcoin:
+    rm -rf data/bitcoin
+
+_delete-signet:
+    rm -rf data/signet
+
+_delete-testnet4:
+    rm -rf data/testnet4
+
+_delete-target:
+    rm -rf target
+
+_delete-lockfile:
+    rm -f Cargo.lock
+
+# Run an example crate
+example name="example":
+    cargo run --example {{ name }} --release
+
+# Format code
+fmt:
+    cargo +nightly fmt