feat: Run cargo crap in CI

Author: larseggert

.github/workflows/check.yml

@@ -111,6 +111,7 @@ jobs:
           # shellcheck disable=SC2086
           if [ "$TOOLCHAIN" == "stable" ]; then
             cargo llvm-cov test $BUILD_TYPE --locked --include-ffi --codecov --output-path codecov.json
+            cargo llvm-cov report $BUILD_TYPE --lcov --include-ffi --output-path lcov.info
           elif [ -n "$CAREFUL" ]; then
             cargo careful test $BUILD_TYPE --locked --target "$(rustc --print host-tuple)"
           fi
@@ -142,6 +143,13 @@ jobs:
           mkdir -p C:/msys64/home/runneradmin/
           touch C:/msys64/home/runneradmin/.gitconfig
 
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: matrix.os == 'ubuntu-24.04' && matrix.rust-toolchain == 'stable' && matrix.type == 'debug'
+        with:
+          name: lcov-coverage
+          path: lcov.info
+          retention-days: 1
+
       - uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
         with:
           files: codecov.json
@@ -161,6 +169,33 @@ jobs:
           path: simulation-seeds
           compression-level: 9
 
+  crap:
+    name: CRAP analysis
+    needs: check
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      security-events: write # for uploading SARIF to code scanning
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: lcov-coverage
+
+      - uses: mozilla/actions/crap@2e46408d5c495e59a21e5e125e82008fad0d9408 # v1.1.7
+        with:
+          lcov-path: lcov.info
+          threshold: "30"
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        with:
+          sarif_file: crap.sarif
+          category: cargo-crap
+
   check-cargo-lock:
     name: Ensure `Cargo.lock` contains all required dependencies
     runs-on: ubuntu-24.04