Update .github/workflows/semver.yml

Author: Not-Nik

.github/workflows/semver.yml

@@ -31,7 +31,12 @@ jobs:
       - name: Get latest tag
         id: tag
         run: |
-          echo "ref=$(git tag --sort=-creatordate | head -n 1)" >> "$GITHUB_OUTPUT"
+          TAG=$(git tag --sort=-version:refname | head -n 1)
+          if [ -z "$TAG" ]; then
+            echo "::error::No tags found; cannot determine semver baseline"
+            exit 1
+          fi
+          echo "ref=$TAG" >> "$GITHUB_OUTPUT"
 
       - uses: mozilla/actions/nss@25cb84d060946c0ad6d2c3f79da479b16d180d71 # v1.1.0
         with:

CLAUDE.md

@@ -0,0 +1,86 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+nss-rs provides a safe, idiomatic Rust interface to Mozilla's NSS (Network Security Services) cryptographic library. It originated from neqo-crypto in mozilla-central and is primarily for use in Gecko, though it supports standalone use. API stability is NOT a goal.
+
+## Build Prerequisites
+
+- NSS libraries must be available. The build system resolves NSS in this order:
+  1. `NSS_DIR` env var (absolute path to NSS source; will build NSS from source unless `NSS_PREBUILT=1`)
+  2. `pkg-config` (uses system-installed NSS)
+  3. Falls back to cloning NSS/NSPR from hg.mozilla.org and building from source
+- Minimum NSS version: defined in `min_version.txt` (currently 3.121)
+- Rust edition 2024, MSRV 1.90.0
+- On macOS, build.rs auto-detects Xcode's libclang. On Windows, set `LIBCLANG_PATH` or `MOZBUILD_STATE_PATH`.
+
+## Common Commands
+
+```bash
+# Build
+cargo build
+
+# Run all tests
+cargo test
+
+# Run a single test
+cargo test <test_name>
+
+# Clippy (CI runs with -D warnings and feature powerset)
+cargo clippy --workspace --all-targets -- -D warnings
+cargo hack clippy --feature-powerset --no-dev-deps --exclude-features gecko -- -D warnings
+
+# Format
+cargo fmt
+cargo fmt --check
+
+# Doc check (matches CI)
+RUSTDOCFLAGS="--deny rustdoc::broken_intra_doc_links --deny warnings" cargo doc --workspace --no-deps --document-private-items
+
+# Dependency check
+cargo machete
+```
+
+## Architecture
+
+**Single crate** (`nss-rs`) with a `test-fixture` helper crate for tests.
+
+### Build System (`build.rs`)
+- Uses `bindgen` to generate Rust FFI bindings from C headers in `bindings/`
+- Binding configuration is in `bindings/bindings.toml` — each section maps to a `.h` file and specifies which types/functions/variables to expose
+- Handles three modes: Gecko (`gecko` feature + mozbuild), standalone with NSS_DIR, or pkg-config
+- Debug builds link statically; release builds link dynamically
+
+### Key Source Modules
+- `lib.rs` — NSS initialization (`init()`, `init_db()`), re-exports public API
+- `agent.rs`, `agentio.rs` — TLS agent (client/server) implementation
+- `aead.rs`, `hkdf.rs`, `hp.rs`, `hmac.rs`, `hash.rs` — Cryptographic primitives
+- `p11.rs`, `pk11_utils.rs` — PKCS#11 key management wrappers
+- `err.rs`, `result.rs` — Error types and `Res<T>` alias
+- `ssl.rs`, `secrets.rs` — SSL options and secret management
+- `ech.rs` — Encrypted Client Hello support
+- `selfencrypt.rs` — Self-encryption utilities
+- `ext.rs` — TLS extension handling
+- `time.rs` — Time abstraction (Instant::now() is denied project-wide)
+
+### FFI Pattern
+Generated bindings are organized into internal modules (`nss_prelude`, `nss`, `ssl`, etc.) via `include!(concat!(env!("OUT_DIR"), "/<name>.rs"))`. Public types like `SECItem`, `SECStatus` are re-exported from `nss_prelude`.
+
+### Features
+- `gecko` — Build within Gecko/mozilla-central (uses mozbuild)
+- `disable-encryption` / `disable-random` — Testing features
+- `deny-warnings` — Treat warnings as errors
+- `bench` — Benchmark support
+
+## Lint Configuration
+
+Extensive clippy lints are configured in `Cargo.toml`. Key policies:
+- `clippy::unwrap_used` and `clippy::get_unwrap` are **warn** — prefer `expect()` or proper error handling
+- `clippy::pedantic` and `clippy::nursery` lint groups are enabled
+- `Instant::now()` usage is denied — use the `time` module abstraction instead
+
+## Test Fixture
+
+Tests use `test-fixture` crate which initializes NSS with a test database (`test-fixture/db/`). Call `fixture_init()` or use helpers like `now()` and `anti_replay()` that auto-initialize.