ci: Deduplicate checks and tests

.github/workflows/pr_security-checks.yml

@@ -0,0 +1,59 @@
+---
+name: Security Checks
+
+on:
+  pull_request:
+
+env:
+  CARGO_TERM_COLOR: always
+  CARGO_INCREMENTAL: "0"
+  CARGO_PROFILE_DEV_DEBUG: "0"
+  RUST_TOOLCHAIN_VERSION: "1.89.0"
+  RUSTFLAGS: "-D warnings"
+  RUSTDOCFLAGS: "-D warnings"
+  RUST_LOG: "info"
+
+permissions: {}
+
+jobs:
+  # Identify unused dependencies
+  cargo-udeps:
+    name: Run Cargo Udeps
+    runs-on: ubuntu-latest
+    env:
+      RUSTC_BOOTSTRAP: 1
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
+      - uses: Swatinem/rust-cache@f13886b937689c021905a6b90929199931d60db1 # v2.8.1
+        with:
+          key: udeps
+      - run: cargo install --locked cargo-udeps@0.1.59
+      - run: cargo udeps --all-targets --all-features
+
+  cargo-deny:
+    name: Run Cargo Deny
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        checks:
+          - advisories
+          - bans licenses sources
+
+    # Prevent sudden announcement of a new advisory from failing ci:
+    continue-on-error: ${{ matrix.checks == 'advisories' }}
+
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
+      - uses: EmbarkStudios/cargo-deny-action@76cd80eb775d7bbbd2d80292136d74d39e1b4918 # v2.0.14
+        with:
+          command: check ${{ matrix.checks }}

.pre-commit-config.yaml

@@ -47,6 +47,30 @@ repos:
         stages: [pre-commit, pre-merge-commit, manual]
         pass_filenames: false
 
+      - id: cargo-doc
+        name: cargo-doc
+        language: system
+        entry: cargo doc --document-private-items
+        stages: [pre-commit, pre-merge-commit]
+        pass_filenames: false
+        files: \.rs$|Cargo\.(toml|lock)
+
+      - id: cargo-test-no-default-features
+        name: cargo-test-no-default-features
+        language: system
+        entry: cargo test --no-default-features --workspace
+        stages: [pre-commit, pre-merge-commit]
+        pass_filenames: false
+        files: \.rs$|Cargo\.(toml|lock)
+
+      - id: cargo-test-all-features
+        name: cargo-test-all-features
+        language: system
+        entry: cargo test --all-features --workspace
+        stages: [pre-commit, pre-merge-commit]
+        pass_filenames: false
+        files: \.rs$|Cargo\.(toml|lock)
+
       - id: cargo-rustfmt
         name: cargo-rustfmt
         language: system