build(deps): bump actions/checkout from 7.0.0 to 7.0.1

.github/workflows/attest.yml

@@ -0,0 +1,64 @@
+name: Attest
+
+on:
+  workflow_call:
+    inputs:
+      include-macro:
+        required: true
+        type: boolean
+
+permissions:
+  contents: read
+  id-token: write
+  attestations: write
+  artifact-metadata: write
+
+jobs:
+  attest:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - name: Check out source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+
+      - name: Install pinned Rust toolchain
+        run: rustup toolchain install 1.96.1 --profile minimal
+
+      - name: Build release package
+        run: |
+          cargo +1.96.1 package -p hiway --locked --no-verify
+          if [[ "${{ inputs.include-macro }}" == "true" ]]; then
+            cargo +1.96.1 package -p hiway-macros --locked --no-verify
+          fi
+
+      - name: Generate CycloneDX SBOM
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610
+        with:
+          path: .
+          format: cyclonedx-json
+          output-file: target/package/hiway.cdx.json
+          upload-artifact: false
+          upload-release-assets: false
+
+      - name: Attest release packages
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6
+        with:
+          subject-path: target/package/*.crate
+
+      - name: Attest release SBOM
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6
+        with:
+          subject-path: target/package/*.crate
+          sbom-path: target/package/hiway.cdx.json
+
+      - name: Upload release evidence
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: release-evidence-${{ github.sha }}
+          path: |
+            target/package/*.crate
+            target/package/hiway.cdx.json
+          if-no-files-found: error
+          retention-days: 90

.github/workflows/release.yml

@@ -0,0 +1,124 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+  id-token: write
+  attestations: write
+  artifact-metadata: write
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  prepare:
+    runs-on: ubuntu-24.04
+    outputs:
+      publish-macro: ${{ steps.versions.outputs.publish-macro }}
+    steps:
+      - name: Check out source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+
+      - name: Install pinned Rust toolchain
+        run: rustup toolchain install 1.96.1 --profile minimal
+
+      - name: Check release versions
+        id: versions
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          metadata="$(cargo +1.96.1 metadata --no-deps --format-version 1)"
+          hiway_version="$(jq -r '.packages[] | select(.name == "hiway") | .version' <<<"$metadata")"
+          macro_version="$(jq -r '.packages[] | select(.name == "hiway-macros") | .version' <<<"$metadata")"
+          macro_requirement="$(jq -r '.packages[] | select(.name == "hiway") | .dependencies[] | select(.name == "hiway-macros") | .req' <<<"$metadata")"
+
+          [[ "$GITHUB_REF_NAME" == "v$hiway_version" ]]
+          [[ "$macro_requirement" == "=$macro_version" ]]
+
+          response_file="$RUNNER_TEMP/hiway-macros.json"
+          status="$(curl --silent --show-error --header 'User-Agent: hiway-release' --output "$response_file" --write-out '%{http_code}' "https://crates.io/api/v1/crates/hiway-macros/$macro_version")"
+          case "$status" in
+            200)
+              jq -e --arg version "$macro_version" '.version.num == $version and .version.yanked == false' "$response_file" >/dev/null
+              publish_macro=false
+              ;;
+            404)
+              publish_macro=true
+              ;;
+            *)
+              echo "crates.io returned HTTP $status for hiway-macros $macro_version" >&2
+              exit 1
+              ;;
+          esac
+
+          echo "publish-macro=$publish_macro" >> "$GITHUB_OUTPUT"
+
+  publish:
+    needs: prepare
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    environment:
+      name: crates-io
+      url: https://crates.io/crates/hiway
+    steps:
+      - name: Check out source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+
+      - name: Install pinned Rust toolchain
+        run: rustup toolchain install 1.96.1 --profile minimal
+
+      - name: Publish missing macro version
+        if: needs.prepare.outputs.publish-macro == 'true'
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+        run: cargo +1.96.1 publish -p hiway-macros --locked
+
+      - name: Wait for macro version in the registry
+        if: needs.prepare.outputs.publish-macro == 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+          for attempt in $(seq 1 30); do
+            status="$(curl --silent --show-error --header 'User-Agent: hiway-release' --output /dev/null --write-out '%{http_code}' "https://crates.io/api/v1/crates/hiway-macros/$(cargo +1.96.1 metadata --no-deps --format-version 1 | jq -r '.packages[] | select(.name == "hiway-macros") | .version')")"
+            if [[ "$status" == "200" ]]; then
+              exit 0
+            fi
+            sleep 4
+          done
+          echo "hiway-macros was not visible on crates.io" >&2
+          exit 1
+
+      - name: Validate published dependency resolution
+        run: |
+          for attempt in $(seq 1 30); do
+            if cargo +1.96.1 package -p hiway --locked --no-verify >/dev/null 2>&1; then
+              exit 0
+            fi
+            sleep 4
+          done
+          echo "hiway could not resolve its published macro dependency" >&2
+          exit 1
+
+      - name: Publish hiway
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+        run: cargo +1.96.1 publish -p hiway --locked
+
+  attest:
+    needs:
+      - prepare
+      - publish
+    uses: ./.github/workflows/attest.yml
+    with:
+      include-macro: ${{ needs.prepare.outputs.publish-macro == 'true' }}
+    secrets: inherit

.github/workflows/tests.yml

@@ -0,0 +1,66 @@
+name: Tests
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: tests-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - name: Check out source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+
+      - name: Install pinned Rust toolchain
+        run: >-
+          rustup toolchain install 1.96.1
+          --profile minimal
+          --component clippy
+          --component rustfmt
+          --target thumbv7em-none-eabi
+
+      - name: Install dependency policy checker
+        run: cargo +1.96.1 install cargo-deny --version 0.19.8 --locked
+
+      - name: Check formatting
+        run: cargo +1.96.1 fmt --all -- --check
+
+      - name: Test supported feature sets
+        run: |
+          cargo +1.96.1 test --workspace --locked
+          cargo +1.96.1 test --workspace --all-features --locked
+          cargo +1.96.1 test -p hiway --no-default-features --locked
+          cargo +1.96.1 test -p hiway --doc --locked
+          cargo +1.96.1 test -p hiway --no-default-features --doc --locked
+
+      - name: Check no_std target
+        run: |
+          cargo +1.96.1 check -p hiway --no-default-features --target thumbv7em-none-eabi --locked
+          cargo +1.96.1 check -p hiway-tests --lib --no-default-features --target thumbv7em-none-eabi --locked
+          cargo +1.96.1 build -p hiway-tests --bin embedded --no-default-features --target thumbv7em-none-eabi --locked
+
+      - name: Lint supported feature sets
+        run: |
+          cargo +1.96.1 clippy --workspace --all-targets --all-features --locked -- -D warnings -W clippy::pedantic
+          cargo +1.96.1 clippy -p hiway --no-default-features --all-targets --locked -- -D warnings -W clippy::pedantic
+
+      - name: Bounded Loom model (preemption=2; Hiway locks/atomics)
+        env:
+          RUSTFLAGS: --cfg loom
+        run: |
+          cargo +1.96.1 clippy -p hiway-loom --all-targets --locked -- -D warnings -W clippy::pedantic
+          cargo +1.96.1 test -p hiway-loom --locked
+
+      - name: Check dependency policy
+        run: cargo +1.96.1 deny check