ci-battery-pack

A battery pack for GitHub Actions CI in Rust projects. Generates pinned workflows with the project’s MSRV.

Adding CI to an existing project

Each workflow or scaffold is available as a standalone template you can merge into your project with cargo bp add:

cargo bp add ci -t spellcheck
cargo bp add ci -t fuzzing -d ci_platform=github
cargo bp add ci -t security-scanning
cargo bp add ci -t dependency-policy
cargo bp add ci -t trusted-publishing

New files are written directly. For existing files, TOML and YAML are merged (new keys added, existing keys preserved), and other file types prompt you to skip, overwrite, or view a diff. See the templates docs for the full merge behavior and flags.

Available standalone templates: benchmarks, binary-release, clippy-sarif, dependency-policy, fuzzing, mdbook, mutation-testing, security-scanning, spellcheck, stress-test, trusted-publishing, xtask.

Preview any template before applying it:

cargo bp show ci -t fuzzing
cargo bp show ci -t full -d benchmarks -d fuzzing

Creating a new project

The full template scaffolds a complete project (Cargo.toml, src/lib.rs, README with badges) plus CI configuration:

cargo bp new ci --name my-project

Use -d all to enable every optional feature, or pass individual flags:

cargo bp new ci --name my-project -d benchmarks -d fuzzing -d spellcheck

What the full template generates

Core CI (GitHub Actions)

• CI workflow: fmt, clippy, warnings check, docsrs check, build matrix (stable × nightly), feature powerset, MSRV, semver-checks, gate job
• RustSec audit workflow
• Dependency policy workflow
• Dependabot config for Cargo and GitHub Actions updates

Template flags

SHA pinning

All GitHub Actions are pinned to commit SHAs at generation time per GitHub’s security guidance. Use Dependabot to keep them up to date.

Setup

After generating your project, set ci-pass as the required status check in branch protection.

release-plz

1. Configure trusted publishing on crates.io
2. In repo settings → Actions → General, enable “Allow GitHub Actions to create and approve pull requests”

Without binary_release, GITHUB_TOKEN works fine and no further setup is needed.

If you enabled binary_release, you also need a PAT so the release event triggers the binary build:

1. Create a fine-grained PAT with contents: write and pull-requests: write for your repo
2. Add it as a RELEASE_PLZ_TOKEN repo secret

Alternatively, you can avoid the PAT by moving the binary build steps into the release workflow itself.

See release-plz docs for more.

Bencher (if benchmarks enabled)

1. Create a project on Bencher
2. Add BENCHER_API_TOKEN as a repo secret
3. Add your project slug as a BENCHER_PROJECT repo variable

Clippy SARIF (if clippy_sarif enabled)

Uploads clippy results to GitHub Code Scanning, showing warnings as inline PR annotations. Works automatically on public repos. For private repos, enable Code Scanning at Settings → Security → Code security.

mdBook (if mdbook enabled)

Enable GitHub Pages in repo settings (Settings → Pages → Source: GitHub Actions).

Dependency policy (if dependency_policy enabled)

Review deny.toml before enforcing it; license policy is project-specific.

License

Licensed under either of:

• Apache License, Version 2.0
• MIT license

at your option.

Battery pack contents

Documentation

Code Quality

Static analysis and testing tools

Dependencies

Templates