Enable strict clippy with documented allow-list and defensive-coding pass

.cargo/config.toml

@@ -0,0 +1,9 @@
+# Intentionally empty — runners for `wasm32-wasip1` differ per adapter
+# (Viceroy for fastly, Wasmtime for spin) and a single workspace-wide
+# default would silently pick the wrong host ABI for one of them.
+#
+# Per-package configs at `crates/edgezero-adapter-{fastly,spin}/.cargo/`
+# wire up the right runner when cargo is invoked from inside the package
+# directory. For workspace-root invocations, set
+# `CARGO_TARGET_WASM32_WASIP1_RUNNER` explicitly (CI does this in
+# `.github/workflows/test.yml`).

.github/workflows/codeql.yml

@@ -59,7 +59,7 @@ jobs:
  # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
  steps:
  - name: Checkout repository
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
 
  # Add any setup steps before running the `github/codeql-action/init` action.
  # This includes steps like installing compilers or runtimes (`actions/setup-node`

.github/workflows/deploy-docs.yml

@@ -24,7 +24,7 @@ jobs:
  runs-on: ubuntu-latest
  steps:
  - name: Checkout
- uses: actions/checkout@v4
+ uses: actions/checkout@v6
  with:
  fetch-depth: 0 # For lastUpdated feature
 
@@ -38,14 +38,14 @@ jobs:
  fi
 
  - name: Setup Node.js
- uses: actions/setup-node@v4
+ uses: actions/setup-node@v6
  with:
  node-version: ${{ steps.node-version.outputs.node-version }}
  cache: "npm"
  cache-dependency-path: docs/package-lock.json
 
  - name: Setup Pages
- uses: actions/configure-pages@v4
+ uses: actions/configure-pages@v6
 
  - name: Install dependencies
  working-directory: docs
@@ -56,7 +56,7 @@ jobs:
  run: npm run build
 
  - name: Upload artifact
- uses: actions/upload-pages-artifact@v3
+ uses: actions/upload-pages-artifact@v5
  with:
  path: docs/.vitepress/dist
 
@@ -69,4 +69,4 @@ jobs:
  steps:
  - name: Deploy to GitHub Pages
  id: deployment
- uses: actions/deploy-pages@v4
+ uses: actions/deploy-pages@v5

.github/workflows/format.yml

@@ -18,10 +18,10 @@ jobs:
  name: cargo fmt
  runs-on: ubuntu-latest
  steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@v6
 
  - name: Cache cargo dependencies
- uses: actions/cache@v4
+ uses: actions/cache@v5
  with:
  path: |
  ~/.cargo/registry/index/
@@ -52,14 +52,62 @@ jobs:
  - name: Run cargo clippy
  run: cargo clippy --workspace --all-targets --all-features -- -D warnings
 
+ adapter-wasm-clippy:
+ name: ${{ matrix.adapter }} wasm clippy
+ runs-on: ubuntu-latest
+ strategy:
+ fail-fast: false
+ matrix:
+ include:
+ - adapter: cloudflare
+ target: wasm32-unknown-unknown
+ - adapter: fastly
+ target: wasm32-wasip1
+ - adapter: spin
+ target: wasm32-wasip1
+ steps:
+ - uses: actions/checkout@v6
+
+ - name: Cache Cargo dependencies
+ uses: actions/cache@v5
+ with:
+ path: |
+ ~/.cargo/registry/index/
+ ~/.cargo/registry/cache/
+ ~/.cargo/git/db/
+ target/
+ key: ${{ runner.os }}-cargo-${{ matrix.adapter }}-clippy-${{ hashFiles('**/Cargo.lock') }}
+ restore-keys: |
+ ${{ runner.os }}-cargo-${{ matrix.adapter }}-clippy-
+
+ - name: Retrieve Rust version
+ id: rust-version
+ run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+ shell: bash
+
+ - name: Set up Rust tool chain
+ uses: actions-rust-lang/setup-rust-toolchain@v1
+ with:
+ toolchain: ${{ steps.rust-version.outputs.rust-version }}
+ components: clippy
+
+ - name: Add wasm target
+ run: rustup target add ${{ matrix.target }}
+
+ - name: Fetch dependencies (locked)
+ run: cargo fetch --locked
+
+ - name: Clippy ${{ matrix.adapter }} on ${{ matrix.target }}
+ run: cargo clippy -p edgezero-adapter-${{ matrix.adapter }} --features ${{ matrix.adapter }} --target ${{ matrix.target }} --all-targets -- -D warnings
+
  format-docs:
  runs-on: ubuntu-latest
  defaults:
  run:
  working-directory: docs
 
  steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@v6
 
  - name: Retrieve Node.js version
  id: node-version
@@ -68,7 +116,7 @@ jobs:
  shell: bash
 
  - name: Use Node.js
- uses: actions/setup-node@v4
+ uses: actions/setup-node@v6
  with:
  node-version: ${{ steps.node-version.outputs.node-version }}
  cache: "npm"

.github/workflows/test.yml

@@ -18,12 +18,13 @@ jobs:
  name: cargo test
  runs-on: ubuntu-latest
  steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@v6
 
  - name: Cache Cargo dependencies
- uses: actions/cache@v4
+ uses: actions/cache@v5
  with:
  path: |
+ ~/.cargo/bin/
  ~/.cargo/registry/index/
  ~/.cargo/registry/cache/
  ~/.cargo/git/db/
@@ -74,18 +75,19 @@ jobs:
  runner_env: CARGO_TARGET_WASM32_WASIP1_RUNNER
  runner_value: wasmtime run
  steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@v6
 
  - name: Cache Cargo dependencies
- uses: actions/cache@v4
+ uses: actions/cache@v5
  with:
  path: |
+ ~/.cargo/bin/
  ~/.cargo/registry/index/
  ~/.cargo/registry/cache/
  ~/.cargo/git/db/
  ~/.wasmtime/bin/
  target/
- key: ${{ runner.os }}-cargo-${{ matrix.adapter }}-${{ hashFiles('**/Cargo.lock') }}
+ key: ${{ runner.os }}-cargo-${{ matrix.adapter }}-${{ hashFiles('**/Cargo.lock', '.tool-versions') }}
  restore-keys: |
  ${{ runner.os }}-cargo-${{ matrix.adapter }}-
 
@@ -120,36 +122,66 @@ jobs:
  test -n "$version"
  echo "version=$version" >> "$GITHUB_OUTPUT"
 
+ # `--force` is required because the cargo cache may restore an existing
+ # `~/.cargo/bin/<binary>` from a prior run, which `cargo install` rejects
+ # by default. Force-overwriting is safe — `--locked` pins the version.
  - name: Install wasm-bindgen test runner
  if: matrix.adapter == 'cloudflare'
- run: |
- required="${{ steps.wasm-bindgen-version.outputs.version }}"
- if ! command -v wasm-bindgen-test-runner &>/dev/null \
- || ! wasm-bindgen --version 2>/dev/null | grep -q "$required"; then
- cargo install wasm-bindgen-cli --version "$required" --locked --force
- fi
+ run: cargo install wasm-bindgen-cli --version "${{ steps.wasm-bindgen-version.outputs.version }}" --locked --force
+
+ - name: Resolve Viceroy version
+ if: matrix.adapter == 'fastly'
+ id: viceroy-version
+ shell: bash
+ run: echo "version=$(grep '^viceroy ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
 
  - name: Setup Viceroy
  if: matrix.adapter == 'fastly'
- env:
- VICEROY_VERSION: 0.16.5
- run: |
- if ! command -v viceroy &>/dev/null \
- || ! viceroy --version 2>/dev/null | grep -qF "$VICEROY_VERSION"; then
- cargo install viceroy --version "$VICEROY_VERSION" --locked
- fi
+ # Version comes from .tool-versions (single source of truth shared with
+ # local dev).
+ run: cargo install viceroy --version "${{ steps.viceroy-version.outputs.version }}" --locked --force
+
+ - name: Resolve Wasmtime version
+ if: matrix.adapter == 'spin'
+ id: wasmtime-version
+ shell: bash
+ run: echo "version=$(grep '^wasmtime ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
 
  - name: Setup Wasmtime
  if: matrix.adapter == 'spin'
- env:
- WASMTIME_VERSION: v44.0.0
+ # Direct GitHub-release tarball install. The official
+ # `https://wasmtime.dev/install.sh` script broke as of
+ # 2026-05-19 (interpolation failure: tried to download
+ # version literal `{`), so we pin via .tool-versions and
+ # land the binary in `~/.wasmtime/bin/` so the cache step
+ # above actually short-circuits the download on subsequent
+ # runs.
+ #
+ # The cache key now hashes `.tool-versions` too, so a
+ # version bump invalidates the cached binary. We also
+ # explicitly compare `wasmtime --version` against the pin
+ # — without that a runner-provided wasmtime or a stale
+ # cache hit would silently shadow the pinned version.
  run: |
- export PATH="$HOME/.wasmtime/bin:$PATH"
- echo "$HOME/.wasmtime/bin" >> "$GITHUB_PATH"
- if ! command -v wasmtime &>/dev/null \
- || ! wasmtime --version 2>/dev/null | grep -qF "${WASMTIME_VERSION#v}"; then
- curl https://wasmtime.dev/install.sh -sSf | bash -s -- --version "$WASMTIME_VERSION"
+ install_dir="$HOME/.wasmtime/bin"
+ echo "$install_dir" >> "$GITHUB_PATH"
+ export PATH="$install_dir:$PATH"
+ version="${{ steps.wasmtime-version.outputs.version }}"
+ # Compare exact versions so a pin like `44.0.1` does not silently
+ # accept `wasmtime 44.0.10` from a stale cache or runner-provided
+ # binary.
+ actual="$(wasmtime --version 2>/dev/null | awk '{print $2}' || true)"
+ if [ "$actual" != "$version" ]; then
+ tag="v${version}"
+ archive="wasmtime-${tag}-x86_64-linux"
+ mkdir -p "$install_dir"
+ curl -fL "https://github.com/bytecodealliance/wasmtime/releases/download/${tag}/${archive}.tar.xz" -o /tmp/wasmtime.tar.xz
+ tar -xJf /tmp/wasmtime.tar.xz -C /tmp
+ install -m 0755 "/tmp/${archive}/wasmtime" "$install_dir/wasmtime"
  fi
+ actual="$(wasmtime --version | awk '{print $2}')"
+ test "$actual" = "$version"
+ wasmtime --version
 
  - name: Fetch dependencies (locked)
  run: cargo fetch --locked

.gitignore

@@ -33,3 +33,4 @@ docs/superpowers/
 !.vscode/tasks.json
 !.vscode/launch.json
 !.vscode/extensions.json
+*.rlib

.tool-versions

@@ -1,3 +1,5 @@
-fasltly v13.0.0
+fastly 15.1.0
 nodejs 24.12.0
-rust 1.91.1
+rust 1.95.0
+viceroy 0.17.0
+wasmtime 44.0.1

CLAUDE.md

@@ -27,9 +27,9 @@ scripts/ # Build/deploy/test helper scripts
 
 ## Toolchain & Versions
 
-- **Rust**: 1.91.1 (from `.tool-versions`)
+- **Rust**: 1.95.0 (from `.tool-versions`)
 - **Node.js**: 24.12.0 (for docs site only)
-- **Fastly CLI**: v13.0.0
+- **Fastly CLI**: 15.1.0
 - **Edition**: 2021
 - **Resolver**: 2
 - **License**: Apache-2.0