rust-tooling-cicd

Run the canonical gate in fixed order: cargo fmt --check, cargo clippy with -D warnings, cargo deny check, cargo audit, cargo nextest run, cargo test --doc, then cargo llvm-cov for coverage. The Skill provides a ready-to-copy ci.yml implementing this as four jobs.

Declare versions once in the root [workspace.dependencies] table, then inherit them in each member with dep.workspace = true. This creates a single source of truth and prevents the same crate being pinned at different versions across members.

cargo-deny is a policy engine covering licenses, banned or duplicate crates, unknown sources, and advisories, while cargo-audit only scans Cargo.lock against the RustSec advisory database. They overlap on advisories but are not redundant, so run both in CI.

cargo nextest never executes doc-tests by design, so doc-tests silently pass CI if nextest is the only test step. Add a separate cargo test --doc step after nextest to cover them.

Declare rust-version in the package or workspace manifest, then run cargo hack check --rust-version to prove the crate builds on it. Use cargo hack --feature-powerset check to verify every feature combination compiles, since features must be additive.

Do not use features for mutually exclusive behavior, because Cargo unifies the union of all requested features across the dependency graph and a downstream crate enabling both gets both. Model mutually exclusive modes as separate crates or APIs instead.