ci: audit and harden GitHub Actions workflows

- Bump all actions to latest versions (checkout@v6, upload-artifact@v7,
  download-artifact@v8, labeler@v6, gh-release@v3, gpg-import@v7)
- Replace fragile curl|bash tool install with taiki-e/install-action@v2
- Fix Swatinem/rust-cache ordering: must run AFTER toolchain install
  for correct cache key derivation
- Add --all-targets to clippy (CI now matches local testing)
- Add RUSTDOCFLAGS=-D warnings to doc step (fail on broken links)
- Fix ARM64 build order: install Rust toolchain before adding target
  and configuring linker
- Add rust-toolchain.toml pinning Rust 1.94.0 for deterministic builds
- Update Cargo.lock: rustls-webpki v0.103.11->v0.103.13 (fixes 3 CVEs)
- Fix softprops/action-gh-release@v3: include checksums in files list
  (v3 removed the checksum input parameter)
- Fix clippy manual_checked_ops lint in screenshot.rs
- Clean up trailing whitespace and missing newlines in YAML files

.github/actions/deps/action.yml

@@ -4,7 +4,7 @@ description: Install system dependencies required for building rustlock
 runs:
   using: composite
   steps:
-    - name: Install system dependencies (Ubuntu/Debian)
+    - name: Install system dependencies for Debian based distros
       shell: bash
       run: |
         sudo apt-get update

.github/labeler.yml

@@ -8,7 +8,7 @@ features:
 
 rendering:
   - changed-files:
-      - any-glob-to-any-file: ['src/render/**', 'src/render.rs']
+      - any-glob-to-any-file: ['src/render/**']
 
 ci:
   - changed-files:
@@ -20,4 +20,4 @@ dependencies:
 
 refactoring:
   - changed-files:
-      - any-glob-to-any-file: ['src/util.rs', 'src/system.rs']
+      - any-glob-to-any-file: ['src/util.rs', 'src/system.rs', 'src/main.rs']

.github/workflows/labeler.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Label PR based on changed files
-        uses: actions/labeler@v5
+        uses: actions/labeler@v6
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           configuration-path: .github/labeler.yml

.github/workflows/quality.yml

@@ -14,8 +14,7 @@ jobs:
   quality-checks:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: Swatinem/rust-cache@v2
+      - uses: actions/checkout@v6
 
       - uses: ./.github/actions/deps
 
@@ -24,14 +23,21 @@ jobs:
         with:
           components: rustfmt, clippy
 
+      - uses: Swatinem/rust-cache@v2
+
       - name: Check formatting
         run: cargo fmt -- --check
 
       - name: Run clippy
-        run: cargo clippy -- -D warnings
+        run: cargo clippy --all-targets -- -D warnings
 
-      - name: Run unit tests
+      - name: Run unit tests (default features)
         run: cargo test --quiet
 
+      - name: Run unit tests (all features)
+        run: cargo test --all-features --quiet
+
       - name: Check documentation
+        env:
+          RUSTDOCFLAGS: -D warnings
         run: cargo doc --no-deps --document-private-items

.github/workflows/release.yml

@@ -9,7 +9,7 @@ env:
   CARGO_TERM_COLOR: always
 
 jobs:
-  release-build:
+  release-build-x86:
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -33,7 +33,7 @@ jobs:
     container: ${{ matrix.distro == 'ubuntu' && 'ubuntu:latest' || matrix.distro == 'debian' && 'debian:stable-slim' || matrix.distro == 'fedora' && 'fedora:latest' || 'archlinux:latest' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install system dependencies (Ubuntu/Debian)
         if: matrix.distro == 'ubuntu' || matrix.distro == 'debian'
@@ -75,31 +75,118 @@ jobs:
         run: cargo build --release ${{ matrix.args }}
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: rustlock-${{ matrix.variant }}-${{ matrix.distro }}
           path: target/release/rustlock
 
+  release-build-arm64:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - variant: "default"
+            args: ""
+            target: "aarch64-unknown-linux-gnu"
+          - variant: "no-networking"
+            args: "--no-default-features"
+            target: "aarch64-unknown-linux-gnu"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install cross-compilation toolchain
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            curl \
+            llvm clang libclang-dev \
+            pkg-config \
+            libglib2.0-dev libcairo2-dev libpango1.0-dev libatk1.0-dev \
+            libgdk-pixbuf-2.0-dev libpam0g-dev libdbus-1-dev \
+            libwayland-dev libxkbcommon-dev \
+            gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
+
+      - name: Add ARM target
+        run: rustup target add aarch64-unknown-linux-gnu
+
+      - name: Configure cross-compilation linker
+        run: |
+          mkdir -p ~/.cargo
+          echo '[target.aarch64-unknown-linux-gnu]
+          linker = "aarch64-linux-gnu-gcc"' >> ~/.cargo/config.toml
+
+      - name: Build ${{ matrix.variant }} (ARM64)
+        run: cargo build --release --target aarch64-unknown-linux-gnu ${{ matrix.args }}
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: rustlock-${{ matrix.variant }}-arm64
+          path: target/aarch64-unknown-linux-gnu/release/rustlock
+
+  publish-crates:
+    runs-on: ubuntu-latest
+    needs: [release-build-x86]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Publish to crates.io
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+        run: cargo publish
+
   release:
     runs-on: ubuntu-latest
-    needs: [release-build]
+    needs: [release-build-x86, release-build-arm64, publish-crates]
     permissions:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
 
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: artifacts
 
+      - name: Generate checksums
+        working-directory: artifacts
+        run: |
+          find . -type f -name "rustlock" -exec sha256sum {} \; > SHA256SUMS.txt
+          cat SHA256SUMS.txt
+
+      - name: Import GPG key
+        id: import_gpg
+        uses: crazy-max/ghaction-import-gpg@v7
+        with:
+          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.GPG_PASSPHRASE }}
+          git_config_global: true
+          git_user_name: JorySeverijnse
+          git_user_email: jory@severijnse.com
+
+      - name: Sign checksums
+        working-directory: artifacts
+        run: |
+          gpg --armor --detach-sign SHA256SUMS.txt
+
       - name: Determine tag
         id: tag
         run: echo "VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
 
       - name: Create Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ github.ref_name }}
           name: RustLock v${{ steps.tag.outputs.VERSION }}
@@ -111,3 +198,8 @@ jobs:
             artifacts/rustlock-default-debian/rustlock
             artifacts/rustlock-default-fedora/rustlock
             artifacts/rustlock-default-arch/rustlock
+            artifacts/rustlock-default-arm64/rustlock
+            artifacts/rustlock-no-networking-arm64/rustlock
+            artifacts/SHA256SUMS.txt
+            artifacts/SHA256SUMS.txt.asc
+          generate_release_notes: true

.github/workflows/security.yml

@@ -19,17 +19,17 @@ jobs:
   security-audit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: Swatinem/rust-cache@v2
+      - uses: actions/checkout@v6
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
 
+      - uses: Swatinem/rust-cache@v2
+
       - name: Install security tools
-        run: |
-          curl -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash
-          cargo binstall --no-confirm cargo-audit cargo-deny cargo-cyclonedx cargo-outdated || \
-          cargo install cargo-audit cargo-deny cargo-cyclonedx cargo-outdated
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-audit,cargo-deny,cargo-cyclonedx,cargo-outdated
 
       - name: Run cargo audit
         run: cargo audit
@@ -41,7 +41,7 @@ jobs:
         run: cargo cyclonedx --format json --override-filename bom
 
       - name: Upload SBOM
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: sbom
           path: bom.json
@@ -49,12 +49,3 @@ jobs:
       - name: Check for outdated dependencies
         run: cargo outdated --exit-code 1 || echo "Some dependencies are outdated"
 
-      - name: Security summary
-        run: |
-          echo "=== Security Scan Complete ==="
-          echo "✅ cargo audit - Vulnerability scanning"
-          echo "✅ cargo deny - Advisory and license checking"
-          echo "✅ SBOM generated - Software Bill of Materials"
-          echo "✅ Outdated dependencies checked"
-          echo ""
-          echo "Next scheduled scan: Weekly (Sunday 00:00 UTC)"

Cargo.lock

@@ -2147,9 +2147,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.11"
+version = "0.103.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20a6af516fea4b20eccceaf166e8aa666ac996208e8a644ce3ef5aa783bc7cd4"
+checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
 dependencies = [
  "ring",
  "rustls-pki-types",

rust-toolchain.toml

@@ -0,0 +1,3 @@
+[toolchain]
+channel = "1.94.0"
+components = ["rustfmt", "clippy"]

src/screenshot.rs

@@ -171,9 +171,9 @@ impl Screenshot {
                 }
 
                 if count > 0 {
-                    let r = (r / count) as u8;
-                    let g = (g / count) as u8;
-                    let b = (b / count) as u8;
+                    let r = r.checked_div(count).unwrap_or(0) as u8;
+                    let g = g.checked_div(count).unwrap_or(0) as u8;
+                    let b = b.checked_div(count).unwrap_or(0) as u8;
 
                     // Fill the block
                     for py in 0..pixel_size {