feat(ci): add GitHub Actions CI/CD with security best practices

.github/dependabot.yml

@@ -0,0 +1,19 @@
+version: 2
+updates:
+  # Keep GitHub Actions up to date
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      actions:
+        patterns: ["*"]
+
+  # Keep Rust dependencies up to date
+  - package-ecosystem: "cargo"
+    directory: "/ctxium"
+    schedule:
+      interval: "weekly"
+    groups:
+      rust-deps:
+        patterns: ["*"]

.github/workflows/ci.yml

@@ -0,0 +1,80 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0 # stable
+        with:
+          toolchain: stable
+          components: clippy, rustfmt
+
+      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
+        with:
+          workspaces: ctxium -> target
+
+      - name: Check formatting
+        run: cargo fmt --check --manifest-path ctxium/Cargo.toml
+
+      - name: Clippy
+        run: cargo clippy --manifest-path ctxium/Cargo.toml -- -D warnings
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0 # stable
+        with:
+          toolchain: stable
+
+      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
+        with:
+          workspaces: ctxium -> target
+
+      - name: Run tests
+        run: cargo test --manifest-path ctxium/Cargo.toml
+
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0 # stable
+        with:
+          toolchain: stable
+
+      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
+        with:
+          workspaces: ctxium -> target
+
+      - name: Build release
+        run: cargo build --release --manifest-path ctxium/Cargo.toml
+
+      - name: Upload binary
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: ctxium-linux-x86_64
+          path: ctxium/target/release/ctxium
+          if-no-files-found: error

ctxium/src/bootstrap/codesign.rs

@@ -1,5 +1,6 @@
 //! macOS code signing utilities for bootstrap operations
 
+#[cfg(target_os = "macos")]
 use super::shell::run_command;
 use super::BootstrapError;
 use std::path::Path;
@@ -8,6 +9,7 @@ use std::path::Path;
 ///
 /// This is required for binaries downloaded from the internet on macOS
 /// to avoid "cannot be opened because the developer cannot be verified" errors.
+#[cfg_attr(not(target_os = "macos"), allow(dead_code))]
 pub fn codesign_adhoc(binary_path: &Path) -> Result<(), BootstrapError> {
     #[cfg(target_os = "macos")]
     {
@@ -33,6 +35,7 @@ pub fn codesign_adhoc(binary_path: &Path) -> Result<(), BootstrapError> {
 /// Remove quarantine attribute on macOS
 ///
 /// Downloaded binaries may have a quarantine attribute that prevents execution.
+#[cfg_attr(not(target_os = "macos"), allow(dead_code))]
 pub fn remove_quarantine(path: &Path) -> Result<(), BootstrapError> {
     #[cfg(target_os = "macos")]
     {

ctxium/src/bootstrap/download.rs

@@ -44,7 +44,7 @@ pub async fn download_and_extract(
         extract_tar_gz(&bytes, temp_dir.path())?;
     } else {
         // Just write the file as-is
-        let filename = url.split('/').last().unwrap_or("download");
+        let filename = url.split('/').next_back().unwrap_or("download");
         let file_path = temp_dir.path().join(filename);
         std::fs::write(&file_path, &bytes).map_err(BootstrapError::IoError)?;
     }

ctxium/src/bootstrap/tools/adversarial_spec.rs

@@ -159,12 +159,12 @@ impl ToolInstaller for AdversarialSpecInstaller {
         }
 
         eprintln!("{} adversarial-spec installed", "==>".green());
-        eprintln!("{}", "");
+        eprintln!();
         eprintln!(
             "{} Usage: /adversarial-spec \"your feature description\"",
             "==>".green()
         );
-        eprintln!("{}", "");
+        eprintln!();
         eprintln!("{} API keys (set at least one):", "==>".green());
         eprintln!(
             "{}   OPENAI_API_KEY, ANTHROPIC_API_KEY, GEMINI_API_KEY",

ctxium/src/hookserver.rs

@@ -107,9 +107,9 @@ fn append_to_log(path: &PathBuf, payload: &HookPayload) -> std::io::Result<()> {
 }
 
 fn expand_tilde(path: &str) -> PathBuf {
-    if path.starts_with("~/") {
+    if let Some(stripped) = path.strip_prefix("~/") {
         if let Some(home) = dirs_home() {
-            return PathBuf::from(home).join(&path[2..]);
+            return PathBuf::from(home).join(stripped);
         }
     }
     PathBuf::from(path)