chore(ci): harden distribution and rewrite the docs

.github/workflows/ci.yml

@@ -13,6 +13,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 env:
   CARGO_INCREMENTAL: 0
   CARGO_NET_RETRY: 10

.github/workflows/docker-publish.yml

@@ -15,9 +15,25 @@ env:
   IMAGE_NAME: pixincreate/keywatch
 
 jobs:
+  test:
+    name: Test before publish
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: stable
+
+      - name: Run tests
+        run: cargo test --release --locked
+
   build-and-push:
     name: Build and push Docker image
     runs-on: ubuntu-latest
+    needs: test
 
     steps:
       - name: Checkout repository

.github/workflows/release.yml

@@ -114,10 +114,6 @@ jobs:
         with:
           targets: ${{ matrix.platform.target }}
 
-      - name: Add aarch64 Apple target
-        if: matrix.platform.target == 'aarch64-apple-darwin'
-        run: rustup target add aarch64-apple-darwin
-
       # Build the specific package
       - name: Build Binary
         run: |
@@ -167,3 +163,27 @@ jobs:
           prerelease: false
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  major-tag:
+    name: update-major-tag
+    needs: release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Move the major tag to this release
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          case "$REF_NAME" in
+            *-*) echo "Prerelease tag; major tag not moved."; exit 0 ;;
+          esac
+          major="${REF_NAME%%.*}"
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git tag -fa "$major" -m "Update $major tag"
+          git push origin "$major" --force

.github/workflows/update-baseline.yml

@@ -33,12 +33,14 @@ jobs:
       - name: Open pull request if the baseline changed
         env:
           GH_TOKEN: ${{ github.token }}
+          BASE_REF: ${{ github.ref_name }}
+          RUN_ID: ${{ github.run_id }}
         run: |
           if [ -z "$(git status --porcelain -- .keywatch-baseline.json)" ]; then
             echo "Baseline unchanged; nothing to do."
             exit 0
           fi
-          branch="chore/update-baseline-${{ github.run_id }}"
+          branch="chore/update-baseline-${RUN_ID}"
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git checkout -b "$branch"
@@ -48,4 +50,4 @@ jobs:
           gh pr create \
             --title "chore: update keywatch baseline" \
             --body "Regenerated by the update-baseline workflow. Review every newly baselined finding before merging: each entry is a finding KeyWatch will stop reporting." \
-            --base "${{ github.ref_name }}"
+            --base "$BASE_REF"