Update the Base project tooling to base-project 0.1.7.

.github/workflows/publish.yml

@@ -1,3 +1,8 @@
+# SECURITY: Actions are pinned to release tags, not commit SHAs, so whoever controls an
+# action could move its tag and run new code in jobs that hold `id-token` or `contents`
+# write permissions. This is accepted because each action comes from GitHub, the Rust
+# project, or the maintainer of `dtolnay/rust-toolchain`, who already control the runner,
+# the toolchain, or the publishing this workflow trusts; pin them to SHAs if that changes.
 name: Publish to crates.io
 
 on:
@@ -22,11 +27,12 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy, rustfmt
       - name: Install Bake launcher
-        run: cargo install bake --locked
+        run: cargo install bake --version 0.20.1 --locked
       - name: Detect an explicit release request
         id: detect
         env:
@@ -58,9 +64,10 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
       - name: Install Bake launcher
-        run: cargo install bake --locked
+        run: cargo install bake --version 0.20.1 --locked
       - name: Find workspace packages that need publishing
         id: packages
         env:

.github/workflows/test.yml

@@ -33,9 +33,28 @@ jobs:
       - name: Run tests and require complete source-region coverage
         run: cargo bake --locked test:coverage --all-targets true
 
+  minimum-rust:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v7
+      - name: Read the declared minimum Rust version
+        id: rust-version
+        run: |
+          version=$(sed -n 's/^rust-version = "\(.*\)"$/\1/p' Cargo.toml | head -n 1)
+          test -n "$version" || { echo "Cargo.toml declares no rust-version" >&2; exit 1; }
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ steps.rust-version.outputs.version }}
+      - name: Build the publishable packages with the declared minimum Rust version
+        run: |
+          packages=$(cargo metadata --no-deps --format-version 1 --locked | jq -r '.packages[] | select(.publish != []) | "--package=\(.name)"')
+          cargo check $packages --all-targets --locked
+
   test-result:
     if: always()
-    needs: [test]
+    needs: [test, minimum-rust]
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:

agents.md

@@ -4,4 +4,6 @@ Run `cargo bake agent:context:install` to install dependency context and skills,
 
 Before planning or changing behavior, discover and read applicable `design/*.md`. Use `base-design-review` to assess plans and changes, and `base-design-author` when user requirements are introduced, changed, or removed. Review design compliance before opening or updating a pull request.
 
+Use `base-security-audit` when reviewing code for security issues, and record each review in `security/audit-*.md`. Use `base-security-advisory` for vulnerability reports and for findings that may warrant an advisory. Before reporting a security finding, read the relevant `// SECURITY:` comments and `design/*.md`.
+
 Keep runtime dependencies independent of concrete schedulers. Libraries use ordinary `tracing` events; application setup, formatting, and captured failure diagnostics belong here. Development tooling belongs in the private `bake/` package. CI requires complete source-region coverage across all targets: run `cargo bake test:coverage --all-targets true`.

bake/Cargo.toml

@@ -6,5 +6,5 @@ publish = false
 
 [dependencies]
 bake = ">=0.20, <1"
-base-project = ">=0.1.0"
+base-project = ">=0.1.7"
 

readme.md

@@ -71,7 +71,7 @@ See the [API documentation](https://docs.rs/base-console) for writers, filters,
 
 ## Releasing
 
-Prepare a release with `cargo bake cargo:version:patch` (or `minor`, `major`, or `bump --version X.Y.Z`), commit it with a `Release: vVERSION` trailer, then run `cargo bake cargo:release` and open a pull request. After review and merge, GitHub Actions publishes the release when the configured `crates-io` environment approves it, then creates or updates the matching GitHub Release from `releases.md`. Follow the shared [Releasing skill](https://github.com/base-rs/base-project/blob/main/context/releasing.md) for the standard process.
+Prepare a release with `cargo bake cargo:release:patch` (or `minor`, `major`, or `bump --version X.Y.Z`), which bumps the version, commits it with a `Release: vVERSION` trailer, validates it and opens the release pull request. After review and merge, GitHub Actions publishes the release when the configured `crates-io` environment approves it, then creates or updates the matching GitHub Release from `releases.md`. Follow the shared [Releasing skill](https://github.com/base-rs/base-project/blob/main/context/releasing.md) for the standard process.
 
 ## Releases