From 7922106f569836bb0b9b18df4b5bd8469e4130c1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=BF=97=E5=AE=87?= <hello@evanlinjin.me>
Date: Fri, 25 Sep 2026 03:40:02 +0000
Subject: [PATCH 1/2] ci: check no_std and WASM builds, harden workflow

Add `Check no_std` and `Check WASM` jobs, modelled on bdk_wallet's CI.
The crate is `#![no_std]` with an optional `std` feature, but nothing
previously built it without default features.

Also set `permissions: {}` and `persist-credentials: false` on every
checkout so jobs don't hold a token they never use.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/test.yml | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index dfac56f..3074b36 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -4,6 +4,7 @@ on:
       - master
   pull_request:
 
+permissions: {}
 
 # Make sure CI fails on all warnings, including Clippy lints
 env:
@@ -16,6 +17,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt
@@ -25,6 +28,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy
@@ -35,6 +40,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@1.54.0
         # don't want dev-dependencies for MSRV check
       - run: sed -i 's/\[dev-dependencies]/[ignore-this-warning-fren]/g' Cargo.toml
@@ -44,6 +51,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
       - run: cargo test --release
 
@@ -52,5 +61,29 @@ jobs:
      runs-on: ubuntu-latest
      steps:
        - uses: actions/checkout@v4
+         with:
+           persist-credentials: false
        - uses: dtolnay/rust-toolchain@stable
        - run:  cargo doc --no-deps
+
+  check-no-std:
+    name: Check no_std
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@stable
+      - run: cargo check --no-default-features
+
+  check-wasm:
+    name: Check WASM
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: wasm32-unknown-unknown
+      - run: cargo check --target wasm32-unknown-unknown --no-default-features

From f2eef938593f9fdef955ab7fdfbbfdb6603aef1d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=BF=97=E5=AE=87?= <hello@evanlinjin.me>
Date: Tue, 20 Oct 2026 13:48:24 +1100
Subject: [PATCH 2/2] fix(dev-deps): cap proptest below 1.12

proptest 1.12 depends on rand 0.10, while our `rand` dev-dependency is
0.9, so a fresh resolve (as CI does, `Cargo.lock` isn't committed) fails
to build the tests with `TestRng: rand::Rng` not satisfied. This broke
the `test` and `clippy_check` jobs on master and every open PR.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.toml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Cargo.toml b/Cargo.toml
index 14cabad..67d04fc 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -22,7 +22,8 @@ std = []
 
 [dev-dependencies]
 rand = "0.9"
-proptest = "1.7"
+# proptest 1.12 moved to rand 0.10; bump both together.
+proptest = ">=1.7, <1.12"
 bitcoin = "0.32"
 criterion = "0.5"