From 7922106f569836bb0b9b18df4b5bd8469e4130c1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=BF=97=E5=AE=87?= <hello@evanlinjin.me>
Date: Fri, 25 Sep 2026 03:40:02 +0000
Subject: [PATCH] ci: check no_std and WASM builds, harden workflow

Add `Check no_std` and `Check WASM` jobs, modelled on bdk_wallet's CI.
The crate is `#![no_std]` with an optional `std` feature, but nothing
previously built it without default features.

Also set `permissions: {}` and `persist-credentials: false` on every
checkout so jobs don't hold a token they never use.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/test.yml | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index dfac56f..3074b36 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -4,6 +4,7 @@ on:
       - master
   pull_request:
 
+permissions: {}
 
 # Make sure CI fails on all warnings, including Clippy lints
 env:
@@ -16,6 +17,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt
@@ -25,6 +28,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy
@@ -35,6 +40,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@1.54.0
         # don't want dev-dependencies for MSRV check
       - run: sed -i 's/\[dev-dependencies]/[ignore-this-warning-fren]/g' Cargo.toml
@@ -44,6 +51,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
       - run: cargo test --release
 
@@ -52,5 +61,29 @@ jobs:
      runs-on: ubuntu-latest
      steps:
        - uses: actions/checkout@v4
+         with:
+           persist-credentials: false
        - uses: dtolnay/rust-toolchain@stable
        - run:  cargo doc --no-deps
+
+  check-no-std:
+    name: Check no_std
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@stable
+      - run: cargo check --no-default-features
+
+  check-wasm:
+    name: Check WASM
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: wasm32-unknown-unknown
+      - run: cargo check --target wasm32-unknown-unknown --no-default-features