Enable strict clippy with documented allow-list and defensive-coding pass

.cargo/config.toml

@@ -0,0 +1,11 @@
+# Workspace-level cargo config so wasm32-wasip1 tests run from the workspace
+# root via `-p <crate>`. Per-package `.cargo/config.toml` files only apply
+# when cwd is inside the package directory; this file makes the runners
+# discoverable from anywhere in the tree.
+#
+# Cargo invokes the runner with cwd set to the package's manifest directory
+# (e.g. `crates/edgezero-adapter-fastly/`), so the `-C` argument is relative
+# to that — `../../examples/...` resolves to the same fastly.toml regardless
+# of which adapter package is being tested.
+[target.wasm32-wasip1]
+runner = "viceroy run -C ../../examples/app-demo/crates/app-demo-adapter-fastly/fastly.toml -- "

.github/workflows/codeql.yml

@@ -59,7 +59,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       # Add any setup steps before running the `github/codeql-action/init` action.
       # This includes steps like installing compilers or runtimes (`actions/setup-node`

.github/workflows/deploy-docs.yml

@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0 # For lastUpdated feature
 
@@ -38,7 +38,7 @@ jobs:
           fi
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: ${{ steps.node-version.outputs.node-version }}
           cache: "npm"

.github/workflows/format.yml

@@ -18,10 +18,10 @@ jobs:
     name: cargo fmt
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Cache cargo dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cargo/bin/
@@ -60,7 +60,7 @@ jobs:
         working-directory: docs
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Retrieve Node.js version
         id: node-version
@@ -69,7 +69,7 @@ jobs:
         shell: bash
 
       - name: Use Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: ${{ steps.node-version.outputs.node-version }}
           cache: "npm"

.github/workflows/test.yml

@@ -18,10 +18,10 @@ jobs:
     name: cargo test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Cache Cargo dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cargo/bin/
@@ -46,12 +46,6 @@ jobs:
       - name: Add wasm targets
         run: rustup target add wasm32-wasip1 wasm32-unknown-unknown
 
-      - name: Setup Viceroy
-        run: |
-          if ! command -v viceroy &>/dev/null; then
-            cargo install viceroy --locked
-          fi
-
       - name: Fetch dependencies (locked)
         run: cargo fetch --locked
 
@@ -61,42 +55,56 @@ jobs:
       - name: Check feature compilation
         run: cargo check --workspace --all-targets --features "fastly cloudflare spin"
 
-      - name: Check Spin wasm32 compilation
-        run: cargo check -p edgezero-adapter-spin --target wasm32-wasip1 --features spin
-
-  cloudflare-wasm-tests:
-    name: cloudflare wasm tests
+  adapter-wasm-tests:
+    name: ${{ matrix.adapter }} wasm tests
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - adapter: cloudflare
+            target: wasm32-unknown-unknown
+            runner_env: CARGO_TARGET_WASM32_UNKNOWN_UNKNOWN_RUNNER
+            runner_value: wasm-bindgen-test-runner
+          - adapter: fastly
+            target: wasm32-wasip1
+            runner_env: CARGO_TARGET_WASM32_WASIP1_RUNNER
+            runner_value: viceroy run
+          - adapter: spin
+            target: wasm32-wasip1
+            runner_env: CARGO_TARGET_WASM32_WASIP1_RUNNER
+            runner_value: wasmtime run
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Cache Cargo dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cargo/bin/
             ~/.cargo/registry/index/
             ~/.cargo/registry/cache/
             ~/.cargo/git/db/
             target/
-          key: ${{ runner.os }}-cargo-cloudflare-${{ hashFiles('**/Cargo.lock') }}
+          key: ${{ runner.os }}-cargo-${{ matrix.adapter }}-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: |
-            ${{ runner.os }}-cargo-cloudflare-
+            ${{ runner.os }}-cargo-${{ matrix.adapter }}-
 
       - name: Retrieve Rust version
-        id: rust-version-cloudflare
+        id: rust-version
         run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
         shell: bash
 
       - name: Set up Rust tool chain
         uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
-          toolchain: ${{ steps.rust-version-cloudflare.outputs.rust-version }}
+          toolchain: ${{ steps.rust-version.outputs.rust-version }}
 
-      - name: Add wasm32 target
-        run: rustup target add wasm32-unknown-unknown
+      - name: Add wasm target
+        run: rustup target add ${{ matrix.target }}
 
       - name: Resolve wasm-bindgen CLI version
+        if: matrix.adapter == 'cloudflare'
         id: wasm-bindgen-version
         shell: bash
         run: |
@@ -113,62 +121,41 @@ jobs:
           test -n "$version"
           echo "version=$version" >> "$GITHUB_OUTPUT"
 
+      # `--force` is required because the cargo cache may restore an existing
+      # `~/.cargo/bin/<binary>` from a prior run, which `cargo install` rejects
+      # by default. Force-overwriting is safe — `--locked` pins the version.
       - name: Install wasm-bindgen test runner
-        run: cargo install wasm-bindgen-cli --version "${{ steps.wasm-bindgen-version.outputs.version }}" --locked
-
-      - name: Fetch dependencies (locked)
-        run: cargo fetch --locked
-
-      - name: Run Cloudflare wasm tests
-        env:
-          CARGO_TARGET_WASM32_UNKNOWN_UNKNOWN_RUNNER: wasm-bindgen-test-runner
-        run: cargo test -p edgezero-adapter-cloudflare --features cloudflare --target wasm32-unknown-unknown --test contract
-
-      - name: Check Cloudflare wasm target
-        run: cargo check -p edgezero-adapter-cloudflare --features cloudflare --target wasm32-unknown-unknown
-
-  fastly-wasm-tests:
-    name: fastly wasm tests
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Cache Cargo dependencies
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/index/
-            ~/.cargo/registry/cache/
-            ~/.cargo/git/db/
-            target/
-          key: ${{ runner.os }}-cargo-fastly-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-fastly-
+        if: matrix.adapter == 'cloudflare'
+        run: cargo install wasm-bindgen-cli --version "${{ steps.wasm-bindgen-version.outputs.version }}" --locked --force
 
-      - name: Retrieve Rust version
-        id: rust-version-fastly
-        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+      - name: Resolve Viceroy version
+        if: matrix.adapter == 'fastly'
+        id: viceroy-version
         shell: bash
-
-      - name: Set up Rust tool chain
-        uses: actions-rust-lang/setup-rust-toolchain@v1
-        with:
-          toolchain: ${{ steps.rust-version-fastly.outputs.rust-version }}
-
-      - name: Add wasm targets
-        run: rustup target add wasm32-wasip1
+        run: echo "version=$(grep '^viceroy ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
 
       - name: Setup Viceroy
-        run: cargo install viceroy --locked
+        if: matrix.adapter == 'fastly'
+        # Version comes from .tool-versions (single source of truth shared with
+        # local dev). viceroy 0.17 raises MSRV to rustc 1.95; we ship 1.91, so
+        # the .tool-versions entry pins us to a 0.16.x build.
+        run: cargo install viceroy --version "${{ steps.viceroy-version.outputs.version }}" --locked --force
+
+      - name: Setup Wasmtime
+        if: matrix.adapter == 'spin'
+        run: |
+          if ! command -v wasmtime &>/dev/null; then
+            curl https://wasmtime.dev/install.sh -sSf | bash
+            echo "$HOME/.wasmtime/bin" >> "$GITHUB_PATH"
+          fi
 
       - name: Fetch dependencies (locked)
         run: cargo fetch --locked
 
-      - name: Run Fastly wasm tests
+      - name: Run ${{ matrix.adapter }} wasm tests
         env:
-          CARGO_TARGET_WASM32_WASIP1_RUNNER: "viceroy run"
-        run: cargo test -p edgezero-adapter-fastly --features fastly --target wasm32-wasip1 --test contract
+          ${{ matrix.runner_env }}: ${{ matrix.runner_value }}
+        run: cargo test -p edgezero-adapter-${{ matrix.adapter }} --features ${{ matrix.adapter }} --target ${{ matrix.target }} --test contract
 
-      - name: Check Fastly wasm target
-        run: cargo check -p edgezero-adapter-fastly --features fastly --target wasm32-wasip1
+      - name: Check ${{ matrix.adapter }} wasm target
+        run: cargo check -p edgezero-adapter-${{ matrix.adapter }} --features ${{ matrix.adapter }} --target ${{ matrix.target }}

.gitignore

@@ -32,3 +32,4 @@ docs/superpowers/
 !.vscode/tasks.json
 !.vscode/launch.json
 !.vscode/extensions.json
+*.rlib

.tool-versions

@@ -1,3 +1,4 @@
 fasltly v13.0.0
 nodejs 24.12.0
 rust 1.91.1
+viceroy 0.16.4

Cargo.toml

@@ -69,3 +69,72 @@ validator = { version = "0.20", features = ["derive"] }
 walkdir = { version = "2" }
 web-time = "1"
 worker = { version = "0.8", features = ["http"] }
+
+[workspace.lints.clippy]
+# Same strict gate as the demo workspace. Allow-list mirrors the demo's
+# slim set; every additional exception lives at the call site as a
+# documented `#[allow]` or `#[expect]` rather than a workspace allow.
+pedantic = { level = "warn", priority = -1 }
+restriction = { level = "deny", priority = -1 }
+
+# Meta — required when enabling `restriction` as a group.
+blanket_clippy_restriction_lints = "allow"
+
+# Documentation — private items don't need full docs.
+missing_docs_in_private_items = "allow"
+
+# Style / formatting — match idiomatic Rust conventions.
+implicit_return = "allow"
+question_mark_used = "allow"
+single_call_fn = "allow"
+separated_literal_suffix = "allow"
+# `pub_with_shorthand` wants `pub(in crate)` but rustfmt unconditionally
+# rewrites that to `pub(crate)`. Five legitimate cross-file `pub(crate)`
+# items remain (dispatch_raw, dispatch_with_store_names, parse_uri,
+# parse_client_addr, decompress_body) — they need at least crate visibility,
+# and there is no spelling that satisfies both the lint and rustfmt.
+pub_with_shorthand = "allow"
+# `module_name_repetitions` was attempted: 39 sites in edgezero-core,
+# centred on three concrete blockers that surfaced during the rename:
+#   1. `proxy::Request`/`proxy::Response` would collide with the
+#      `http::Request`/`http::Response` already imported by every
+#      consumer; the only viable alternative names (`OutboundRequest`,
+#      `Outbound`) are strictly more verbose than `ProxyRequest`.
+#   2. `manifest.rs` has 17 `Manifest*` types; consumers in adapters,
+#      cli, demos, scaffold templates, and the macro-generated app
+#      code use these names directly. Stripping the prefix would force
+#      every site to write `use edgezero_core::manifest::Spec as Manifest`
+#      etc. — pure churn for no readability gain since `manifest::Spec`
+#      reads worse than `Manifest`.
+#   3. The macro `#[app]` emits code that references these names by
+#      their current spelling; renaming requires regenerating every
+#      generated app with new types and updating CLAUDE.md examples.
+# Net: the lint's intent (Rust ecosystem `module::Type` idiom) is
+# real, but it conflicts with our flat re-export surface and several
+# names cannot be deprefixed without losing meaning.
+module_name_repetitions = "allow"
+
+# `pattern_type_mismatch` and `ref_patterns` are mutually exclusive in modern
+# Rust — every `if let Some(x) = &foo` flags the first, every
+# `*foo { Variant(ref x) => ... }` flags the second. We pick match-ergonomics.
+pattern_type_mismatch = "allow"
+
+# API design — `exhaustive_structs` fires on the unit struct generated by
+# `edgezero_core::app!`.
+exhaustive_structs = "allow"
+# Only one site triggers `exhaustive_enums` workspace-wide: `Body { Once,
+# Stream }`. Marking it `#[non_exhaustive]` would force a wildcard arm
+# (`_ => unreachable!()`) at every external `match` site — 37 of them
+# across the four adapter crates — and a third Body variant would
+# silently panic at runtime instead of producing a compile error.
+# Body is intentionally a closed enum.
+exhaustive_enums = "allow"
+
+# Imports / paths
+std_instead_of_alloc = "allow"
+std_instead_of_core = "allow"
+
+
+
+[workspace.lints.rust]
+unsafe_code = "deny"

clippy.toml

@@ -0,0 +1,9 @@
+# Clippy configuration. See https://doc.rust-lang.org/clippy/lint_configuration.html
+#
+# Test code uses `.unwrap()`, `.expect()`, `panic!`, `assert!`, indexing, and
+# other "if-this-fails-the-test-fails" idioms by convention. We keep the
+# corresponding restriction lints active in production code but exempt tests.
+allow-expect-in-tests = true
+allow-indexing-slicing-in-tests = true
+allow-panic-in-tests = true
+allow-unwrap-in-tests = true

crates/edgezero-adapter-axum/Cargo.toml

@@ -5,6 +5,9 @@ version = { workspace = true }
 authors = { workspace = true }
 license = { workspace = true }
 
+[lints]
+workspace = true
+
 [features]
 default = ["axum"]
 axum = [