ci: use default branch and simplify release-plz workflow

.github/workflows/audit.yml

@@ -27,7 +27,7 @@ jobs:
       contents: read
       issues: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - uses: actions-rust-lang/audit@v1

.github/workflows/release-plz.yml

@@ -4,52 +4,36 @@ name: Release-plz
 #
 # This workflow is triggered manually only (Actions -> "Release-plz" -> "Run
 # workflow"). Select the branch to release from in the "Use workflow from"
-# dropdown (e.g. `master` or `release/1.0`) and choose the command:
-#   - `release-pr` to prepare/refresh the release PR.
-#   - `release` to publish after the release PR has been merged.
+# dropdown (e.g. the default branch or `release/1.x`) and click "Run workflow".
+# Both jobs below run on every dispatch:
 #
-# 1. `release-pr` opens/updates a release PR (branch prefix `release-plz-`)
+# 1. The `release-pr` job opens/updates a release PR (branch prefix `release-plz-`)
 #    with the version bump and changelog for the `rust-cktap` crate, targeting
 #    the selected branch, authored by the `bitcoindevkit-release-plz` GitHub App.
 #    The version bump is computed from that branch's Cargo.toml. Re-run it to
 #    refresh the release PR after new commits land on the branch.
-# 2. After the release PR is reviewed and merged, run the workflow again with
-#    `release` on the same branch: it publishes the crate to crates.io (via
-#    trusted publishing / OIDC, no token secret) and creates the
-#    `rust-cktap-vX.Y.Z` git tag and GitHub release.
-# 3. The `release` job runs in the `release` GitHub environment, whose required
-#    reviewers are the @bitcoindevkit/rust-cktap-release team: publishing
-#    waits until a team member approves it in the Actions UI.
+# 2. The `release` job checks whether the release PR has been merged. If so, it
+#    publishes the crate to crates.io (via trusted publishing / OIDC, no token
+#    secret) and creates the `rust-cktap-vX.Y.Z` git tag and GitHub release.
+#    The job runs in the `release` GitHub environment, whose required reviewers
+#    are the @bitcoindevkit/rust-cktap-release team: publishing waits until a
+#    team member approves it in the Actions UI.
 #
 # Notes:
-# - To release from a `release/*` maintenance branch, cherry-pick both
-#   `release-plz.toml` and this workflow file onto that branch when cutting it
-#   (and keep the workflow in sync with `master` afterwards): the run uses the
-#   workflow file from the branch selected in the dropdown.
 # - release-plz supports only one open release PR per repository, so don't
 #   prepare releases on two branches concurrently.
 
 on:
   workflow_dispatch:
-    inputs:
-      command:
-        description: >-
-          release-pr: prepare/refresh the release PR.
-          release: publish after the release PR is merged.
-        required: true
-        type: choice
-        options:
-          - release-pr
-          - release
 
 permissions: {}
 
 jobs:
-  # Create/update the PR with the new version and changelog.
+  # Create or update the PR with the new version and changelog.
   release-pr:
-    name: Create Rust Release PR
+    name: Create/Update Rust Release PR
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'bitcoindevkit' && inputs.command == 'release-pr' }}
+    if: ${{ github.repository_owner == 'bitcoindevkit' }}
     permissions:
       contents: write # push the release PR branch
       pull-requests: write # open and update the release PR
@@ -60,25 +44,26 @@ jobs:
       - name: Validate selected branch
         env:
           BRANCH: ${{ github.ref_name }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
         run: |
           case "$BRANCH" in
-            master|release/*) ;;
-            *) echo "Refusing to release from '$BRANCH' (expected 'master' or 'release/*')"; exit 1 ;;
+            "$DEFAULT_BRANCH"|release/*) ;;
+            *) echo "Refusing to release from '$BRANCH' (expected '$DEFAULT_BRANCH' or 'release/*')"; exit 1 ;;
           esac
       - name: Generate GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ secrets.RELEASE_PLZ_APP_ID }}
           private-key: ${{ secrets.RELEASE_PLZ_PRIVATE_KEY }}
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.ref_name }}
           fetch-depth: 0
           persist-credentials: false
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: actions-rust-lang/setup-rust-toolchain@v2
       - name: Install PCSC development libraries
         run: |
           sudo apt-get update
@@ -90,12 +75,12 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
 
-  # Publish to crates.io, tag, and create the GitHub release. Gated by the
-  # `release` environment (team approval).
+  # If the release PR was merged, publish to crates.io, tag, and create the
+  # GitHub release. Gated by the `release` environment (team approval).
   release:
     name: Publish Rust Release
     runs-on: ubuntu-latest
-    if: ${{ github.repository_owner == 'bitcoindevkit' && inputs.command == 'release' }}
+    if: ${{ github.repository_owner == 'bitcoindevkit' }}
     environment: release
     permissions:
       contents: write # push tags and create GitHub releases
@@ -105,25 +90,26 @@ jobs:
       - name: Validate selected branch
         env:
           BRANCH: ${{ github.ref_name }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
         run: |
           case "$BRANCH" in
-            master|release/*) ;;
-            *) echo "Refusing to release from '$BRANCH' (expected 'master' or 'release/*')"; exit 1 ;;
+            "$DEFAULT_BRANCH"|release/*) ;;
+            *) echo "Refusing to release from '$BRANCH' (expected '$DEFAULT_BRANCH' or 'release/*')"; exit 1 ;;
           esac
       - name: Generate GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ secrets.RELEASE_PLZ_APP_ID }}
           private-key: ${{ secrets.RELEASE_PLZ_PRIVATE_KEY }}
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.ref_name }}
           fetch-depth: 0
           persist-credentials: false
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: actions-rust-lang/setup-rust-toolchain@v2
       - name: Install PCSC development libraries
         run: |
           sudo apt-get update

.github/workflows/swift-release.yml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/test.yml

@@ -27,15 +27,14 @@ jobs:
           - --all-features
     steps:
       - name: checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v7
       - name: Install Rust toolchain
-        uses: actions-rs/toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@v2
         with:
           toolchain: ${{ matrix.rust.version }}
           override: true
-          profile: minimal
       - name: Rust Cache
-        uses: Swatinem/rust-cache@v2.2.1
+        uses: Swatinem/rust-cache@v2
       - name: Install PCSC development libraries
         run: |
           sudo apt-get update
@@ -57,17 +56,16 @@ jobs:
             msrv: true
     steps:
       - name: checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v7
         with:
           submodules: 'true'
       - name: Install Rust toolchain
-        uses: actions-rs/toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@v2
         with:
           toolchain: ${{ matrix.rust.version }}
           override: true
-          profile: minimal
       - name: Rust Cache
-        uses: Swatinem/rust-cache@v2.2.1
+        uses: Swatinem/rust-cache@v2
       - name: Use MSRV Cargo.toml # Don't include "cli" in workspace if using MSRV
         if: ${{ matrix.rust.msrv }}
         run: cp Cargo.toml.MSRV Cargo.toml
@@ -76,7 +74,7 @@ jobs:
           sudo apt-get update -y
           sudo apt-get install -y swig libpcsclite-dev
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.12'
       - name: Test
@@ -93,13 +91,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v7
       - name: Install Rust toolchain
-        uses: actions-rs/toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@v2
         with:
           toolchain: nightly
-          override: true
-          profile: minimal
           components: rustfmt
       - name: Check fmt
         run: cargo +nightly fmt --all
@@ -108,18 +104,15 @@ jobs:
     name: Clippy check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v1
-      - uses: actions-rs/toolchain@v1
+      - uses: actions/checkout@v7
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v2
         with:
-          toolchain: stable
           components: clippy
-          override: true
       - name: Rust Cache
-        uses: Swatinem/rust-cache@v2.2.1
+        uses: Swatinem/rust-cache@v2
       - name: Install libpcsclite-dev
         run: sudo apt install libpcsclite-dev
-      - uses: actions-rs/clippy-check@v1
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          args: --all-features --all-targets -- -D warnings
+      - name: Run clippy
+        run: cargo clippy --all-features --all-targets -- -D warnings
 

CONTRIBUTING.md

@@ -114,30 +114,28 @@ Releases of the `rust-cktap` crate are automated with [release-plz](https://rele
 `rust-cktap` library crate is released this way; `cktap-cli` and `cktap-ffi` are
 excluded (they cannot be published to crates.io).
 
-1. Commits must follow [conventional commits](https://www.conventionalcommits.org)
-   (e.g. `feat:`, `fix:`, `fix!:`) so the changelog is generated correctly.
-2. To prepare a release, run the `Release-plz` workflow manually from the
-   Actions tab: select the branch to release from (`master` or a `release/*`
-   branch) in the "Run workflow" dropdown and choose the `release-pr` command.
-   The `bitcoindevkit-release-plz` GitHub App opens or updates a release PR
-   targeting that branch with the version bump and changelog. Re-run it to
-   refresh the PR after new commits land.
-3. A maintainer reviews and merges the release PR.
-4. Run the `Release-plz` workflow again with command `release` on the same
-   branch. The job waits for approval from a member of the
-   `@bitcoindevkit/rust-cktap-release` team (the `release` GitHub
-   environment). Once approved it publishes to crates.io via trusted publishing
-   and creates the `rust-cktap-vX.Y.Z` git tag and GitHub release.
-
-The plain `vX.Y.Z` tag namespace is reserved for Swift package releases
-(see `.github/workflows/swift-release.yml`).
-
-To cut a maintenance release from a `release/*` branch (e.g. backporting a fix
-to a prior major version), cherry-pick `release-plz.toml` and
-`.github/workflows/release-plz.yml` onto the branch when creating it (the run
-uses the workflow file from the branch selected in the dropdown), then select
-that branch when running the workflow. Don't prepare releases on two branches
-concurrently — release-plz supports only one open release PR per repository.
+1. Commits must follow [conventional commits](https://www.conventionalcommits.org) 
+   (e.g. `feat:`, `fix:`, `fix!:`) so the changelog is generated correctly. 
+2. Run the `Release-plz` workflow manually from the Actions tab: select the 
+   branch to release from (the default branch or a `release/*` branch) in the 
+   "Run workflow" dropdown and click "Run workflow". The workflow runs both the 
+   `release-pr` and `release` jobs; the `bitcoindevkit-release-plz` GitHub App 
+   opens or updates a release PR targeting that branch, while the `release` job 
+   only publishes if the release PR has already been merged. Re-run it to refresh 
+   the PR after new commits land. 
+3. A maintainer reviews and merges the release PR. 
+4. Run the `Release-plz` workflow again on the same branch. The `release` job 
+   waits for approval from a member of the `@bitcoindevkit/rust-cktap-release` 
+   team. Once approved it publishes to crates.io via trusted publishing and creates 
+   the `rust-cktap-vX.Y.Z` git tag and GitHub release. 
+
+The plain `vX.Y.Z` tag namespace is reserved for Swift package releases 
+(see `.github/workflows/swift-release.yml`). 
+
+To cut a maintenance release from a `release/*` branch (e.g. backporting a fix 
+to a prior major version), select that branch when running the workflow. Don't 
+prepare releases on two branches concurrently — release-plz supports only one open 
+release PR per repository.
 
 Going further
 -------------