Harden first-release validation and dependency hygiene

.github/workflows/ci.yml

@@ -7,26 +7,46 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   rust:
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - uses: dtolnay/rust-toolchain@6d653ac52d5f748757700b3b0ec16abf11083d92
         with:
           toolchain: 1.92.0
           components: rustfmt, clippy
-      - run: sudo apt-get update && sudo apt-get install -y --no-install-recommends build-essential clang libclang-dev pkg-config python3-cryptography openssl
-      - run: cargo fmt --all --check
+      - run: sudo apt-get update && sudo apt-get install -y --no-install-recommends build-essential clang libclang-dev pkg-config python3-cryptography openssl ripgrep curl rsync time
+      - run: python3 tools/check_format.py
+      - run: python3 -m unittest discover -s tools -p 'test_*.py'
       - run: cargo check --locked --no-default-features
       - run: cargo test --locked
       - run: cargo clippy --locked --all-targets -- -D warnings
       - run: cargo build --locked --release
+      - run: python3 tools/dependency_notices.py --check
   docker:
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-      - run: sudo apt-get update && sudo apt-get install -y --no-install-recommends python3-cryptography openssl
+      - run: sudo apt-get update && sudo apt-get install -y --no-install-recommends python3-cryptography openssl ripgrep
       - run: docker build -f docker/Dockerfile -t panda-rpki:ci .
       - run: docker run --rm panda-rpki:ci --help
       - run: bash tests/synthetic_docker_e2e.sh
+        env:
+          PANDA_RPKI_TEST_IMAGE: panda-rpki:ci
+  audit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: dtolnay/rust-toolchain@6d653ac52d5f748757700b3b0ec16abf11083d92
+        with:
+          toolchain: 1.92.0
+      - run: cargo install cargo-audit --locked --version 0.22.0
+      - run: cargo audit --json