build: add third party licenses generation

.github/workflows/autofix.yml

@@ -13,9 +13,14 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: autofix-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
 jobs:
   autofix:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:

.github/workflows/ci-dataset.yml

@@ -20,11 +20,14 @@ permissions: {}
 jobs:
   schema:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Install check-jsonschema
         run: pipx install check-jsonschema
@@ -53,16 +56,22 @@ jobs:
             check-jsonschema --schemafile docs/schemas/profiles.schema.json "${files[@]}"
           fi
 
+      - name: Summary
+        run: echo "### ✅ Schema validation - positions, stations & profiles" >> $GITHUB_STEP_SUMMARY
+
   validate:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        run: rustup toolchain install stable --profile minimal --no-self-update
 
       - name: Cache cargo
         uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
@@ -72,3 +81,6 @@ jobs:
 
       - name: Validate dataset
         run: cargo run --quiet --release --locked --bin vacs-data --manifest-path tools/Cargo.toml -- --log-format github validate dataset/
+
+      - name: Summary
+        run: echo "### ✅ Dataset validation - all files valid" >> $GITHUB_STEP_SUMMARY

.github/workflows/ci-rust.yml

@@ -34,7 +34,9 @@ defaults:
 jobs:
   cargo-deny:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     strategy:
+      fail-fast: false
       matrix:
         checks:
           - advisories
@@ -55,8 +57,12 @@ jobs:
           command: check ${{ matrix.checks }}
           command-arguments: "--config tools/deny.toml"
 
+      - name: Summary
+        run: echo "### ✅ Cargo Deny - ${{ matrix.checks }}" >> $GITHUB_STEP_SUMMARY
+
   cargo-machete:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     continue-on-error: true
     steps:
       - name: Checkout
@@ -65,32 +71,97 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - name: Install cargo-machete
+        run: cargo install cargo-machete --locked
+
       - name: cargo machete
-        uses: bnjbvr/cargo-machete@7959c845782fed02ee69303126d4a12d64f1db18 # v0.9.1
+        run: cargo machete
+
+      - name: Summary
+        run: echo "### ✅ Cargo Machete - no unused dependencies" >> $GITHUB_STEP_SUMMARY
+
+  fmt:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Rust toolchain
+        run: rustup toolchain install stable --profile minimal --no-self-update --component rustfmt
+
+      - name: Format
+        run: cargo fmt --all -- --check
+
+      - name: Summary
+        run: echo "### ✅ Rustfmt - all files formatted" >> $GITHUB_STEP_SUMMARY
 
   check:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          components: clippy, rustfmt
+        run: rustup toolchain install stable --profile minimal --no-self-update
 
       - name: Cache cargo
         uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
+
+      - name: Tests
+        run: cargo test --locked --workspace --all-targets --all-features
+
+      - name: Summary
+        run: echo "### ✅ Tests - all workspace tests passed" >> $GITHUB_STEP_SUMMARY
+
+  clippy:
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: "ubuntu-22.04"
+            arch: "x86_64"
+            target: "x86_64-unknown-linux-gnu"
+          - platform: "windows-latest"
+            arch: "x86_64"
+            target: "x86_64-pc-windows-msvc"
+          - platform: "macos-latest"
+            arch: "aarch64"
+            target: "aarch64-apple-darwin" # for Arm based macs (M1 and above).
+
+    runs-on: ${{ matrix.platform }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          shared-key: "linux-x86_64"
-          workspaces: "tools -> target"
+          persist-credentials: false
 
-      - name: Format
-        run: cargo fmt --all -- --check
+      - name: Rust toolchain
+        run: |
+          rustup toolchain install stable --profile minimal --no-self-update --component clippy
+          rustup target add ${{ matrix.target }}
+
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
+        with:
+          shared-key: ${{ matrix.platform }}-${{ matrix.arch }}
 
       - name: Clippy
-        run: cargo clippy --workspace --all-targets --all-features -- -D warnings
+        run: cargo clippy --locked --workspace --all-targets --all-features --target ${{ matrix.target }} -- -D warnings
 
-      - name: Tests
-        run: cargo test --workspace --all-targets --all-features
+      - name: Summary
+        run: echo "### ✅ Clippy - ${{ matrix.platform }} (${{ matrix.arch }})" >> $GITHUB_STEP_SUMMARY

.github/workflows/deploy-dataset.yml

@@ -30,6 +30,7 @@ jobs:
   deploy-dev:
     name: Deploy to dev
     needs: validate
+    timeout-minutes: 10
     if: >-
       (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/'))
       || (github.event_name == 'workflow_dispatch' && inputs.environment == 'dev')
@@ -46,6 +47,7 @@ jobs:
         with:
           sparse-checkout: .github/actions
           sparse-checkout-cone-mode: false
+          persist-credentials: false
 
       - name: Deploy dataset
         uses: ./.github/actions/deploy-dataset
@@ -90,6 +92,7 @@ jobs:
   deploy-production:
     name: Deploy to production
     needs: validate
+    timeout-minutes: 10
     if: >-
       (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/airac-'))
       || (github.event_name == 'workflow_dispatch' && inputs.environment == 'production')
@@ -123,6 +126,7 @@ jobs:
         with:
           sparse-checkout: .github/actions
           sparse-checkout-cone-mode: false
+          persist-credentials: false
 
       - name: Deploy dataset
         uses: ./.github/actions/deploy-dataset