Review cleanup

.github/workflows/ci.yml

@@ -0,0 +1,49 @@
+name: CI
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+  workflow_dispatch:
+
+jobs:
+  build-and-test:
+    strategy:
+      fail-fast: false
+      matrix:
+        compiler:
+          - { name: gcc,   cc: gcc,   cxx: g++ }
+          - { name: clang, cc: clang, cxx: clang++ }
+    runs-on: ubuntu-latest
+    name: Linux ${{ matrix.compiler.name }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Cache submodule checkouts
+        uses: actions/cache@v4
+        with:
+          path: |
+            test/googletest
+            test/rapidcheck
+          key: submods-${{ hashFiles('.gitmodules', '.git/modules/test/googletest/HEAD', '.git/modules/test/rapidcheck/HEAD') }}
+
+      - name: Install compiler
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y ${{ matrix.compiler.cc }}
+
+      - name: Configure CMake
+        env:
+          CC:  ${{ matrix.compiler.cc }}
+          CXX: ${{ matrix.compiler.cxx }}
+        run: cmake -S . -B build
+
+      - name: Build
+        run: cmake --build build -j
+
+      - name: Run tests
+        run: ctest --test-dir build --output-on-failure

.github/workflows/clang-tidy.yml

@@ -0,0 +1,41 @@
+name: clang-tidy (advisory)
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+
+# Advisory-only. Findings are reported in the log but the job NEVER
+# fails CI. Promotion to gated (fail-on-findings) is a deferred decision.
+
+jobs:
+  clang-tidy:
+    runs-on: ubuntu-latest
+    name: clang-tidy (advisory)
+    continue-on-error: true
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Install clang-tidy
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y clang-tidy
+
+      - name: Configure (compile_commands.json)
+        run: cmake -S . -B build -DCMAKE_EXPORT_COMPILE_COMMANDS=ON
+
+      - name: Run clang-tidy (advisory)
+        run: |
+          # Run tidy across the library source only (examples and tests
+          # are scanned separately, if at all; this job never fails on
+          # findings). Scope to libbech32/ and include/ explicitly so
+          # vendored googletest/rapidcheck under test/ are not scanned.
+          find libbech32 include -name '*.cpp' -o -name '*.h' | \
+            xargs -r clang-tidy -p build \
+              -checks='-*,bugprone-*,cert-*,clang-analyzer-*' \
+              --quiet \
+              || true

.github/workflows/release.yml

@@ -0,0 +1,45 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+      - '[0-9]*.[0-9]*.[0-9]*'
+
+jobs:
+  tarball:
+    runs-on: ubuntu-latest
+    name: Build release tarball
+    permissions:
+      contents: write
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Install build deps
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y cmake g++
+
+      - name: Configure + build (release)
+        run: |
+          cmake -S . -B build -DCMAKE_BUILD_TYPE=Release
+          cmake --build build -j
+
+      - name: Run tests (sanity check before tagging)
+        run: ctest --test-dir build --output-on-failure
+
+      - name: Install to staging prefix
+        run: cmake --install build --prefix install-staging
+
+      - name: Package tarball
+        run: |
+          TAG_NAME=${GITHUB_REF_NAME}
+          tar -czf libbech32-${TAG_NAME}-linux-x86_64.tar.gz -C install-staging .
+
+      - name: Upload release artifact
+        uses: softprops/action-gh-release@v2
+        with:
+          files: libbech32-*-linux-x86_64.tar.gz

.github/workflows/sanitizer.yml

@@ -0,0 +1,49 @@
+name: Sanitizers
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+
+jobs:
+  asan-ubsan:
+    runs-on: ubuntu-latest
+    name: ASan + UBSan (clang)
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Cache submodule checkouts
+        uses: actions/cache@v4
+        with:
+          path: |
+            test/googletest
+            test/rapidcheck
+          key: submods-${{ hashFiles('.gitmodules', '.git/modules/test/googletest/HEAD', '.git/modules/test/rapidcheck/HEAD') }}
+
+      - name: Install clang
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y clang
+
+      - name: Configure with sanitizers
+        env:
+          CC: clang
+          CXX: clang++
+          CFLAGS:   "-fsanitize=address,undefined -fno-omit-frame-pointer -g"
+          CXXFLAGS: "-fsanitize=address,undefined -fno-omit-frame-pointer -g"
+          LDFLAGS:  "-fsanitize=address,undefined"
+        run: cmake -S . -B build
+
+      - name: Build
+        run: cmake --build build -j
+
+      - name: Run sanitized tests
+        env:
+          # Fail CI on any sanitizer report.
+          ASAN_OPTIONS: halt_on_error=1:abort_on_error=1:detect_leaks=1
+          UBSAN_OPTIONS: halt_on_error=1:print_stacktrace=1
+        run: ctest --test-dir build --output-on-failure

CMakeLists.txt

@@ -13,7 +13,7 @@
 # LIBBECH32_BUILD_GOOGLETEST : Build googletest for testing [ON OFF]. Default: ON if LIBBECH32_BUILD_TESTS is ON.
 # LIBBECH32_BUILD_RAPIDCHECK : Build rapidcheck for testing [ON OFF]. Default: ON if LIBBECH32_BUILD_TESTS is ON.
 
-cmake_minimum_required(VERSION 3.14 FATAL_ERROR)
+cmake_minimum_required(VERSION 3.22 FATAL_ERROR)
 
 # Version settings