Forbid unsafe code in fasterhenry-cli; CI guard for crate roots

.github/workflows/ci.yml

@@ -30,6 +30,18 @@ jobs:
           fi
           echo "clean"
 
+      - name: Fail if a crate root lacks #![forbid(unsafe_code)]
+        run: |
+          set -euo pipefail
+          status=0
+          while IFS= read -r root; do
+            if ! grep -q '^#!\[forbid(unsafe_code)\]' "$root"; then
+              echo "::error file=$root::crate root is missing #![forbid(unsafe_code)]"
+              status=1
+            fi
+          done < <(find . -path ./target -prune -o \( -path '*/src/lib.rs' -o -path '*/src/main.rs' -o -path '*/src/bin/*.rs' -o -name build.rs \) -print)
+          exit $status
+
   dependency-policy:
     name: Dependency licenses & sources (cargo-deny)
     runs-on: ubuntu-latest

fasterhenry-cli/build.rs

@@ -1,6 +1,8 @@
 // Bakes the source revision into `--version` via FASTERHENRY_GIT_DESCRIBE.
 // Falls back to "unknown" where git is absent (a crates.io tarball build),
 // so the version string stays deterministic there.
+#![forbid(unsafe_code)]
+
 use std::process::Command;
 
 fn describe() -> String {

fasterhenry-cli/src/lib.rs

@@ -4,6 +4,8 @@
 //! The binary logic lives in this library so the tests can drive it without
 //! spawning a process; `src/main.rs` is a thin wrapper.
 
+#![forbid(unsafe_code)]
+
 pub mod cli;
 pub mod inp;
 pub mod mat;

fasterhenry-cli/src/main.rs

@@ -5,6 +5,8 @@
 //! the explicit `fasterhenry run <deck.inp | problem.json>`, which writes
 //! one only when `--zc-mat` asks for it. See `--help`.
 
+#![forbid(unsafe_code)]
+
 use fasterhenry_cli::cli::{Invocation, RunArgs};
 use fasterhenry_cli::inp::ParseOptions;
 use fasterhenry_cli::spice::write_spice_subckt;