feat(ci): setup Renovate and GHA

.github/renovate.json

@@ -0,0 +1,8 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:base",
+    "github>msfjarvis/shared-workflows//renovate/rust",
+    "github>msfjarvis/shared-workflows//renovate/automerge"
+  ]
+}

.github/workflows/test.yml

@@ -0,0 +1,13 @@
+on:
+  push:
+    branches:
+      - main
+      - renovate/**
+  pull_request:
+    branches:
+      - main
+
+name: Check Rust code
+jobs:
+  check:
+    uses: msfjarvis/shared-workflows/.github/workflows/test-rust-project.yml@main

deny.toml

@@ -0,0 +1,49 @@
+targets = [
+  { triple = "x86_64-unknown-linux-gnu" },
+  { triple = "aarch64-unknown-linux-gnu" },
+  { triple = "x86_64-unknown-linux-musl" },
+  { triple = "aarch64-apple-darwin" },
+  { triple = "x86_64-apple-darwin" },
+  { triple = "x86_64-pc-windows-msvc" },
+]
+
+[advisories]
+db-path = "~/.cargo/advisory-db"
+db-urls = ["https://github.com/rustsec/advisory-db"]
+vulnerability = "deny"
+unmaintained = "warn"
+yanked = "warn"
+notice = "warn"
+ignore = [
+]
+[licenses]
+unlicensed = "deny"
+allow = [
+    "MIT",
+    "Apache-2.0",
+    "Unicode-DFS-2016",
+]
+copyleft = "allow"
+allow-osi-fsf-free = "neither"
+default = "deny"
+confidence-threshold = 0.8
+exceptions = [
+  { allow = ["Apache-2.0", "MIT", "BSD-3-Clause"], name = "encoding_rs", version = "*" },
+  { allow = ["Apache-2.0", "MIT", "BSD-3-Clause"], name = "subtle", version = "*" },
+]
+
+[licenses.private]
+ignore = false
+
+[bans]
+multiple-versions = "deny"
+wildcards = "deny"
+highlight = "all"
+skip = [
+    { name = "futures", version = "0.3.21" }
+]
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+allow-git = []