regex: only enable implicit capture groups

.github/workflows/rust.yml

@@ -2,69 +2,84 @@ name: Rust
 
 on:
   push:
-    branches: [ master ]
+    branches: [master]
   pull_request:
-    branches: [ master ]
+    branches: [master]
 
 env:
   CARGO_TERM_COLOR: always
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions-rust-lang/setup-rust-toolchain@v1
-      with:
-        toolchain: stable
-        components: clippy,rustfmt
-    - name: Print versions
-      run: |
-        cargo --version
-        rustc --version
-        clippy-driver --version
-        rustfmt --version
-    - name: Build
-      run: cargo build --verbose
-    - name: Run tests
-      run: cargo test --verbose
-    - name: Run clippy
-      run: cargo clippy --verbose --all-targets -- -D clippy::all
-    - name: Check code formatting
-      run: cargo fmt --verbose --all -- --check
+      - uses: actions/checkout@v4
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: stable
+          components: clippy
+      - name: Print versions
+        run: |
+          cargo --version
+          rustc --version
+          clippy-driver --version
+      - name: Build
+        run: cargo build --verbose
+      - name: Run tests
+        run: cargo test --verbose
+      - name: Run clippy
+        run: cargo clippy --verbose --all-targets -- -D clippy::all
+
+  fmt:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: nightly
+          components: rustfmt
+      - uses: tombi-toml/setup-tombi@v1
+      - name: Print versions
+        run: |
+          cargo fmt --version
+          tombi --version
+      - name: Check code formatting
+        uses: actions-rust-lang/rustfmt@v1
+      - name: Check toml formatting
+        run: tombi format --check
 
   doc:
     name: Documentation
     runs-on: ubuntu-latest
     env:
       RUSTDOCFLAGS: -D warnings
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions-rust-lang/setup-rust-toolchain@v1
-      with:
-        toolchain: stable
-    - name: Print versions
-      run: |
-        cargo --version
-        rustc --version
-        rustdoc --version
-    - name: Doc
-      run: cargo doc --verbose
-    - name: Doc with all features
-      run: cargo doc --verbose --all-features
+      - uses: actions/checkout@v4
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: stable
+      - name: Print versions
+        run: |
+          cargo --version
+          rustc --version
+          rustdoc --version
+      - name: Doc
+        run: cargo doc --verbose
+      - name: Doc with all features
+        run: cargo doc --verbose --all-features
 
   miri-test:
     name: Test with miri
     runs-on: ubuntu-latest
     env:
       MIRIFLAGS: -Zmiri-disable-isolation
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions-rust-lang/setup-rust-toolchain@v1
-      with:
-        toolchain: nightly
-        components: miri
-    - run: cargo miri test --verbose --no-default-features
-    - run: cargo miri test --verbose --all-features
+      - uses: actions/checkout@v4
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: nightly
+          components: miri
+      - run: cargo miri test --verbose --no-default-features
+      - run: cargo miri test --verbose --all-features
 
   sanitizer-test:
     name: Test with -Zsanitizer=${{ matrix.sanitizer }}
@@ -74,19 +89,19 @@ jobs:
       matrix:
         sanitizer: [address, thread, leak]
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions-rust-lang/setup-rust-toolchain@v1
-      with:
-        toolchain: nightly
-        components: rust-src
-    - name: Test with sanitizer
-      env:
-        RUSTFLAGS: -Zsanitizer=${{ matrix.sanitizer }}
-        RUSTDOCFLAGS: -Zsanitizer=${{ matrix.sanitizer }}
-        # only needed by asan
-        ASAN_OPTIONS: detect_stack_use_after_return=1,detect_leaks=0
-        # Asan's leak detection occasionally complains
-        # about some small leaks if backtraces are captured,
-        # so ensure they're not
-        RUST_BACKTRACE: 0
-      run: cargo test -Zbuild-std --verbose --target=x86_64-unknown-linux-gnu --lib --bins --tests
+      - uses: actions/checkout@v4
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: nightly
+          components: rust-src
+      - name: Test with sanitizer
+        env:
+          RUSTFLAGS: -Zsanitizer=${{ matrix.sanitizer }}
+          RUSTDOCFLAGS: -Zsanitizer=${{ matrix.sanitizer }}
+          # only needed by asan
+          ASAN_OPTIONS: detect_stack_use_after_return=1,detect_leaks=0
+          # Asan's leak detection occasionally complains
+          # about some small leaks if backtraces are captured,
+          # so ensure they're not
+          RUST_BACKTRACE: 0
+        run: cargo test -Zbuild-std --verbose --target=x86_64-unknown-linux-gnu --lib --bins --tests

.github/workflows/semgrep.yml

@@ -1,24 +1,30 @@
+name: Semgrep OSS scan
 on:
   pull_request: {}
+  push:
+    branches: [main, master]
   workflow_dispatch: {}
-  push: 
-    branches:
-      - main
-      - master
   schedule:
-    - cron: '0 0 * * *'
-name: Semgrep config
+    - cron: '0 0 20 * *'
+concurrency:
+  group: semgrep-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+permissions:
+  contents: read
 jobs:
   semgrep:
-    name: semgrep/ci
-    runs-on: ubuntu-latest
-    env:
-      SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
-      SEMGREP_URL: https://cloudflare.semgrep.dev
-      SEMGREP_APP_URL: https://cloudflare.semgrep.dev
-      SEMGREP_VERSION_CHECK_URL: https://cloudflare.semgrep.dev/api/check-version
-    container:
-      image: semgrep/semgrep
+    name: semgrep-oss
+    runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@v4
-      - run: semgrep ci
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 1
+      - id: cache-semgrep
+        uses: actions/cache@v5
+        with:
+          path: ~/.local
+          key: semgrep-1.160.0-${{ runner.os }}
+      - if: steps.cache-semgrep.outputs.cache-hit != 'true'
+        run: pip install --user semgrep==1.160.0
+      - run: echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+      - run: semgrep scan --config=auto