chore: Enable security lints and clean up documentation formatting

[unclesp1d3r]

This pull request primarily makes two changes: it fixes the enforcement of workspace lints by moving the [lints] workspace = true section in Cargo.toml to the correct location, and it cleans up the formatting of CHANGELOG.md by ensuring a consistent separation between sections. Additionally, it removes the file exclusion list from .mdformat.toml.

The most important changes are:

Lint enforcement:

• Moves [lints] workspace = true to the correct position in Cargo.toml to ensure workspace-wide linting is actually enforced. Previously, this section was misplaced and thus inert. [1] [2]

Changelog formatting:

• Adds consistent blank lines and generated-by comments between sections in CHANGELOG.md, improving readability and ensuring automated changelog tools work as intended. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12]

Formatting configuration:

• Removes the exclusion list from .mdformat.toml, likely to simplify or update markdown formatting rules.

[coderabbitai]

Walkthrough

The PR removes Markdown formatter exclusions, regenerates changelog spacing, relocates the Cargo workspace lint opt-in, and reformats security-assurance tables without changing their content.

Changes

Formatting and manifest updates

Layer / File(s)	Summary
Cargo lint opt-in relocation Cargo.toml	Moves the package-level workspace lint opt-in after the development dependencies while preserving the workspace lint configuration.
Generated changelog spacing CHANGELOG.md	Regenerates blank-line spacing around release sections and git-cliff markers.
Markdown formatting .mdformat.toml, docs/src/security-assurance.md	Removes formatter exclusions and reformats security-assurance tables without changing their described content.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• EvilBit-Labs/libmagic-rs#353: Related to the Cargo workspace lint opt-in and associated lint enforcement.
• EvilBit-Labs/libmagic-rs#373: Directly overlaps the formatting and manifest changes.

Suggested reviewers: copilot

Poem

Blank lines march in neat array,
Tables find their shape today.
Cargo’s lints relocate,
Changelog markers stand up straight.
Safe Rust keeps the watchful light.

🚥 Pre-merge checks | ✅ 9 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title is relevant, but it does not follow the required Conventional Commits type(scope): description format.	Rewrite it as type(scope): description using an allowed scope, for example chore(cli): enable security lints and clean up docs formatting.

✅ Passed checks (9 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Memory-Safety-Check	✅ Passed	PR only changes docs/config; diff from merge-base touches no Rust source, and no added unsafe/raw-pointer/transmute code appears.
Libmagic-Compatibility-Check	✅ Passed	Only config/docs changed; no parser, evaluator, or output-format code was modified, so libmagic syntax and GNU file behavior remain unaffected.
Performance-Regression-Check	✅ Passed	Only .mdformat.toml, CHANGELOG.md, and docs/src/security-assurance.md changed; no src/ parser/evaluator/I/O code was touched.
Test-Coverage-Check	✅ Passed	PR only repositions config and reformats docs; no runtime code or tests changed, so no additional test coverage is needed.
Error-Handling-Check	✅ Passed	PR only changes docs/config files; no library code, public APIs, unwrap/expect, or Result/error-type paths were touched.
Description check	✅ Passed	The description matches the actual changes to Cargo.toml, CHANGELOG.md, and .mdformat.toml.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

Warning

Review ran into problems

🔥 Problems

These MCP integrations need to be re-authenticated in the Integrations settings: Linear, Notion

---

_{Comment @coderabbitai help to get the list of available commands.}

[mergify]

Merge Protections

🔴 2 of 4 protections blocking · waiting on 🤖 CI

	Protection	Waiting on
🔴	🚦 Auto-queue	—
🟠	Full CI must pass	🤖 CI
🟢	Enforce conventional commit	—
🟢	Do not merge outdated PRs	—

🔴 🚦 Auto-queue

This rule is failing.

When all merge protections are satisfied and these conditions match, this pull request will be queued automatically.

• any of:
  • all of:
    • author = dosubot[bot]
    • base = main
    • label != do-not-merge
  • all of:
    • author = dependabot[bot]
    • base = main
    • label != do-not-merge
  • all of:
    • author = release-plz[bot]
    • head ~= ^release-plz-
    • base = main
    • label != do-not-merge

🟠 Full CI must pass

Waiting for

• check-success = coverage
• check-success = quality
• check-success = test
• check-success = test-cross-platform (macos-latest, macOS)
• check-success = test-cross-platform (ubuntu-22.04, Linux)
• check-success = test-cross-platform (ubuntu-latest, Linux)
• check-success = test-cross-platform (windows-latest, Windows)

Waiting checks: coverage, quality, test, test-cross-platform (macos-latest, macOS), test-cross-platform (ubuntu-22.04, Linux), test-cross-platform (ubuntu-latest, Linux), test-cross-platform (windows-latest, Windows).

All CI checks must pass. Release-plz PRs are exempt because they only bump versions and changelogs (code was already tested on main), and GITHUB_TOKEN-triggered force-pushes suppress CI.

• check-success = coverage
• check-success = quality
• check-success = test
• check-success = test-cross-platform (macos-latest, macOS)
• check-success = test-cross-platform (ubuntu-22.04, Linux)
• check-success = test-cross-platform (ubuntu-latest, Linux)
• check-success = test-cross-platform (windows-latest, Windows)

---

Show 2 satisfied protections

🟢 Enforce conventional commit

Require conventional commit format per https://www.conventionalcommits.org/en/v1.0.0/. Skipped for bots.

• title ~= ^(fix|feat|docs|style|refactor|perf|test|build|ci|chore|revert)(?:\(.+\))?!?:

🟢 Do not merge outdated PRs

Make sure PRs are within 10 commits of the base branch before merging

• #commits-behind <= 10

[Copilot]

Pull request overview

This PR tightens project hygiene by ensuring Rust workspace lint configuration is actually applied to the root package, and by normalizing markdown formatting in project documentation and release notes.

Changes:

• Repositions the root package’s [lints] workspace = true opt-in so workspace lints are enforced.
• Normalizes markdown formatting in CHANGELOG.md and fixes table rendering in docs/src/security-assurance.md.
• Simplifies mdformat configuration by removing the explicit exclude list.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
Cargo.toml	Moves the package lint opt-in ([lints] workspace = true) to ensure workspace lints apply; minor comment wording now needs to be updated.
CHANGELOG.md	Adds consistent blank lines and normalizes git-cliff generated markers between sections.
docs/src/security-assurance.md	Fixes markdown table formatting so the security principles/CWE tables render as tables (not code blocks).
.mdformat.toml	Removes the repo-wide exclude list, leaving core mdformat settings and extensions.

[Copilot]

Copilot wasn't able to review any files in this pull request.