chore: DX improvements — typos, blame-ignore, PR template, registry checklist (#120)

* chore: add workspace clippy lints, release profiles, COMPAT.md, diff-registry.sh

- Workspace clippy lints: or_fun_call, redundant_clone, collection_is_never_read,
  naive_bytecount, stable_sort_primitive, large_types_passed_by_value, assigning_clones
- Fix or_fun_call in cargo_registry.rs (unwrap_or -> unwrap_or_else)
- Release profiles: release (thin LTO) + release-official (full LTO, codegen-units=1)
- COMPAT.md: protocol compatibility matrix for all 7 registries (40 endpoints)
- scripts/diff-registry.sh: differential smoke tests (Docker/npm/Cargo/PyPI/Go/Raw)

* ci: add typos spell-check job and config

* chore: add .git-blame-ignore-revs for bulk fmt/clippy commits

* chore: unify PR template with What/Why/Checklist format

* docs: add new registry checklist and improve contributing guide

* fix: correct typos action SHA to v1.45.0

.git-blame-ignore-revs

@@ -0,0 +1,32 @@
+# Bulk formatting and lint-fix commits — ignore in git blame
+# See: https://docs.github.com/en/repositories/working-with-files/using-files/viewing-a-file#ignore-commits-in-the-blame-view
+
+# style: cargo fmt
+b2be7102fef2b42d7546ef66c8fd02f06b130bc4
+26d30b622dc4d17d160999f043e8be9985cea263
+8da4c4278a87ced1420fc6e7a9ea2c567e4e7b97
+
+# style: apply rustfmt to registry handlers
+8336166e0e541f213d0f3b20d55ea509bbb2f2d8
+
+# style: fix formatting
+a9125e6287e9f31fff0720e7c1c07cdc5e94c9db
+bbdefff07cf588ad5f848bec9031f4e51cc47c41
+ac4020d34f72b08e1eb3dc0c4248128b1012ddb5
+
+# Fix formatting
+08eea07cfe05ac64e9d6d4a7f8314f269d834e9c
+c7098a4aed2a880dff418abe48c5016ea5ac20e0
+
+# Fix code formatting
+0a97b00278c59a267c0fc7cdca7eb2bd7aa5decf
+
+# Fix clippy warnings
+cf9feee5b2116e216cbcd6b0d3ae1fe5e93cf7d5
+2f86b4852a9c9a1a5691e8b48da8be3fb45f6d0c
+
+# fix: clippy let_and_return warning
+dab3ee805edbd2e6fb3cffda9c9618468880153e
+
+# fix: resolve clippy warnings and format code
+00fbd201127defee9c24a8edeb01eba3c053f306

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,16 +1,14 @@
-## Summary
+## What
 
-<!-- What does this PR do? -->
+<!-- Brief description of changes -->
 
-## Changes
+## Why
 
-<!-- List key changes -->
+<!-- Motivation / issue reference -->
 
 ## Checklist
 
-- [ ]  passes
+- [ ] Tests pass (`cargo test`)
-- [ ]  passes
+- [ ] No new clippy warnings (`cargo clippy -- -D warnings`)
-- [ ]  passes
+- [ ] Updated CHANGELOG.md (if user-facing change)
-- [ ] No  in production code
+- [ ] New registry? See CONTRIBUTING.md checklist
-- [ ] New public API has documentation
-- [ ] CHANGELOG updated (if user-facing change)

.github/pull_request_template.md

@@ -1,15 +0,0 @@
-## What does this PR do?
-
-<!-- Brief description of the change -->
-
-## Related issue
-
-<!-- Link to issue, e.g. Fixes #123 -->
-
-## Checklist
-
-- [ ] `cargo fmt` passes
-- [ ] `cargo clippy` passes with no warnings
-- [ ] `cargo test --lib --bin nora` passes
-- [ ] New functionality includes tests
-- [ ] CHANGELOG.md updated (if user-facing change)

.github/workflows/ci.yml

@@ -9,6 +9,13 @@ on:
 permissions: read-all
 
 jobs:
+  typos:
+    name: Typos
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: crate-ci/typos@02ea592e44b3a53c302f697cddca7641cd051c3d # v1.45.0
+
   test:
     name: Test
     runs-on: ubuntu-latest

CONTRIBUTING.md

@@ -107,16 +107,19 @@ All three must pass. CI will enforce this.
 
 - Run `cargo fmt` before committing
 - Fix all `cargo clippy` warnings
+- No `unwrap()` in production code (use proper error handling)
 - Follow Rust naming conventions
 - Keep functions short and focused
 - Add tests for new functionality
 
 ## Pull Request Process
 
-1. Update CHANGELOG.md if the change is user-facing
+1. Branch from `main`, use descriptive branch names (`feat/`, `fix/`, `chore/`)
-2. Add tests for new features or bug fixes
+2. Update CHANGELOG.md if the change is user-facing
-3. Ensure CI passes (fmt, clippy, test, security checks)
+3. Add tests for new features or bug fixes
-4. Keep PRs focused — one feature or fix per PR
+4. Ensure CI passes (fmt, clippy, test, security checks)
+5. Keep PRs focused — one feature or fix per PR
+6. PRs are squash-merged to keep a clean history
 
 ## Commit Messages
 
@@ -131,6 +134,20 @@ Use conventional commits:
 
 Example: `feat: add npm scoped package support`
 
+## New Registry Checklist
+
+When adding a new registry type (Docker, npm, Maven, etc.), ensure all of the following:
+
+- [ ] Handler in `nora-registry/src/registry/`
+- [ ] Health check endpoint
+- [ ] Metrics (Prometheus)
+- [ ] OpenAPI spec update
+- [ ] Startup log line
+- [ ] Dashboard UI tile
+- [ ] Playwright e2e test
+- [ ] CHANGELOG entry
+- [ ] COMPAT.md update
+
 ## Reporting Issues
 
 - Use GitHub Issues with the provided templates

_typos.toml

@@ -0,0 +1,10 @@
+[default.extend-words]
+# HashiCorp is not a typo
+Hashi = "Hashi"
+# flate2 is a Rust crate for compression
+flate = "flate"
+# grep pattern fragment in lint script
+validat = "validat"
+
+[files]
+extend-exclude = ["vendor/", "*.lock", "target/", "fuzz/corpus/"]