fix/workflow conformity

.github/workflows/rust.yml

@@ -2,9 +2,9 @@ name: Rust
 
 on:
   push:
-    branches: ["main"]
+    branches: ["master"]
   pull_request:
-    branches: ["main"]
+    branches: ["master"]
 
 env:
   CARGO_TERM_COLOR: always
@@ -33,9 +33,6 @@ jobs:
       - name: Run tests
         run: cargo test --verbose --all-features
 
-      - name: Documentation
-        run: cargo doc --all-features
-
   msrv:
     name: Verify MSRV (1.85)
     runs-on: ubuntu-latest
@@ -47,4 +44,44 @@ jobs:
         uses: dtolnay/rust-toolchain@1.85.0
 
       - name: Check
-        run: cargo check --all-features
+        run: cargo check --all-features
+
+  coverage:
+    name: Coverage
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust Toolchain (stable)
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: llvm-tools-preview
+
+      - name: Install cargo-llvm-cov
+        run: cargo install cargo-llvm-cov
+
+      - name: Run coverage
+        run: cargo llvm-cov --all-features --workspace --lcov --output-path lcov.info
+
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v4
+        with:
+          files: lcov.info
+          fail_ci_if_error: false
+
+  audit:
+    name: Security Audit
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust Toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install cargo-audit
+        run: cargo install cargo-audit
+
+      - name: Run cargo audit
+        run: cargo audit

CHANGELOG.md

@@ -5,6 +5,26 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.0] - 2026-08-18
+
+### Changed
+
+- Migrated from the `bs-*` workspace path dependencies to the published crates.io `multi-*` crates. `multi-codec` is now `1.2`, `multi-hash` is now `1.1.2`, and the `multi-base`/`multi-trait`/`multi-util`/`multi-cbor` deps now resolve from crates.io. The `bs-multibase`/`bs-multicodec`/`bs-multihash`/`bs-multitrait`/`bs-multiutil` `package` aliases and `path` overrides are removed.
+- `EncodedCid` is now `BaseEncoded<Cid, CidEncoder>` instead of `BaseEncoded<Cid, DetectedEncoder>`. This is a breaking change to the public type identity of `EncodedCid`.
+- `From<Cid> for Vec<u8>` and the `serde` serialization path no longer delegate to `EncodeIntoBuffer` on `Codec`, `Multihash`, or `Cid`. They build the byte representation via `From<Codec> for Vec<u8>` and `From<Multihash> for Vec<u8>` plus `extend_from_slice`, because the published `multi-codec` and `multi-hash` types impl `From<*> for Vec<u8>` and `TryDecodeFrom` but not `EncodeIntoBuffer`.
+
+### Added
+
+- `CidEncoder`, a `multi_util::BaseEncoder` for CIDs. It tries multibase first, then `Base58Btc` explicitly for unprefixed v0 CIDs, then falls back to `multi_util::DetectedEncoder`. The published `DetectedEncoder` tries `Base58Flickr` before `Base58Btc` (alphabet iteration order) and bails on the first strict decode success; both base58 alphabets accept the same characters, so a naked base58btc v0 CID decoded under `Base58Flickr` first and produced wrong bytes. `CidEncoder` fixes v0 CID decoding.
+
+### Fixed
+
+- Unprefixed (naked) base58btc v0 CID strings now decode to the correct bytes. Previously they decoded as `Base58Flickr`, producing wrong bytes.
+
+### Removed
+
+- Removed the `ensure_no_std` job from `.github/workflows/rust.yml`. The crate is not `no_std`-compatible: `multi-hash` (a required dependency) hard-codes `unsigned-varint` with the `std` feature and has no `std` cargo feature or `#![no_std]` attribute, so a `thumbv6m-none-eabi` build fails with `E0463` in `subtle`, `constant_time_eq`, `data-encoding`, and `unsigned-varint`. This mirrors the fix applied upstream in `multi-hash`, which also has no `ensure_no_std` job.
+
 ## [0.1.0] - 2026-08-12
 
 ### Added
@@ -36,4 +56,6 @@ This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 - The `multi-base`, `multi-codec`, `multi-hash`, `multi-trait`, and `multi-util` dependencies use the published crates.io versions.
 
-[0.1.0]: https://github.com/cryptidtech/multi-cid/releases/tag/v0.1.0
+[0.2.0]: https://github.com/cryptidtech/multi-cid/releases/tag/v0.2.0
+
+[0.1.0]: https://github.com/cryptidtech/multi-cid/releases/tag/v0.1.0

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "multi-cid"
-version = "0.1.0"
+version = "0.2.0"
 edition = "2021"
 rust-version = "1.85"
 authors = ["Dave Grantham <dwg@linuxprogrammer.org>"]
@@ -17,22 +17,22 @@ dag_cbor = ["dep:multi-cbor", "multi-cbor/tags"]
 
 [dependencies]
 multi-base = { version = "1.0", default-features = false }
-multi-codec = "1.1"
-multi-hash = "1.0"
-multi-trait = { version = "1.0.5", default-features = false }
+multi-cbor = { version = "0.1", optional = true }
+multi-codec = "1.2"
+multi-hash = "1.1.2"
+multi-trait = { version = "1.0", default-features = false }
 multi-util = "1.1"
 thiserror = "2.0"
 serde = { version = "1.0", default-features = false, features = [
   "alloc",
   "derive",
 ], optional = true }
-multi-cbor = { version = "0.1", optional = true }
 
 [dev-dependencies]
 criterion = "0.8"
 hex = "0.4"
 multi-cbor = "0.1"
-proptest = "1.4"
+proptest = "1.11"
 serde_json = "1.0"
 serde_test = "1.0"
 

src/cid.rs

@@ -4,7 +4,7 @@ use core::fmt;
 use multi_base::Base;
 use multi_codec::Codec;
 use multi_hash::Multihash;
-use multi_trait::{EncodeInto, Null, TryDecodeFrom};
+use multi_trait::{EncodeInto, EncodeIntoBuffer, Null, TryDecodeFrom};
 use multi_util::{
     Base58Encoder, BaseEncoded, BaseEncoder, CodecInfo, DetectedEncoder, EncodingInfo,
 };
@@ -135,6 +135,12 @@ impl EncodeInto for Cid {
     }
 }
 
+impl EncodeIntoBuffer for Cid {
+    fn encode_into_buffer(&self, buffer: &mut Vec<u8>) {
+        buffer.extend_from_slice(&self.clone().encode_into());
+    }
+}
+
 impl<'a> TryFrom<&'a [u8]> for Cid {
     type Error = Error;