chore: pass clippy --all-targets and enforce it in CI

[gvonnessi]

Summary

The strict clippy gate cargo clippy --workspace --all-targets --all-features -- -D warnings previously failed with 33 lints (all in test code, surfaced because #![warn(clippy::pedantic)] is enabled at the crate roots). CI only ran clippy without --all-targets, so this debt was invisible. This PR resolves every lint and tightens CI so the --all-targets gate is enforced from now on. No runtime behavior changes.

⚠️ CI gate tightened (please note)

The clippy invocations are changed from --all-features to --all-targets --all-features, so test/bench/example targets are now linted. Affected steps:

File	Step	Before → After
.github/workflows/ci.yml	Clippy (workspace)	--all-features → --all-targets --all-features
.github/workflows/ci.yml	Clippy Swift bridge	(bare) → --all-targets
.github/workflows/publish.yml	Clippy (workspace)	--all-features → --all-targets --all-features

Future PRs that introduce lints in test/bench/example code will now be caught.

Lint count: 33 → 0

Under clippy 1.96.0 (the toolchain in this environment), the --all-targets gate emitted exactly 33 lints. (The original estimate of ~41 included needless_pass_by_value; that pedantic lint does not fire under 1.96.0, confirmed by a cold re-lint at exit 0.)

Lint	Count	Disposition
default_trait_access	13	Fixed
similar_names	18	Scoped #[allow] (justified)
module_inception	1	Fixed (structural)
manual_contains	1	Fixed

15 fixed via real code changes · 18 scoped-allowed with reasons · 0 crate-level blanket allows.

Fixed (real, idiomatic changes)

• default_trait_access ×13 — cdx-core/src/archive/reader.rs (tests): replaced Default::default() with the concrete zip::write::FileOptions::default() in start_file::<&str, ()>(..) calls. The turbofish already pins the type, so this is a no-op at runtime.
• manual_contains ×1 — cdx-core/tests/conformance.rs: declared.iter().any(|n| *n == "unknown") → declared.contains(&"unknown").
• module_inception ×1 — cdx-core/src/document/tests.rs: removed the redundant inner mod tests { .. } wrapper. The file is loaded by #[cfg(test)] mod tests; in document/mod.rs, so it is the tests module; the inner mod tests was pointless nesting. This is a pure dedent — the file's non-whitespace bytes are byte-identical before and after (verified with cmp), so no #[allow] was needed and nothing semantic changed.

Scoped-allowed (with justification)

• similar_names ×18 — cdx-core/src/security/encryption.rs: a module-scoped #[allow(clippy::similar_names)] (with a one-line comment) on the three key-wrapping test modules (key_wrapping_tests, rsa_oaep_tests, pbes2_tests). These flag wrapper vs wrapped — the natural "wrap an object, get a wrapped result" idiom in crypto tests, where wrapped.wrapped_key is then accessed. Renaming to satisfy a one-character-difference heuristic would add churn without improving clarity. Allows are scoped to the specific test modules, not the crate.

Verification (all run locally, all green)

Check	Result
cargo clippy --workspace --all-targets --all-features -- -D warnings	✅ exit 0 (incl. cold re-lint)
cargo clippy --manifest-path cdx-swift-bridge/Cargo.toml --all-targets -- -D warnings	✅ exit 0
cargo build --workspace --all-features	✅
cargo test --workspace --all-features	✅ 1082 passed, 0 failed (matches baseline)
cargo fmt --all -- --check	✅ clean
swift-bridge build + test	✅ 18 passed

The exact CI clippy command(s) were run locally and pass.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!