CI: Fuegt automatisiertes Nightly-Release hinzu und behebt Zeitzone bei geplanten Workflows

- Neuer Workflow "nightly-pr.yaml": Erstellt und merged taeglich automatisch
  einen Pull Request von dev nach nightly (09:00 Uhr Europe/Berlin); legt den
  nightly-Branch bei Bedarf initial von dev an.
- Neuer Workflow "nightly.yaml": Baut und veroeffentlicht Pakete bei
  Aenderungen auf nightly in den nightly-Kanal der Paket-Registry
  (Debian/RPM/Arch); erstellt bewusst kein Gitea-Release.
- CRON_TZ=Europe/Berlin in security-scan.yaml und trufflehog-scan.yaml
  ergaenzt: Gitea Actions interpretiert schedule-Cron sonst in der lokalen
  Zeitzone des Gitea-Servers statt in der beabsichtigten Zeitzone.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitea/workflows/code-quality.yaml

@@ -24,16 +24,14 @@ jobs:
           components: clippy, rustfmt
           cache: false
 
+      # Ein rohes 'actions/cache' auf target/ liefert zwar einen technischen Cache-Hit (Dateien
+      # werden wiederhergestellt), Cargo kompiliert die Abhängigkeiten aber oft trotzdem neu:
+      # Der tar-basierte Restore-Vorgang setzt bei allen wiederhergestellten Dateien dieselbe
+      # Mtime, wodurch Cargos Fingerprinting nicht mehr zuverlässig erkennen kann, was
+      # älter/neuer als was ist, und sicherheitshalber alles neu baut. Swatinem/rust-cache ist
+      # genau dafür gebaut (u. a. gezielte Mtime-Korrektur nach dem Restore).
       - name: Cache Cargo-Abhängigkeiten & Build-Artefakte
-        uses: actions/cache@v6
+        uses: Swatinem/rust-cache@v2
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            target
-          key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
-          restore-keys: |
-            cargo-${{ runner.os }}-
 
       - name: Formatierung automatisch beheben
         run: cargo fmt

.gitea/workflows/main.yaml

@@ -47,16 +47,14 @@ jobs:
           toolchain: stable
           cache: false
 
+      # Ein rohes 'actions/cache' auf target/ liefert zwar einen technischen Cache-Hit (Dateien
+      # werden wiederhergestellt), Cargo kompiliert die Abhängigkeiten aber oft trotzdem neu:
+      # Der tar-basierte Restore-Vorgang setzt bei allen wiederhergestellten Dateien dieselbe
+      # Mtime, wodurch Cargos Fingerprinting nicht mehr zuverlässig erkennen kann, was
+      # älter/neuer als was ist, und sicherheitshalber alles neu baut. Swatinem/rust-cache ist
+      # genau dafür gebaut (u. a. gezielte Mtime-Korrektur nach dem Restore).
       - name: Cache Cargo-Abhängigkeiten & Build-Artefakte
-        uses: actions/cache@v6
+        uses: Swatinem/rust-cache@v2
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            target
-          key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
-          restore-keys: |
-            cargo-${{ runner.os }}-
 
       - name: Alte Paketierungs-Ausgaben aus dem Cache entfernen
         run: rm -rf target/debian target/generate-rpm target/arch

.gitea/workflows/nightly-pr.yaml

@@ -0,0 +1,91 @@
+name: Nightly Auto-Merge (Dev → Nightly)
+
+on:
+  schedule:
+    # Gitea Actions interpretiert 'schedule'-Cron standardmaessig in der lokalen
+    # Zeitzone des Gitea-Servers (anders als GitHub Actions, das immer UTC nutzt).
+    # Das CRON_TZ-Praefix ist eine Gitea-Erweiterung und legt die Zeitzone explizit
+    # und DST-sicher fest, unabhaengig von der Server-Konfiguration.
+    - cron: "CRON_TZ=Europe/Berlin 0 9 * * *"
+  workflow_dispatch:
+
+jobs:
+  merge-dev-into-nightly:
+    name: Erstelle & merge automatisch PR von dev nach nightly
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.PACKAGE_TOKEN || secrets.RELEASE_TOKEN || secrets.PUBLISH_TOKEN || secrets.API_TOKEN || secrets.PAT_TOKEN || secrets.CUSTOM_TOKEN || secrets.GITEA_TOKEN || secrets.GITHUB_TOKEN || github.token }}
+
+      - name: Stelle sicher, dass der nightly-Branch existiert
+        run: |
+          git fetch origin dev
+          if git ls-remote --exit-code --heads origin nightly > /dev/null 2>&1; then
+            echo "nightly-Branch existiert bereits."
+          else
+            echo "nightly-Branch existiert noch nicht, erstelle ihn initial von dev..."
+            git push origin origin/dev:refs/heads/nightly
+          fi
+
+      - name: Prüfe auf Unterschiede zwischen dev und nightly
+        id: diff
+        run: |
+          git fetch origin nightly
+          if git diff --quiet origin/nightly origin/dev; then
+            echo "Keine Unterschiede zwischen dev und nightly, überspringe."
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_changes=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Prüfe auf bereits offenen PR nach nightly
+        id: check_pr
+        if: steps.diff.outputs.has_changes == 'true'
+        env:
+          GITEA_URL: ${{ gitea.server_url || github.server_url }}
+          REPO: ${{ gitea.repository || github.repository }}
+          TOKEN: ${{ secrets.PACKAGE_TOKEN || secrets.RELEASE_TOKEN || secrets.PUBLISH_TOKEN || secrets.API_TOKEN || secrets.PAT_TOKEN || secrets.CUSTOM_TOKEN || secrets.GITEA_TOKEN || secrets.GITHUB_TOKEN || github.token }}
+        run: |
+          OPEN_PRS=$(curl -s -H "Authorization: token ${TOKEN}" "${GITEA_URL}/api/v1/repos/${REPO}/pulls?state=open&limit=50")
+          PR_NUMBER=$(echo "$OPEN_PRS" | jq -r '[.[] | select(.base.ref == "nightly" and .head.ref == "dev")][0].number // empty')
+          echo "Bereits offener dev→nightly PR: ${PR_NUMBER:-keiner}"
+          echo "pr_number=${PR_NUMBER}" >> "$GITHUB_OUTPUT"
+
+      - name: Erstelle PR (dev -> nightly)
+        id: create_pr
+        if: steps.diff.outputs.has_changes == 'true' && steps.check_pr.outputs.pr_number == ''
+        env:
+          GITEA_URL: ${{ gitea.server_url || github.server_url }}
+          REPO: ${{ gitea.repository || github.repository }}
+          TOKEN: ${{ secrets.PACKAGE_TOKEN || secrets.RELEASE_TOKEN || secrets.PUBLISH_TOKEN || secrets.API_TOKEN || secrets.PAT_TOKEN || secrets.CUSTOM_TOKEN || secrets.GITEA_TOKEN || secrets.GITHUB_TOKEN || github.token }}
+        run: |
+          DATE="$(date -u +%Y-%m-%d)"
+          PAYLOAD=$(jq -n --arg title "Nightly-Build: Merge dev in nightly (${DATE})" --arg head "dev" --arg base "nightly" \
+            '{title: $title, head: $head, base: $base}')
+          RESP=$(curl -f -s -S -X POST \
+            -H "Authorization: token ${TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "$PAYLOAD" \
+            "${GITEA_URL}/api/v1/repos/${REPO}/pulls")
+          PR_NUMBER=$(echo "$RESP" | jq -r '.number')
+          echo "PR #${PR_NUMBER} erstellt."
+          echo "pr_number=${PR_NUMBER}" >> "$GITHUB_OUTPUT"
+
+      - name: Merge PR automatisch
+        if: steps.diff.outputs.has_changes == 'true'
+        env:
+          GITEA_URL: ${{ gitea.server_url || github.server_url }}
+          REPO: ${{ gitea.repository || github.repository }}
+          TOKEN: ${{ secrets.PACKAGE_TOKEN || secrets.RELEASE_TOKEN || secrets.PUBLISH_TOKEN || secrets.API_TOKEN || secrets.PAT_TOKEN || secrets.CUSTOM_TOKEN || secrets.GITEA_TOKEN || secrets.GITHUB_TOKEN || github.token }}
+          PR_NUMBER: ${{ steps.create_pr.outputs.pr_number || steps.check_pr.outputs.pr_number }}
+        run: |
+          echo "Merge PR #${PR_NUMBER} automatisch (dev -> nightly)..."
+          curl -f -s -S -X POST \
+            -H "Authorization: token ${TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d '{"Do": "merge"}' \
+            "${GITEA_URL}/api/v1/repos/${REPO}/pulls/${PR_NUMBER}/merge"
+          echo "PR #${PR_NUMBER} erfolgreich gemerged."

.gitea/workflows/nightly.yaml

@@ -0,0 +1,166 @@
+name: Nightly Build & Publish
+
+on:
+  push:
+    branches:
+      - nightly
+
+jobs:
+  detect-changes:
+    name: Erkenne relevante Code-Änderungen
+    runs-on: ubuntu-latest
+    outputs:
+      code_changed: ${{ steps.filter.outputs.code }}
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v7
+
+      - name: Prüfe auf Änderungen am Programmcode
+        uses: dorny/paths-filter@v4
+        id: filter
+        with:
+          filters: |
+            code:
+              - 'src/**'
+              - 'Cargo.toml'
+              - 'Cargo.lock'
+              - 'scripts/**'
+              - '.cargo/**'
+              - '.gitea/workflows/nightly.yaml'
+
+  build-and-publish:
+    name: Build & Publish Packages (Nightly)
+    needs: detect-changes
+    if: needs.detect-changes.outputs.code_changed == 'true'
+    runs-on: ubuntu-latest
+    env:
+      CARGO_BINSTALL_VERSION: "1.23.0"
+      CARGO_DEB_VERSION: "3.8.0"
+      CARGO_GENERATE_RPM_VERSION: "0.21.0"
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v7
+
+      - name: Install Rust Toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v2
+        with:
+          toolchain: stable
+          cache: false
+
+      - name: Cache Cargo-Abhängigkeiten & Build-Artefakte
+        uses: Swatinem/rust-cache@v2
+
+      - name: Alte Paketierungs-Ausgaben aus dem Cache entfernen
+        run: rm -rf target/debian target/generate-rpm target/arch
+
+      - name: Install Cross-Compilation Toolchains (apt)
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y gcc-aarch64-linux-gnu
+
+      - name: Ermittle Rust-Version für Rustup-Target-Cache-Key
+        run: echo "RUST_VERSION=$(rustc --version | awk '{print $2}')" >> "$GITHUB_ENV"
+
+      - name: Cache Rustup Cross-Compilation-Targets
+        id: cache-rustup-targets
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/aarch64-unknown-linux-gnu
+          key: rustup-targets-${{ runner.os }}-${{ env.RUST_VERSION }}
+
+      - name: Add Rust Cross-Compilation Targets
+        if: steps.cache-rustup-targets.outputs.cache-hit != 'true'
+        run: rustup target add aarch64-unknown-linux-gnu
+
+      - name: PATH um Cargo-bin-Verzeichnis ergänzen
+        run: |
+          mkdir -p ~/.cargo/bin
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+
+      - name: Cache Packaging-Tools (cargo-binstall, cargo-deb, cargo-generate-rpm)
+        id: cache-packaging-tools
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.cargo/bin/cargo-binstall
+            ~/.cargo/bin/cargo-deb
+            ~/.cargo/bin/cargo-generate-rpm
+          key: packaging-tools-${{ runner.os }}-${{ env.CARGO_BINSTALL_VERSION }}-${{ env.CARGO_DEB_VERSION }}-${{ env.CARGO_GENERATE_RPM_VERSION }}
+
+      - name: Install Packaging Tools (Prebuilt Binaries)
+        if: steps.cache-packaging-tools.outputs.cache-hit != 'true'
+        run: |
+          curl -fsSL "https://github.com/cargo-bins/cargo-binstall/releases/download/v${CARGO_BINSTALL_VERSION}/cargo-binstall-x86_64-unknown-linux-musl.tgz" | tar -xz -C ~/.cargo/bin
+          ~/.cargo/bin/cargo-binstall -y --no-symlinks "cargo-deb@${CARGO_DEB_VERSION}" "cargo-generate-rpm@${CARGO_GENERATE_RPM_VERSION}"
+
+      - name: Run Tests
+        run: |
+          cargo test
+
+      - name: Build Release Binaries
+        run: |
+          cargo build --release --target x86_64-unknown-linux-gnu
+          cargo build --release --target aarch64-unknown-linux-gnu
+
+      - name: Determine Build Number
+        id: build_num
+        env:
+          GITEA_URL: ${{ gitea.server_url || github.server_url }}
+          REPO: ${{ gitea.repository || github.repository }}
+          REPO_OWNER: ${{ gitea.repository_owner || github.repository_owner }}
+          TOKEN: ${{ secrets.PACKAGE_TOKEN || secrets.RELEASE_TOKEN || secrets.PUBLISH_TOKEN || secrets.API_TOKEN || secrets.PAT_TOKEN || secrets.CUSTOM_TOKEN || secrets.GITEA_TOKEN || secrets.GITHUB_TOKEN || github.token }}
+        run: |
+          BUILD_NUM=$(python3 scripts/get-build-number.py)
+          echo "build_number=${BUILD_NUM}" >> $GITHUB_OUTPUT
+          echo "BUILD_NUMBER=${BUILD_NUM}" >> $GITHUB_ENV
+          echo "Ermittelte Build-Nummer: ${BUILD_NUM}"
+
+      - name: Build Debian Packages (.deb)
+        run: |
+          cargo deb --target x86_64-unknown-linux-gnu --deb-revision "${BUILD_NUMBER}" --no-build
+          cargo deb --target aarch64-unknown-linux-gnu --deb-revision "${BUILD_NUMBER}" --no-build
+
+      - name: Build Fedora / RPM Packages (.rpm)
+        run: |
+          mkdir -p target/generate-rpm
+          cargo generate-rpm --target x86_64-unknown-linux-gnu -s "release=\"${BUILD_NUMBER}\"" -o target/generate-rpm
+          cargo generate-rpm --target aarch64-unknown-linux-gnu -s "release=\"${BUILD_NUMBER}\"" -o target/generate-rpm
+
+      - name: Build Arch Linux Packages (.pkg.tar.zst)
+        run: |
+          python3 scripts/package-arch.py --target x86_64-unknown-linux-gnu --pkgrel "${BUILD_NUMBER}"
+          python3 scripts/package-arch.py --target aarch64-unknown-linux-gnu --pkgrel "${BUILD_NUMBER}"
+
+      - name: Publish Packages to Gitea Package Registry
+        env:
+          GITEA_URL: ${{ gitea.server_url || github.server_url }}
+          REPO_OWNER: ${{ gitea.repository_owner || github.repository_owner }}
+          TOKEN: ${{ secrets.PACKAGE_TOKEN || secrets.RELEASE_TOKEN || secrets.PUBLISH_TOKEN || secrets.API_TOKEN || secrets.PAT_TOKEN || secrets.CUSTOM_TOKEN || secrets.GITEA_TOKEN || secrets.GITHUB_TOKEN || github.token }}
+        run: |
+          echo "Veröffentliche Debian-Paket (Distribution: nightly, Component: main)..."
+          for deb in target/debian/*.deb; do
+            [ -f "$deb" ] || continue
+            curl -f -s -S -X PUT \
+              -H "Authorization: token ${TOKEN}" \
+              --upload-file "$deb" \
+              "${GITEA_URL}/api/packages/${REPO_OWNER}/debian/pool/nightly/main/upload"
+          done
+
+          echo "Veröffentliche Fedora/RPM-Paket (Gruppe: nightly)..."
+          for rpm in target/generate-rpm/*.rpm; do
+            [ -f "$rpm" ] || continue
+            curl -f -s -S -X PUT \
+              -H "Authorization: token ${TOKEN}" \
+              --upload-file "$rpm" \
+              "${GITEA_URL}/api/packages/${REPO_OWNER}/rpm/nightly/upload"
+          done
+
+          echo "Veröffentliche Arch Linux-Paket (Repository: nightly)..."
+          for pkg in target/arch/*.pkg.tar.zst; do
+            [ -f "$pkg" ] || continue
+            curl -f -s -S -X PUT \
+              -H "Authorization: token ${TOKEN}" \
+              --upload-file "$pkg" \
+              "${GITEA_URL}/api/packages/${REPO_OWNER}/arch/nightly"
+          done

.gitea/workflows/renovate.yaml

@@ -9,7 +9,7 @@ jobs:
   renovate:
     name: Dependency-Updates prüfen & Pull Requests erstellen
     runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:44.83.0
+    container: ghcr.io/renovatebot/renovate:44.103.6
     steps:
       - name: Renovate ausführen
         run: renovate

.gitea/workflows/security-scan.yaml

@@ -8,7 +8,7 @@ on:
       - dev
   pull_request:
   schedule:
-    - cron: "0 5 * * 1"
+    - cron: "CRON_TZ=Europe/Berlin 0 5 * * 1"
   workflow_dispatch:
 
 jobs:
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     env:
       TRIVY_VERSION: "0.74.0"
-      OSV_SCANNER_VERSION: "2.5.1"
+      OSV_SCANNER_VERSION: "2.6.0"
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v7

.gitea/workflows/testing.yaml

@@ -47,16 +47,14 @@ jobs:
           toolchain: stable
           cache: false
 
+      # Ein rohes 'actions/cache' auf target/ liefert zwar einen technischen Cache-Hit (Dateien
+      # werden wiederhergestellt), Cargo kompiliert die Abhängigkeiten aber oft trotzdem neu:
+      # Der tar-basierte Restore-Vorgang setzt bei allen wiederhergestellten Dateien dieselbe
+      # Mtime, wodurch Cargos Fingerprinting nicht mehr zuverlässig erkennen kann, was
+      # älter/neuer als was ist, und sicherheitshalber alles neu baut. Swatinem/rust-cache ist
+      # genau dafür gebaut (u. a. gezielte Mtime-Korrektur nach dem Restore).
       - name: Cache Cargo-Abhängigkeiten & Build-Artefakte
-        uses: actions/cache@v6
+        uses: Swatinem/rust-cache@v2
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            target
-          key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
-          restore-keys: |
-            cargo-${{ runner.os }}-
 
       - name: Alte Paketierungs-Ausgaben aus dem Cache entfernen
         run: rm -rf target/debian target/generate-rpm target/arch

.gitea/workflows/trufflehog-scan.yaml

@@ -4,7 +4,7 @@ on:
   push:
   pull_request:
   schedule:
-    - cron: "0 6 * * 1"
+    - cron: "CRON_TZ=Europe/Berlin 0 6 * * 1"
   workflow_dispatch:
 
 jobs:
@@ -12,7 +12,7 @@ jobs:
     name: TruffleHog
     runs-on: ubuntu-latest
     env:
-      TRUFFLEHOG_VERSION: "3.97.4"
+      TRUFFLEHOG_VERSION: "3.97.5"
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v7

.gitea/workflows/unit-tests.yaml

@@ -8,6 +8,7 @@ on:
       - reopened
     branches:
       - testing
+      - dev
 
 jobs:
   test:
@@ -23,16 +24,14 @@ jobs:
           toolchain: stable
           cache: false
 
+      # Ein rohes 'actions/cache' auf target/ liefert zwar einen technischen Cache-Hit (Dateien
+      # werden wiederhergestellt), Cargo kompiliert die Abhängigkeiten aber oft trotzdem neu:
+      # Der tar-basierte Restore-Vorgang setzt bei allen wiederhergestellten Dateien dieselbe
+      # Mtime, wodurch Cargos Fingerprinting nicht mehr zuverlässig erkennen kann, was
+      # älter/neuer als was ist, und sicherheitshalber alles neu baut. Swatinem/rust-cache ist
+      # genau dafür gebaut (u. a. gezielte Mtime-Korrektur nach dem Restore).
       - name: Cache Cargo-Abhängigkeiten & Build-Artefakte
-        uses: actions/cache@v6
+        uses: Swatinem/rust-cache@v2
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            target
-          key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
-          restore-keys: |
-            cargo-${{ runner.os }}-
 
       - name: Run Tests
         run: cargo test

Cargo.lock

@@ -375,9 +375,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.6.6"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "473c7e07f409a8d772161724aa8db6a765a2532a70f9667eeb7b49d3d02fbdca"
+checksum = "aa8876b300ab35ba921adea3dfd70157a46249b33f95c9084ae5709785478946"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -385,9 +385,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.6.6"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b48fea5a88e9ae728a2dcbedbfc0e730f7d60da42e1cb049a83c9fb8b789889"
+checksum = "ec0797fb7aeb1406c84efac526901f7ec3ead2124f946b494e72879d4b54704d"
 dependencies = [
  "anstream",
  "anstyle",
@@ -397,9 +397,9 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.6.4"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d012d2b9d65aca7f18f4d9878a045bc17899bba951561ba5ec3c2ba1eed9a061"
+checksum = "f9c751b79415d4e559e3d1fcf128e09e720eb673a06d26cf6f392d37d75b66e0"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -586,7 +586,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc 0.2.189",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -1280,7 +1280,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -1717,7 +1717,7 @@ dependencies = [
  "errno",
  "libc 0.2.189",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -1996,7 +1996,7 @@ dependencies = [
  "getrandom 0.4.3",
  "once_cell",
  "rustix 1.1.4",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]

renovate.json

@@ -1,29 +1,59 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["config:recommended"],
+  "extends": [
+    "config:recommended"
+  ],
   "timezone": "Europe/Berlin",
-  "schedule": ["before 6am on monday"],
+  "schedule": [
+    "before 6am"
+  ],
   "baseBranchPatterns": [
     "dev"
   ],
   "packageRules": [
     {
-      "matchFileNames": [".gitea/workflows/**"],
+      "matchFileNames": [
+        ".gitea/workflows/**"
+      ],
       "groupName": "Gitea Actions",
       "separateMajorMinor": false,
       "separateMinorPatch": false
     },
     {
-      "matchManagers": ["cargo"],
+      "matchManagers": [
+        "cargo"
+      ],
       "groupName": "Cargo Dependencies",
       "separateMajorMinor": false,
       "separateMinorPatch": false
     },
     {
-      "matchManagers": ["dockerfile", "docker-compose"],
+      "matchManagers": [
+        "dockerfile",
+        "docker-compose"
+      ],
       "groupName": "Docker-Images",
       "separateMajorMinor": false,
       "separateMinorPatch": false
+    },
+    {
+      "description": "Patch-/Minor-/Digest-Updates automatisch mergen, sobald alle CI-Checks (inkl. Unit-Tests) erfolgreich sind - Major-Updates sind unten explizit ausgenommen (siehe nächste Regel).",
+      "matchUpdateTypes": [
+        "patch",
+        "minor",
+        "digest",
+        "lockFileMaintenance"
+      ],
+      "automerge": true,
+      "automergeType": "pr",
+      "platformAutomerge": true
+    },
+    {
+      "description": "Major-Updates immer manuell prüfen, da potenziell brechende Änderungen.",
+      "matchUpdateTypes": [
+        "major"
+      ],
+      "automerge": false
     }
   ],
   "customManagers": [

src/cache.rs

@@ -68,7 +68,7 @@ impl Cache {
             Err(e) => {
                 crate::log::warn(
                     "cache",
-                    &format!("Cache-Lesefehler (trusted_networks): {e}"),
+                    &format!("Cache read error (trusted_networks): {e}"),
                 );
                 false
             }
@@ -90,7 +90,7 @@ impl Cache {
         {
             crate::log::warn(
                 "cache",
-                &format!("Cache-Schreibfehler (trusted_networks, ignoriert): {e}"),
+                &format!("Cache write error (trusted_networks, ignored): {e}"),
             );
         }
     }
@@ -108,7 +108,7 @@ impl Cache {
         {
             Ok(rows) => rows,
             Err(e) => {
-                crate::log::warn("cache", &format!("Cache-Lesefehler: {e}"));
+                crate::log::warn("cache", &format!("Cache read error: {e}"));
                 return None;
             }
         };
@@ -126,7 +126,7 @@ impl Cache {
             }
             Ok(None) => None,
             Err(e) => {
-                crate::log::warn("cache", &format!("Cache-Lesefehler: {e}"));
+                crate::log::warn("cache", &format!("Cache read error: {e}"));
                 None
             }
         }
@@ -145,7 +145,7 @@ impl Cache {
             )
             .await
         {
-            crate::log::warn("cache", &format!("Cache-Schreibfehler (ignoriert): {e}"));
+            crate::log::warn("cache", &format!("Cache write error (ignored): {e}"));
         }
     }
 }
@@ -157,19 +157,15 @@ pub fn is_expired(updated_at: i64, now: i64, ttl_seconds: u64) -> bool {
 
 fn ensure_cache_dir(dir: &Path) -> Result<(), String> {
     if !dir.exists() {
-        std::fs::create_dir_all(dir).map_err(|e| {
+        std::fs::create_dir_all(dir)
-            format!(
+            .map_err(|e| format!("could not create directory '{}': {e}", dir.display()))?;
-                "Verzeichnis '{}' konnte nicht angelegt werden: {e}",
-                dir.display()
-            )
-        })?;
         // create_dir_all() unterliegt dem Prozess-Umask; explizites chmod ist nötig, um
         // wirklich 0777 zu erreichen (Verzeichnis-Rechte steuern nicht die Umask neuer Dateien).
         // Wird nur beim Neuanlegen ausgeführt; bei existierenden Verzeichnissen würde ein
         // unprivilegierter Aufruf auf root-eigenen Pfaden mit EPERM fehlschlagen.
         #[cfg(unix)]
         std::fs::set_permissions(dir, std::fs::Permissions::from_mode(0o777))
-            .map_err(|e| format!("Verzeichnis-Rechte konnten nicht gesetzt werden: {e}"))?;
+            .map_err(|e| format!("could not set directory permissions: {e}"))?;
     }
     Ok(())
 }
@@ -191,7 +187,7 @@ pub async fn try_open_cache(db_path: &Path) -> Option<Cache> {
     if let Some(dir) = db_path.parent()
         && let Err(reason) = ensure_cache_dir(dir)
     {
-        crate::log::warn("cache", &format!("Cache deaktiviert: {reason}"));
+        crate::log::warn("cache", &format!("Cache disabled: {reason}"));
         return None;
     }
 
@@ -201,10 +197,7 @@ pub async fn try_open_cache(db_path: &Path) -> Option<Cache> {
     {
         Ok(db) => db,
         Err(e) => {
-            crate::log::warn(
+            crate::log::warn("cache", &format!("Could not open cache database: {e}"));
-                "cache",
-                &format!("Cache-Datenbank konnte nicht geöffnet werden: {e}"),
-            );
             return None;
         }
     };
@@ -212,17 +205,14 @@ pub async fn try_open_cache(db_path: &Path) -> Option<Cache> {
     let conn = match db.connect() {
         Ok(c) => c,
         Err(e) => {
-            crate::log::warn("cache", &format!("Cache-Verbindung fehlgeschlagen: {e}"));
+            crate::log::warn("cache", &format!("Cache connection failed: {e}"));
             return None;
         }
     };
 
     let cache = Cache { conn };
     if let Err(e) = cache.init_schema().await {
-        crate::log::warn(
+        crate::log::warn("cache", &format!("Could not initialize cache schema: {e}"));
-            "cache",
-            &format!("Cache-Schema konnte nicht initialisiert werden: {e}"),
-        );
         return None;
     }
 

src/cli.rs

@@ -11,50 +11,87 @@ use crate::mac::MacAddress;
     name = "mac2ip",
     author,
     version,
-    about = "Findet zuverlässig die aktuelle IP-Adresse zu einer MAC-Adresse im lokalen Netzwerk",
+    about = "Reliably finds the current IP address for a MAC address on the local network",
     long_about = None
 )]
 pub struct Cli {
     /// MAC-Adresse, deren aktuelle IP-Adresse ermittelt werden soll (z. B. aa:bb:cc:dd:ee:ff)
+    #[arg(help = "MAC address to look up the current IP address for (e.g. aa:bb:cc:dd:ee:ff)")]
     pub mac: MacAddress,
 
     /// Gibt das Ergebnis als einzeiliges JSON-Objekt aus; unterdrückt alle sonstigen Log-Ausgaben
-    #[arg(long)]
+    #[arg(
+        long,
+        help = "Print the result as a single-line JSON object; suppresses all other log output"
+    )]
     pub json: bool,
 
     /// Benutzerdefinierter Pfad zur Konfigurationsdatei
-    #[arg(long)]
+    #[arg(long, help = "Custom path to the configuration file")]
     pub config: Option<PathBuf>,
 
     /// Logging-Level (error, warn, info, debug)
-    #[arg(long, value_enum, env = "MAC2IP_LOG_LEVEL")]
+    #[arg(
+        long,
+        value_enum,
+        env = "MAC2IP_LOG_LEVEL",
+        help = "Log level (error, warn, info, debug)"
+    )]
     pub log_level: Option<LogLevelArg>,
 
     /// Cache-TTL in Sekunden (Standard: 1800)
-    #[arg(long, env = "MAC2IP_CACHE_TTL_SECONDS")]
+    #[arg(
+        long,
+        env = "MAC2IP_CACHE_TTL_SECONDS",
+        help = "Cache TTL in seconds (default: 1800)"
+    )]
     pub cache_ttl_seconds: Option<u64>,
 
     /// Pfad zur globalen Cache-Datenbankdatei (Standard: /var/lib/mac2ip/cache.db)
-    #[arg(long, env = "MAC2IP_CACHE_DB_PATH")]
+    #[arg(
+        long,
+        env = "MAC2IP_CACHE_DB_PATH",
+        help = "Path to the global cache database file (default: /var/lib/mac2ip/cache.db)"
+    )]
     pub cache_db_path: Option<PathBuf>,
 
     /// Timeout in Sekunden für einen einzelnen nmap-Subnetz-Scan (Standard: 120)
-    #[arg(long, env = "MAC2IP_NMAP_TIMEOUT_SECONDS")]
+    #[arg(
+        long,
+        env = "MAC2IP_NMAP_TIMEOUT_SECONDS",
+        help = "Timeout in seconds for a single nmap subnet scan (default: 120)"
+    )]
     pub nmap_timeout_seconds: Option<u64>,
 
     /// Kommagetrennte Liste von CIDR-Subnetzen für den nmap-Scan (überschreibt Auto-Erkennung)
-    #[arg(long, env = "MAC2IP_NETWORKS", value_delimiter = ',')]
+    #[arg(
+        long,
+        env = "MAC2IP_NETWORKS",
+        value_delimiter = ',',
+        help = "Comma-separated list of CIDR subnets for the nmap scan (overrides auto-detection)"
+    )]
     pub networks: Option<Vec<String>>,
 
     /// Kommagetrennte Liste von Gateway-MAC-Adressen, deren Netzwerke ohne Rückfrage für
     /// nmap-Scans (Schritt 3) vertraut werden (überschreibt die Konfigurationsdatei vollständig)
-    #[arg(long, env = "MAC2IP_TRUSTED_NETWORKS", value_delimiter = ',')]
+    #[arg(
+        long,
+        env = "MAC2IP_TRUSTED_NETWORKS",
+        value_delimiter = ',',
+        help = "Comma-separated list of gateway MAC addresses whose networks are trusted for \
+                nmap scans (step 3) without confirmation (fully overrides the config file)"
+    )]
     pub trusted_networks: Option<Vec<MacAddress>>,
 
     /// Beantwortet die "nmap-Scan in diesem Netzwerk erlauben?"-Rückfrage vor Schritt 3
     /// automatisch mit Ja (und merkt sich das Netzwerk dauerhaft im Cache), statt
     /// interaktiv nachzufragen bzw. im --json-Modus den Scan abzulehnen
-    #[arg(long)]
+    #[arg(
+        long,
+        help = "Automatically answers yes to the \"allow nmap scan on this network?\" prompt \
+                before step 3 (and remembers the network permanently in the cache), instead of \
+                asking interactively or rejecting the scan in --json mode"
+    )]
     pub auto_trust_networks: bool,
 }
 

src/error.rs

@@ -4,15 +4,15 @@ use crate::mac::MacAddressError;
 
 #[derive(Debug, thiserror::Error)]
 pub enum Mac2IpError {
-    #[error("keine IP-Adresse für MAC '{mac}' gefunden")]
+    #[error("no IP address found for MAC '{mac}'")]
     NotFound { mac: String },
     #[error(
-        "nmap-Scan abgelehnt: Netzwerk nicht vertrauenswürdig{}",
+        "nmap scan rejected: network not trusted{}",
-        .gateway_mac.as_ref().map(|m| format!(" (Gateway-MAC {m})")).unwrap_or_default()
+        .gateway_mac.as_ref().map(|m| format!(" (gateway MAC {m})")).unwrap_or_default()
     )]
     UntrustedNetwork { gateway_mac: Option<String> },
-    #[error("MAC-Adresse ungültig: {0}")]
+    #[error("invalid MAC address: {0}")]
     InvalidMac(#[from] MacAddressError),
-    #[error("E/A-Fehler: {0}")]
+    #[error("I/O error: {0}")]
     Io(#[from] std::io::Error),
 }

src/mac.rs

@@ -9,7 +9,7 @@ pub struct MacAddress([u8; 6]);
 
 #[derive(Debug, thiserror::Error, Clone, PartialEq, Eq)]
 pub enum MacAddressError {
-    #[error("ungültige MAC-Adresse: '{0}'")]
+    #[error("invalid MAC address: '{0}'")]
     InvalidFormat(String),
 }
 

src/network.rs

@@ -86,11 +86,11 @@ pub enum SudoMode {
 
 #[derive(Debug, thiserror::Error)]
 pub enum NmapRunError {
-    #[error("sudo-Zugangsdaten nicht verfügbar (nicht-interaktiver Modus)")]
+    #[error("sudo credentials unavailable (non-interactive mode)")]
     SudoUnavailable,
-    #[error("nmap-Scan hat das Zeitlimit überschritten")]
+    #[error("nmap scan exceeded the time limit")]
     Timeout,
-    #[error("E/A-Fehler: {0}")]
+    #[error("I/O error: {0}")]
     Io(#[from] std::io::Error),
 }
 

src/output.rs

@@ -42,12 +42,11 @@ pub fn print_success(result: &ResolveResult, json: bool) {
     if json {
         println!(
             "{}",
-            serde_json::to_string(&success_json(result))
+            serde_json::to_string(&success_json(result)).expect("JSON serialization never fails")
-                .expect("JSON-Serialisierung schlägt nicht fehl")
         );
     } else {
         println!(
-            "{} -> {} (Quelle: {})",
+            "{} -> {} (source: {})",
             result.mac,
             result.ip,
             result.source.as_str()
@@ -59,8 +58,7 @@ pub fn print_failure(mac: &MacAddress, err: &Mac2IpError, json: bool) {
     if json {
         println!(
             "{}",
-            serde_json::to_string(&failure_json(mac, err))
+            serde_json::to_string(&failure_json(mac, err)).expect("JSON serialization never fails")
-                .expect("JSON-Serialisierung schlägt nicht fehl")
         );
     } else {
         crate::log::error("mac2ip", &err.to_string());

src/resolver.rs

@@ -55,10 +55,7 @@ pub async fn resolve(
         && !cache::is_expired(entry.updated_at, now, config.cache_ttl_seconds)
         && network::ping_check(entry.ip).await
     {
-        crate::log::info(
+        crate::log::info("resolver", &format!("Cache hit for {mac}: {}", entry.ip));
-            "resolver",
-            &format!("Treffer im Cache für {mac}: {}", entry.ip),
-        );
         return Ok(ResolveResult {
             mac: *mac,
             ip: entry.ip,
@@ -69,13 +66,13 @@ pub async fn resolve(
     // Schritt 2: ip neigh
     crate::log::debug(
         "resolver",
-        "Cache-Treffer nicht verfügbar, prüfe 'ip neigh show'",
+        "No cache hit available, checking 'ip neigh show'",
     );
     if let Ok(output) = network::run_ip_neigh_show().await
         && let Some(ip) = network::parse_ip_neigh_output(&output, mac)
         && network::ping_check(ip).await
     {
-        crate::log::info("resolver", &format!("Treffer via ip neigh für {mac}: {ip}"));
+        crate::log::info("resolver", &format!("Hit via ip neigh for {mac}: {ip}"));
         if let Some(cache) = cache {
             cache.upsert(mac, ip, MatchSource::Arp.as_str(), now).await;
         }
@@ -87,14 +84,14 @@ pub async fn resolve(
     }
 
     // Schritt 3: nmap
-    crate::log::debug("resolver", "Kein Treffer via ip neigh, starte nmap-Scan");
+    crate::log::debug("resolver", "No hit via ip neigh, starting nmap scan");
 
     match trust::ensure_network_trusted(config, cache, auto_trust_networks, json_mode, now).await {
         TrustDecision::Allowed => {}
         TrustDecision::Denied { gateway_mac } => {
             crate::log::warn(
                 "resolver",
-                "nmap-Scan übersprungen: Netzwerk nicht als vertrauenswürdig bestätigt",
+                "nmap scan skipped: network not confirmed as trusted",
             );
             return Err(Mac2IpError::UntrustedNetwork {
                 gateway_mac: gateway_mac.map(|m| m.to_string()),
@@ -125,7 +122,7 @@ pub async fn resolve(
                 if let Some(ip) = network::parse_nmap_output(&output, mac)
                     && network::ping_check(ip).await
                 {
-                    crate::log::info("resolver", &format!("Treffer via nmap für {mac}: {ip}"));
+                    crate::log::info("resolver", &format!("Hit via nmap for {mac}: {ip}"));
                     if let Some(cache) = cache {
                         cache.upsert(mac, ip, MatchSource::Nmap.as_str(), now).await;
                     }
@@ -139,12 +136,12 @@ pub async fn resolve(
             Err(NmapRunError::SudoUnavailable) => {
                 crate::log::warn(
                     "nmap",
-                    "sudo -n fehlgeschlagen (keine Zugangsdaten) - Schritt 3 wird abgebrochen",
+                    "sudo -n failed (no credentials available) - aborting step 3",
                 );
                 break; // sudo-Session-Status ist global, ein Retry pro Subnetz bringt nichts
             }
             Err(e) => {
-                crate::log::warn("nmap", &format!("nmap-Scan für {cidr} fehlgeschlagen: {e}"));
+                crate::log::warn("nmap", &format!("nmap scan for {cidr} failed: {e}"));
                 continue; // Fehler pro Subnetz (z. B. Timeout) - nächstes Subnetz versuchen
             }
         }

src/trust.rs

@@ -35,12 +35,12 @@ pub async fn ensure_network_trusted(
     let Some(gateway_mac) = network::detect_default_gateway_mac().await else {
         crate::log::warn(
             "trust",
-            "Gateway-MAC konnte nicht ermittelt werden, Netzwerk kann nicht identifiziert werden",
+            "Could not determine gateway MAC, network cannot be identified",
         );
         if auto_trust {
             crate::log::warn(
                 "trust",
-                "--auto-trust-networks gesetzt: nmap-Scan wird trotz unbekannter Gateway-MAC ausgeführt",
+                "--auto-trust-networks set: running nmap scan despite unknown gateway MAC",
             );
             return TrustDecision::Allowed;
         }
@@ -60,9 +60,7 @@ pub async fn ensure_network_trusted(
     if auto_trust {
         crate::log::info(
             "trust",
-            &format!(
+            &format!("Network (gateway MAC {gateway_mac}) automatically marked as trusted"),
-                "Netzwerk (Gateway-MAC {gateway_mac}) automatisch als vertrauenswürdig markiert"
-            ),
         );
         if let Some(cache) = cache {
             cache.trust_network(&gateway_mac, now).await;
@@ -95,7 +93,7 @@ pub async fn ensure_network_trusted(
 async fn prompt_trust_confirmation(gateway_mac: MacAddress) -> bool {
     tokio::task::spawn_blocking(move || {
         eprint!(
-            "Unbekanntes Netzwerk (Gateway-MAC {gateway_mac}). nmap-Scan in diesem Netzwerk erlauben und dauerhaft merken? [y/N]: "
+            "Unknown network (gateway MAC {gateway_mac}). Allow nmap scan on this network and remember it permanently? [y/N]: "
         );
         let _ = std::io::stderr().flush();