Adds exception so dependabot ignores rust version for MSRV test

.github/dependabot.yml

@@ -12,3 +12,7 @@ updates:
     schedule:
       interval: weekly
     open-pull-requests-limit: 5
+    ignore:
+      # The versioned ref tests our MSRV; @stable jobs track the latest compiler.
+      # Raise the MSRV deliberately alongside Cargo.toml's rust-version.
+      - dependency-name: dtolnay/rust-toolchain

.github/workflows/actions.yml

@@ -1,6 +1,9 @@
 name: Build and Run
 
-on: [push, pull_request]
+on:
+  push:
+    branches: [main]
+  pull_request:
 
 permissions:
   contents: read
@@ -78,6 +81,7 @@ jobs:
     steps:
 
     - uses: actions/checkout@v7
+    # Keep pinned to Cargo.toml's rust-version; rust-stable tests the latest Rust.
     - uses: dtolnay/rust-toolchain@1.88.0
 
     - name: Build & Test

.github/workflows/advisories.yml

@@ -2,6 +2,7 @@ name: Dependency advisories
 
 on:
   push:
+    branches: [main]
   pull_request:
   schedule:
     - cron: '23 6 * * *'

.github/workflows/fuzz.yml

@@ -2,6 +2,7 @@ name: Bounded fuzzing
 
 on:
   push:
+    branches: [main]
   pull_request:
   schedule:
     - cron: '41 6 * * 1'

TESTING.md

@@ -89,22 +89,25 @@ their normal package manager as described above.
 ## Platform coverage
 
 The minimum supported Rust version is **1.88.0**, declared as `rust-version = "1.88"`
-in `Cargo.toml`. CI runs the Rust build and tests on Linux
-and Windows, checks Rust 1.88.0 on Linux, and runs the Clevis compatibility tests
-in a separate Linux job.
+in `Cargo.toml`. CI runs the Rust build and tests on the latest stable compiler
+on Linux and Windows, checks Rust 1.88.0 on Linux, and runs the Clevis compatibility
+tests in a separate Linux job. The stable jobs follow new Rust releases
+automatically. Dependabot ignores `dtolnay/rust-toolchain` updates so the MSRV job
+stays pinned; raise it deliberately alongside `Cargo.toml`'s `rust-version`.
 
 Other Unix platforms have no CI coverage. See [key storage and rotation](KEY_STORAGE.md)
 for platform permission and crash-durability differences.
 
 ## Release checks and fuzzing
 
-CI requires formatting, strict Clippy, compilation, release builds, tests and
+CI runs on pull requests and pushes to `main`, avoiding duplicate runs for PR
+branch pushes. It requires formatting, strict Clippy, compilation, release builds, tests and
 Rust 1.88.0 checks, retaining Linux, Windows and Clevis jobs. The assurance job
 checks the combined platform reports; a local Linux run alone cannot establish
 Windows behavior. Repository maintainers must select these jobs as required
 status checks in GitHub branch protection to enforce them before merging.
 
-Dependency advisories are checked on pushes, pull requests and a daily schedule
+Dependency advisories are checked on pushes to `main`, pull requests and a daily schedule
 with a freshly fetched RustSec database. Both the library and fuzz lockfiles are
 scanned, and warnings fail the check. Dependabot monitors Cargo dependencies
 (including fuzz tooling) and GitHub Actions weekly. To run the advisory checks:
@@ -116,7 +119,7 @@ cargo audit --file fuzz/Cargo.lock --deny warnings
 ```
 
 Two bounded, seeded fuzz targets exercise recovery request parsing and JWK
-conversion on pull requests, pushes and weekly runs. They run on nightly Rust
+conversion on pull requests, pushes to `main` and weekly runs. They run on nightly Rust
 with AddressSanitizer, separately from the library's stable/MSRV builds. See
 [fuzz/README.md](fuzz/README.md) for commands, resource bounds, seed provenance
 and crash reproduction. A bounded run is a regression check, not exhaustive