feat(test): migrate from MySQL to MariaDB testcontainers (#96)

- Replace MySQL testcontainers with MariaDB for better ready conditions
- Update Cargo.toml to use mariadb feature instead of mysql
- Update all test files to use Mariadb::default() instead of
Mysql::default()
- MariaDB module has built-in ready conditions that wait for:
  - 'mariadbd: ready for connections.' on stderr
  - 'port: 3306' on stderr
- This provides more reliable container startup and reduces flaky tests
- All tests pass with the new MariaDB configuration

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **Breaking Changes**
- TLS now always-on via rustls; legacy TLS feature flags/build variants
removed; repo ownership/branding updated.

- **New Features**
- CLI TLS controls added: --tls-ca-file,
--insecure-skip-hostname-verify, --allow-invalid-certificate (mutually
exclusive) with explicit warnings and exit codes.

- **Improvements**
- CLI-first config precedence, stricter error messages, tighter
validation, and simplified builds.

- **Documentation**
- Extensive TLS migration guides, install/troubleshoot updates, and
contact/branding changes.

- **Tests**
  - New TLS-focused unit/integration tests and CI workflows.

- **Chores**
  - CI/deny config and tooling/workflow cleanup.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: unclesp1d3r <251112+unclesp1d3r@users.noreply.github.com>

Author: 3 people

.actrc

@@ -1,5 +1,10 @@
+# Using Ubuntu 22.04 base for all runners to match most workflows and ensure reproducible builds
 -P ubuntu-22.04=catthehacker/ubuntu:act-22.04
--P ubuntu-latest=catthehacker/ubuntu:act-latest
+-P ubuntu-latest=catthehacker/ubuntu:act-22.04
 -P macos-13=catthehacker/ubuntu:act-22.04
+-P macos-latest=catthehacker/ubuntu:act-22.04
 -P windows-2022=catthehacker/ubuntu:act-22.04
+-P windows-latest=catthehacker/ubuntu:act-22.04
 --container-architecture linux/amd64
+--pull=false
+--no-skip-checkout

.chglog/config.yml

@@ -2,7 +2,7 @@ style: github
 template: CHANGELOG.tpl.md
 info:
   title: CHANGELOG
-  repository_url: https://github.com/unclesp1d3r/gold_digger
+  repository_url: https://github.com/EvilBit-Labs/gold_digger
 options:
   commits:
     filters:

.cursor/rules/project/core-concepts.mdc

@@ -4,7 +4,7 @@ alwaysApply: true
 
 # Gold Digger Core Concepts
 
-This file defines the core concepts and constraints for the Gold Digger MySQL/MariaDB query tool.
+This document defines the essential architecture patterns, safety requirements, and development constraints for the Gold Digger MySQL/MariaDB query tool.
 
 ## Project Identity
 
@@ -75,47 +75,34 @@ src/
 
 ## Known Bugs & Issues
 
-1. **Pattern matching bug**: `Some(&_)` should be `Some(_)` in main.rs:59
-2. **Non-standard exit codes**: `exit(-1)` becomes 255, not documented error codes
-3. **Version mismatch**: CHANGELOG.md v0.2.6 vs Cargo.toml v0.2.5
+1. **Memory**: No streaming support - O(row_count × row_width) memory usage
 
 ## Feature Flags
 
 ```toml
-default = ["json", "csv", "ssl", "additional_mysql_types", "verbose"]
-ssl = ["mysql/native-tls"]                 # Platform native TLS (no OpenSSL dependency)
-ssl-rustls = ["mysql/rustls-tls"]         # Pure Rust TLS implementation
+default = ["json", "csv", "additional_mysql_types", "verbose"]
 additional_mysql_types = ["mysql_common?/bigdecimal", "mysql_common?/rust_decimal", ...]
 verbose = []                               # Conditional println!/eprintln!
 ```
 
-**Note**: `ssl` and `ssl-rustls` are mutually exclusive. The deprecated `vendored` feature has been removed as OpenSSL dependencies have been eliminated.
+**Note**: TLS is now always available and is no longer a feature flag. The project uses a rustls-only implementation instead of the previous dual native-tls/rustls approach.
 
-## Code Quality Standards (Zero Tolerance)
+## Quality Standards
 
-### Quality Gates (Required Before Commits)
+### Required Before Commits
 
 ```bash
-cargo fmt --check           # 100-character line limit enforced
-cargo clippy -- -D warnings # Zero tolerance for warnings
-cargo nextest run           # Parallel test execution (preferred)
-cargo audit                 # Security vulnerability scanning (advisory)
+just fmt-check    # cargo fmt --check (100-char line limit)
+just lint         # cargo clippy -- -D warnings (ZERO tolerance)
+just test         # cargo nextest run (preferred) or cargo test
+just security     # cargo audit (advisory)
 ```
 
 ### Commit Standards
 
 - **Format:** Conventional commits (`feat:`, `fix:`, `docs:`, etc.)
-- **Scope:** Use Gold Digger scopes: `(cli)`, `(db)`, `(output)`, `(tls)`, `(config)`
-- **Automation:** cargo-dist handles versioning and distribution; git-cliff handles changelog generation
-- **CI Parity:** All CI operations executable locally
-
-### Error Handling Patterns
-
-- Use `anyhow::Result<T>` for all fallible functions
-- Never use `from_value::<String>()` - always handle `mysql::Value::NULL`
-- Implement credential redaction in all log output
-- Use `?` operator for error propagation
-- Feature-gate verbose output: `#[cfg(feature = "verbose")]`
+- **Scope:** Use `(cli)`, `(db)`, `(output)`, `(tls)`, `(config)`
+- **Automation:** cargo-dist handles versioning; git-cliff handles changelog
 
 ## Security Requirements
 
@@ -137,7 +124,7 @@ cargo audit                 # Security vulnerability scanning (advisory)
 
 ## Requirements Gap (High Priority)
 
-Current v0.2.5 → Target v1.0:
+Current v0.2.6 → Target v1.0:
 
 - **CLI present; finalize precedence/UX**: Config precedence, flags, user experience (F001-F003)
 - **Exit code standards**: Need proper error taxonomy (F005)
@@ -212,9 +199,9 @@ fn write_output(rows: &[Row], output_file: &str, output: &mut impl Write) -> Res
 
 ```bash
 # Build variations
-cargo build --release                                    # Standard build (native TLS)
-cargo build --release --no-default-features --features ssl-rustls  # Pure Rust TLS
-cargo build --no-default-features --features "csv json" # Minimal build
+cargo build --release                                    # Standard build (TLS always available)
+cargo build --release --no-default-features --features "json csv additional_mysql_types verbose"  # No-default-features build
+cargo build --no-default-features --features "csv json" # No-default-features build
 
 # Development (CLI-first approach)
 cargo install --path .  # Local install

.cursor/rules/rust-best-practices.mdc

@@ -23,76 +23,51 @@ alwaysApply: true
 - Public functions in modules should be documented with doc comments (`///`).
 - Use `pub mod` in [`lib.rs`](mdc:src/lib.rs) to expose modules.
 
-## 🚨 Critical Safety Rules
+## Format Module Contract
 
-### Database Value Conversion (PANIC RISK)
+All format modules must implement:
 
 ```rust
-// ❌ NEVER - causes panics on NULL/non-string types
-from_value::<String>(row[column.name_str().as_ref()])
-
-// ✅ ALWAYS - safe NULL handling
-match &row[column.name_str().as_ref()] {
-    mysql::Value::NULL => "".to_string(),
-    val => from_value_opt::<String>(val)
-        .unwrap_or_else(|_| format!("{:?}", val))
-}
-```
-
-### Security (NEVER VIOLATE)
-
-- **NEVER** log `DATABASE_URL` or credentials - always redact
-- **NEVER** make external service calls at runtime (offline-first)
-- Always recommend SQL `CAST(column AS CHAR)` for type safety
-
-## Configuration Architecture
-
-### CLI-First Resolution Pattern
-
-```rust
-fn resolve_config_value(cli: &Cli) -> anyhow::Result<String> {
-    if let Some(value) = &cli.field {
-        Ok(value.clone())                    // CLI flag (highest priority)
-    } else if let Ok(value) = env::var("ENV_VAR") {
-        Ok(value)                           // Environment variable (fallback)
-    } else {
-        anyhow::bail!("Missing required configuration")  // Error if neither
-    }
-}
+pub fn write<W: Write>(
+    rows: impl IntoIterator<Item = impl IntoIterator<Item = impl AsRef<str>>>,
+    output: &mut W
+) -> anyhow::Result<()>
 ```
 
-### Configuration Precedence
+This zero-copy API accepts:
 
-1. CLI flags (highest priority)
-2. Environment variables (fallback)
-3. Error if neither provided
+- **Rows**: Any iterable of iterables (slices, Vecs, iterators) where items are convertible to `&str`
+- **Output**: Mutable reference to any `Write` implementation (files, stdout, memory buffers)
+- **Performance**: Avoids unnecessary allocations and supports streaming writes
 
-## Error Handling Patterns
+## Code Quality Standards
 
-- Use `anyhow::Result<T>` for application binaries and `thiserror` (or library-specific error types) for library crates
-- Handle nullable database values via `Option<T>` or explicit null checks/conversions rather than using unchecked database driver conversions
-- Implement credential redaction in all log output
-- Use `?` operator for error propagation
-- Use `get_required_env()` helper for environment variable validation with contextual error messages
-- Avoid panics in production code; prefer returning errors. Only use `panic!` for unrecoverable, truly exceptional cases
-- Library crates must return Result-based errors instead of panicking (including in tests) to avoid surprising consumers
+### Formatting & Linting
 
-## Project File Organization
+- **Line limit**: 100 characters (enforced by `rustfmt.toml`)
+- **Clippy warnings**: Zero tolerance (`-D warnings`)
+- **Error handling**: Use `anyhow` for applications, `thiserror` for libraries
+- **Documentation**: Doc comments (`///`) required for all public functions
 
-### Configuration Files
+### Essential Commands
 
-- **Cargo.toml**: Dependencies, features, release profile
-- **rustfmt.toml**: Code formatting rules (100-char limit)
-- **deny.toml**: Security and license compliance
-- **rust-toolchain.toml**: Rust version specification
+```bash
+just fmt-check    # cargo fmt --check (100-char line limit)
+just lint         # cargo clippy -- -D warnings (ZERO tolerance)
+just test         # cargo nextest run (preferred) or cargo test
+just security     # cargo audit (advisory)
+```
 
-### Development Automation
+## Error Handling
 
-- **justfile**: Cross-platform build automation and common tasks
-- **.pre-commit-config.yaml**: Git hook configuration for quality gates
-- **CHANGELOG.md**: Auto-generated version history (conventional commits)
+- Use `anyhow::Result<T>` for applications
+- Use `thiserror` for library error types
+- Always use `?` for error propagation
+- Add context with `.map_err()` for better debugging
+- Avoid panics in production code; prefer returning errors
+- Library crates must return Result-based errors instead of panicking
 
-### Documentation Standards
+## Documentation Standards
 
 Required for all public functions using `///`:
 
@@ -108,52 +83,35 @@ Required for all public functions using `///`:
 /// # Example
 /// ```
 /// let string_rows = rows_to_strings(mysql_rows)?;
-/// csv::write(string_rows, output)?;
+/// let mut writer = std::io::BufWriter::new(std::fs::File::create("output.csv")?);
+/// csv::write(&string_rows, &mut writer)?;
 /// ```
 pub fn rows_to_strings(rows: Vec<mysql::Row>) -> anyhow::Result<Vec<Vec<String>>> {
     // Implementation
 }
 ```
 
-### Code Style
+## Code Style
 
 - Follow [Rustfmt](mdc:https://github.com/rust-lang/rustfmt) conventions for formatting
 - Use `snake_case` for function and variable names, `CamelCase` for types and structs
 - Prefer iterators and combinators over manual loops where possible
 - Use explicit types for function signatures, especially for public APIs
-- Prefer grouping imports by standard library, external crates, and local modules, separated by newlines (advisory rule to prevent format-only diffs during reviews)
+- Group imports by standard library, external crates, and local modules, separated by newlines
 
 ## Features and Conditional Compilation
 
-- Use Cargo features (see `[features]` in [`Cargo.toml`](mdc:Cargo.toml)) to enable/disable output formats and verbose logging.
-- Use `#[cfg(feature = "...")]` to conditionally compile code based on enabled features, as in [`main.rs`](mdc:src/main.rs).
+- Use Cargo features (see `[features]` in [`Cargo.toml`](mdc:Cargo.toml)) to enable/disable output formats and verbose logging
+- Use `#[cfg(feature = "...")]` to conditionally compile code based on enabled features
 
 ## Dependency Management
 
-- Pin dependency versions in [`Cargo.toml`](mdc:Cargo.toml) and use minimal required features for each crate.
-- Use optional dependencies and features for extensibility (e.g., SSL, additional MySQL types).
-
-## Testing and Safety
-
-- Add tests in a `tests/` directory or as `#[cfg(test)]` modules within each file.
-- Validate all external input (e.g., environment variables) and handle missing/invalid values gracefully.
-- Use the `get_required_env()` helper function for environment variable validation with contextual error messages.
-- Prefer returning early on error conditions.
-
-### Test Coverage Guidelines
-
-- **Default Target:** ≥80% coverage with `cargo tarpaulin`
-- **Recommended Exclusions:** `main.rs`, binary crates, auto-generated code, error enums, and integration test scaffolding
-- **Documentation Requirement:** Maintainers must document coverage overrides in `CONTRIBUTING.md` with justification
-- **Flexibility:** Coverage targets are guidelines, not absolute blockers. Lower coverage is acceptable with explanation and maintainer approval
-
-## Documentation
-
-- Keep [`README.md`](mdc:README.md) up to date with usage, features, and examples.
-- Document all public functions and modules with doc comments.
+- Pin dependency versions in [`Cargo.toml`](mdc:Cargo.toml) and use minimal required features for each crate
+- Use optional dependencies and features for extensibility (e.g., additional MySQL types, output formats)
 
-## Miscellaneous
+## Testing Guidelines
 
-- Use `.gitignore` to exclude build artifacts and sensitive files.
-- Use `.editorconfig` for consistent editor settings.
-- Follow the guidelines in [`CONTRIBUTING.md`](mdc:CONTRIBUTING.md) for code contributions.
+- Add tests in a `tests/` directory or as `#[cfg(test)]` modules within each file
+- Validate all external input (e.g., environment variables) and handle missing/invalid values gracefully
+- Prefer returning early on error conditions
+- Target ≥80% coverage with `cargo llvm-cov`

.github/FUNDING.yml

@@ -1,3 +1,3 @@
 # These are supported funding model platforms
 
-github: [unclesp1d3r]
+github: [EvilBit-Labs]

.github/ISSUE_TEMPLATE.md

@@ -45,9 +45,9 @@ Add any other context about the issue here.
 
 Please select the appropriate template for your issue:
 
-- [Bug Report](https://github.com/UncleSp1d3r/gold_digger/issues/new?template=bug_report.md)
-- [Feature Request](https://github.com/UncleSp1d3r/gold_digger/issues/new?template=feature_request.md)
-- [Security Report](https://github.com/UncleSp1d3r/gold_digger/issues/new?template=security_report.md)
+- [Bug Report](https://github.com/EvilBit-Labs/gold_digger/issues/new?template=bug_report.md)
+- [Feature Request](https://github.com/EvilBit-Labs/gold_digger/issues/new?template=feature_request.md)
+- [Security Report](https://github.com/EvilBit-Labs/gold_digger/issues/new?template=security_report.yml)
 
 ---
 

.github/ISSUE_TEMPLATE/bug_report.md

@@ -49,7 +49,9 @@ A clear and concise description of what actually happened.
 
 ```bash
 # How did you build gold_digger?
-cargo build --release --no-default-features --features "ssl-rustls"
+cargo build --release  # Standard build with TLS
+# OR
+cargo build --no-default-features --features "json csv"  # Minimal build
 ```
 
 ## Error Output

.github/ISSUE_TEMPLATE/security_report.yml

@@ -9,11 +9,11 @@ body:
       value: |
         > **⚠️ IMPORTANT: For security vulnerabilities, please use GitHub's private vulnerability reporting instead of opening a public issue.**
         >
-        > **Preferred method**: Go to the [Security tab](https://github.com/UncleSp1d3r/gold_digger/security) and click "Report a vulnerability" for private disclosure.
+        > **Preferred method**: Go to the [Security tab](https://github.com/EvilBit-Labs/gold_digger/security) and click "Report a vulnerability" for private disclosure.
         >
         > **If you must disclose publicly**: Redact all exploit details, sensitive information, and proof-of-concept code. Only include enough information for the maintainer to understand the issue scope.
         >
-        > **Contact maintainer directly**: For urgent or highly sensitive issues, contact [UncleSp1d3r](https://github.com/UncleSp1d3r) or email <unclespider@pm.me>.
+        > **Contact maintainer directly**: For urgent or highly sensitive issues, contact [EvilBit-Labs](https://github.com/EvilBit-Labs) or email <support@evilbitlabs.io>.
 
   - type: textarea
     id: vulnerability-description
@@ -92,7 +92,7 @@ body:
     attributes:
       label: Enabled Features
       description: Features enabled during testing
-      placeholder: e.g., "default", "ssl-rustls", "csv json ssl"
+      placeholder: e.g., "default", "ssl", "csv json ssl"
 
   - type: textarea
     id: steps-to-reproduce
@@ -170,7 +170,7 @@ body:
 
         **For sensitive security issues, please contact the maintainer directly:**
 
-        - **GitHub**: [UncleSp1d3r](https://github.com/UncleSp1d3r)
-        - **Email**: <unclespider@pm.me>
+        - **GitHub**: [EvilBit-Labs](https://github.com/EvilBit-Labs)
+        - **Email**: <support@evilbitlabs.io>
 
         **Note**: This is a single-maintainer project. Response times may vary, but security issues will be prioritized.

.github/act-test-scenarios.yml

@@ -18,15 +18,15 @@ scenarios:
         payload:
           ref: "refs/heads/main"
           repository:
-            full_name: "UncleSp1d3r/gold_digger"
+            full_name: "EvilBit-Labs/gold_digger"
       - name: "Pull request"
         event: pull_request
         payload:
           action: "opened"
           pull_request:
             head:
               repo:
-                full_name: "UncleSp1d3r/gold_digger"
+                full_name: "EvilBit-Labs/gold_digger"
 
   # Security Workflow Testing
   security_testing:
@@ -91,7 +91,7 @@ scenarios:
                 full_name: "fork-user/gold_digger"
             base:
               repo:
-                full_name: "UncleSp1d3r/gold_digger"
+                full_name: "EvilBit-Labs/gold_digger"
 
   # Error Scenario Testing
   error_scenarios:
@@ -191,10 +191,8 @@ matrix:
 
   # Feature combinations
   features:
-    - name: "ssl"
-      flags: "--no-default-features --features json,csv,ssl,additional_mysql_types,verbose"
-    - name: "ssl-rustls"
-      flags: "--no-default-features --features json,csv,ssl-rustls,additional_mysql_types,verbose"
+    - name: "default"
+      flags: "--release"
     - name: "minimal"
       flags: "--no-default-features --features json,csv,additional_mysql_types,verbose"
 

.github/ci-performance-config.yml

@@ -96,10 +96,7 @@ monitoring:
 feature_targets:
   ssl:
     build_time: 180.0
-    binary_size: 8388608 # 8MB
-  ssl-rustls:
-    build_time: 200.0
-    binary_size: 10485760 # 10MB
+    binary_size: 9437184 # 9MB (rustls implementation)
   minimal:
     build_time: 120.0
     binary_size: 6291456 # 6MB