diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index d0af1c0..698f145 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -1,36 +1,45 @@
 name: Push or PR
 
 on:
-  [push, pull_request, workflow_dispatch]
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
 
 env:
   CARGO_TERM_COLOR: always
 
 jobs:
-  build_n_test:
-    strategy:
-      matrix:
-        os: [ubuntu-latest] # macos-latest, windows-latest
-
-    runs-on: ${{ matrix.os }}
-
+  check:
+    runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v7
     - uses: dtolnay/rust-toolchain@stable
-      with:
-        components: rustfmt, clippy
     - uses: taiki-e/install-action@nextest
-    - name: rustfmt
-      run: cargo fmt --all -- --check
     - name: check
       run: cargo check --all-targets --all-features --verbose
-    - name: clippy
-      run: cargo clippy --all-targets --all-features -- -D warnings
     - name: Build
       run: cargo build --verbose --all-targets --all-features
     - name: Test
       run: cargo nextest run --all-features --all-targets
 
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+      - run: cargo fmt --all -- --check
+      - run: cargo clippy --workspace --all-targets --all-features -- -D warnings
+        if: always()
+
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: EmbarkStudios/cargo-deny-action@v2
+
   semver:
     name: Check semver
     strategy:
@@ -47,3 +56,24 @@ jobs:
       - name: Abort on error
         if: ${{ failure() }}
         run: echo "Semver check failed" && false
+
+  coverage:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: llvm-tools-preview
+      - uses: taiki-e/install-action@nextest
+      - uses: taiki-e/install-action@cargo-llvm-cov
+      - name: Run tests with coverage
+        run: cargo llvm-cov nextest --all-features --all-targets --no-report
+      - name: Generate coverage reports
+        run: |
+          cargo llvm-cov report --summary-only
+          cargo llvm-cov report --lcov --output-path lcov.info
+      - uses: actions/upload-artifact@v7
+        with:
+          name: coverage
+          path: lcov.info
+          if-no-files-found: error
diff --git a/deny.toml b/deny.toml
new file mode 100644
index 0000000..e2ae025
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,7 @@
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+
+[licenses]
+allow = ["MIT", "Apache-2.0", "Unicode-3.0"]
+confidence-threshold = 0.93