From 800027e8464a9618026b87de805981c18f8ad320 Mon Sep 17 00:00:00 2001 From: zerosnacks Date: Tue, 16 Sep 2025 12:03:17 +0200 Subject: [PATCH 1/5] pin to hashes --- .github/dependabot.yml | 6 ++++++ .github/workflows/ci.yml | 28 ++++++++++++++-------------- 2 files changed, 20 insertions(+), 14 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..5ace460 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,6 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1c68f92..ce7ce73 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -33,13 +33,13 @@ jobs: - uses: actions/checkout@v5 with: persist-credentials: false - - uses: dtolnay/rust-toolchain@stable + - uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable with: toolchain: ${{ matrix.rust }} # Only run tests on latest stable and above - name: Install cargo-nextest if: ${{ matrix.rust != '1.88' }} # MSRV - uses: taiki-e/install-action@nextest + uses: taiki-e/install-action@de179ea33fa5f5c434a81563f0e8a1c4f7ab8fe2 # nextest - name: build if: ${{ matrix.rust == '1.88' }} # MSRV run: cargo build --workspace ${{ matrix.flags }} @@ -54,8 +54,8 @@ jobs: - uses: actions/checkout@v5 with: persist-credentials: false - - uses: dtolnay/rust-toolchain@stable - - uses: Swatinem/rust-cache@v2 + - uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable + - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2 with: cache-on-failure: true - run: cargo test --workspace --doc @@ -68,9 +68,9 @@ jobs: - uses: actions/checkout@v5 with: persist-credentials: false - - uses: dtolnay/rust-toolchain@stable - - uses: taiki-e/install-action@cargo-hack - - uses: Swatinem/rust-cache@v2 + - uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable + - uses: taiki-e/install-action@c9a06c0e5d38d182732372ae4390adb6ddbfd51b # cargo-hack + - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2 with: cache-on-failure: true - name: cargo hack @@ -83,8 +83,8 @@ jobs: - uses: actions/checkout@v5 with: persist-credentials: false - - uses: dtolnay/rust-toolchain@clippy - - uses: Swatinem/rust-cache@v2 + - uses: dtolnay/rust-toolchain@45949235481cda149033232bdf068b00ceb0b28d # clippy + - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2 with: cache-on-failure: true - run: cargo clippy --workspace --all-targets --all-features @@ -98,8 +98,8 @@ jobs: - uses: actions/checkout@v5 with: persist-credentials: false - - uses: dtolnay/rust-toolchain@nightly - - uses: Swatinem/rust-cache@v2 + - uses: dtolnay/rust-toolchain@55d80eb3c5a4228eec5390a083c092095115c6f1 # nightly + - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2 with: cache-on-failure: true - run: cargo doc --workspace --all-features --no-deps --document-private-items @@ -113,13 +113,13 @@ jobs: - uses: actions/checkout@v5 with: persist-credentials: false - - uses: dtolnay/rust-toolchain@nightly + - uses: dtolnay/rust-toolchain@55d80eb3c5a4228eec5390a083c092095115c6f1 # nightly with: components: rustfmt - run: cargo fmt --all --check deny: - uses: ithacaxyz/ci/.github/workflows/deny.yml@main + uses: ithacaxyz/ci/.github/workflows/deny.yml@9c8d0dc20e7ad02455d3fdab2378a05f29907630 # main ci-success: runs-on: ubuntu-latest @@ -136,6 +136,6 @@ jobs: timeout-minutes: 30 steps: - name: Decide whether the needed jobs succeeded or failed - uses: re-actors/alls-green@release/v1 + uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # release/v1 with: jobs: ${{ toJSON(needs) }} From eb276bf1de2b4cb8d6c68c44e2a18b89a4d0c1a9 Mon Sep 17 00:00:00 2001 From: zerosnacks Date: Tue, 16 Sep 2025 12:27:48 +0200 Subject: [PATCH 2/5] package read is not required --- .github/workflows/codeql.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index dd672fa..3299fcb 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,5 +1,8 @@ name: CodeQL +permissions: + contents: read + on: push: branches: ["main"] @@ -19,7 +22,6 @@ jobs: runs-on: ubuntu-latest permissions: security-events: write - packages: read actions: read contents: read From 726dd999b17622195f19e11b44934303f3bff9f4 Mon Sep 17 00:00:00 2001 From: zerosnacks Date: Tue, 16 Sep 2025 12:30:01 +0200 Subject: [PATCH 3/5] remove duplicate perm --- .github/workflows/codeql.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 3299fcb..d2566ff 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -23,7 +23,6 @@ jobs: permissions: security-events: write actions: read - contents: read strategy: fail-fast: false From 9412a9b057acbbb89a25e80b3ac0c1ff039c2cc1 Mon Sep 17 00:00:00 2001 From: zerosnacks Date: Tue, 16 Sep 2025 13:32:34 +0200 Subject: [PATCH 4/5] pin to `master` and configure per https://github.com/dtolnay/rust-toolchain?tab=readme-ov-file#choice-of-full-length-commit-sha --- .github/workflows/ci.yml | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ce7ce73..fccc4cd 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -33,9 +33,9 @@ jobs: - uses: actions/checkout@v5 with: persist-credentials: false - - uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable + - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master with: - toolchain: ${{ matrix.rust }} + toolchain: stable ${{ matrix.rust }} # Only run tests on latest stable and above - name: Install cargo-nextest if: ${{ matrix.rust != '1.88' }} # MSRV @@ -54,7 +54,9 @@ jobs: - uses: actions/checkout@v5 with: persist-credentials: false - - uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable + - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master + with: + toolchain: stable - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2 with: cache-on-failure: true @@ -68,7 +70,9 @@ jobs: - uses: actions/checkout@v5 with: persist-credentials: false - - uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable + - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master + with: + toolchain: stable - uses: taiki-e/install-action@c9a06c0e5d38d182732372ae4390adb6ddbfd51b # cargo-hack - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2 with: @@ -83,7 +87,10 @@ jobs: - uses: actions/checkout@v5 with: persist-credentials: false - - uses: dtolnay/rust-toolchain@45949235481cda149033232bdf068b00ceb0b28d # clippy + - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master + with: + toolchain: nightly + components: clippy - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2 with: cache-on-failure: true @@ -98,7 +105,9 @@ jobs: - uses: actions/checkout@v5 with: persist-credentials: false - - uses: dtolnay/rust-toolchain@55d80eb3c5a4228eec5390a083c092095115c6f1 # nightly + - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master + with: + toolchain: nightly - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2 with: cache-on-failure: true @@ -113,8 +122,9 @@ jobs: - uses: actions/checkout@v5 with: persist-credentials: false - - uses: dtolnay/rust-toolchain@55d80eb3c5a4228eec5390a083c092095115c6f1 # nightly + - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master with: + toolchain: nightly components: rustfmt - run: cargo fmt --all --check From 26562103818a6afee778775b6a55300867bd9204 Mon Sep 17 00:00:00 2001 From: zerosnacks Date: Tue, 16 Sep 2025 13:35:00 +0200 Subject: [PATCH 5/5] fix --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fccc4cd..4546e2e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -35,7 +35,7 @@ jobs: persist-credentials: false - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master with: - toolchain: stable ${{ matrix.rust }} + toolchain: ${{ matrix.rust }} # Only run tests on latest stable and above - name: Install cargo-nextest if: ${{ matrix.rust != '1.88' }} # MSRV