From 7316a7fa35b04202b5572abeb8aa09286e60d677 Mon Sep 17 00:00:00 2001 From: Matt Jones <47545907+SoundMatt@users.noreply.github.com> Date: Tue, 28 Jul 2026 14:24:21 -0700 Subject: [PATCH] fix: pin rust-FuSa to v0.3.10 in CI instead of floating on default branch The safety job's rsfusa install used `cargo install --git ... rsfusa` with no --tag, so CI silently floated on whatever rust-FuSa's default branch happened to be at run time. Pin to the current released version so safety-evidence generation is reproducible and doesn't change out from under us on unrelated pushes. Closes #10 Signed-off-by: Matt Jones <47545907+SoundMatt@users.noreply.github.com> --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b20e8a2..c114974 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -133,7 +133,7 @@ jobs: key: ubuntu-cargo-safety-${{ hashFiles('**/Cargo.lock') }} - name: Install rsfusa - run: cargo install --git https://github.com/SoundMatt/rust-FuSa rsfusa --locked + run: cargo install --git https://github.com/SoundMatt/rust-FuSa --tag v0.3.10 rsfusa --locked - name: Build release binary (needed for qualify) run: cargo build --release --locked