ci: pin dtolnay/rust-toolchain action, keep channels via toolchain input - #451
Open
arcaven wants to merge 1 commit into
Open
ci: pin dtolnay/rust-toolchain action, keep channels via toolchain input#451arcaven wants to merge 1 commit into
arcaven wants to merge 1 commit into
Conversation
…put (#1) The stable and nightly refs were the repo's two documented pin-gate exemptions because the ref name carried the channel. Pinning the action commit (2c7215f, master 2026-08-04) and selecting the channel through the explicit toolchain input keeps rolling-channel semantics while closing the mutable-ref surface. The action-pin-gate allowlist is now empty and the gate validates every remote ref. Prepares for org-level sha_pinning_required, which has no allowlist mechanism.
Zious11
added a commit
that referenced
this pull request
Sep 6, 2026
…C-DRIFT fixed, dispositions recorded Maintenance sweep maint-2026-09-05 (prior: maint-2026-07-21) run against develop 0b1ea80 (v0.13.3). 6 sweeps executed (1 Dependency Audit, 2 Documentation Drift, 3 Pattern Consistency, 4 Holdout Freshness, 5 Performance Baseline, 7 Spec Coherence); Sweep 6 DTU SKIP (dtu_required:false) + Sweep 9 a11y SKIP (no UI). Overall CLEAN: 0 CVEs, 0 test regressions, 0 performance regressions >10%, 0 blocking defects. - maintenance/sweep-report-2026-09-05.md: consolidated top-level report. - STATE.md: D-553 decision logged; SPEC-DRIFT SC-001 fixed (Drift Item rows PG-W84-LOCAL-BATCH/PG-W85-003/PG-W85-005 RESOLVED); maintenance_run_id/ maintenance_prior_run frontmatter updated; Current Phase Steps + Session Resume Checkpoint rotated (D-548 evicted to Decisions Log, D-552 archived to cycles/wave-086/session-checkpoints.md); Active Carry-Forwards updated with this run's dispositions. Pipeline stays CLEAN RELEASED/PAUSED at v0.13.3 — no release/version/head change. - cycles/maint-2026-09-05/lessons.md: two process observations (PG-MAINT-CLASSIFIER-MERGE-BLOCK, PG-MAINT-REVIEWONLY-HOOK-TRIP). Dispositions: 5 Dependabot Rust-dep bumps (#459/#458/#444/#443/#442) human-authorized to merge, execution handed to the human (gh pr merge classifier-blocked this session); 5 Actions-bump PRs (#457/#456/#455/#449/#436) HELD for supply-chain review; human PRs #451/#407 reviewed, not merged; 2-edit docs-only fix queued (not opened, gh pr create classifier-blocked); 5 holdout coverage gaps + 1 fixture-wiring opportunity routed to product-owner. Single-commit burst per TD-VSDD-053. Claude-Session: https://claude.ai/code/session_01Atd9SQNyxBnmfeBcVYVTHt
Zious11
added a commit
that referenced
this pull request
Sep 6, 2026
Reconcile maint-2026-09-05 (D-553) from "5 Rust-dep merges authorized, pending human execution" to executed-and-verified truth: all 5 merged to develop (#458 clap/#443 serde_json/#442 anyhow/#444 serde/#459 owo-colors); develop tip 0b1ea80->adc9428d; CI fully green, zero regression. DEP-SOAK-FOLLOWUP-2026-07-27 + ROUTE-BC-DEFER-2026-07-11 cleared. Scope note: human also merged 2 held Actions-bump PRs beyond the authorized set (#457/#456); held-set narrowed to #455/#449/#436. #451 now DIRTY/conflicting; #407 unchanged; doc-fix still queued. No release (still v0.13.3; main unchanged 46ebd6e). STATE.md: current_step/timestamp/develop_head frontmatter, EXACT RESUME POINT, Project Metadata (Version/Develop HEAD/Last Updated), Phase Progress maint-2026-09-05 row, Current Phase Steps (D-554 added, D-549 evicted - preserved verbatim in Decisions Log), Decisions Log D-554 added, Active Carry-Forwards (DEP-SOAK/ROUTE-BC-DEFER cleared, MAINT-2026-09-05-DEP-RUST-MERGE-HANDOFF resolved, ACTIONS-BUMPS-HELD narrowed, new PR-451-DTOLNAY-PIN-CONFLICT row), Session Resume Checkpoint replaced (D-553 archived to cycles/maint-2026-09-05/session-checkpoints.md), size-budget banner reconciled to true wc -l (363). maintenance/sweep-report-2026-09-05.md: frontmatter develop_head_close + prs_merged updated; "Post-run execution (D-554)" section appended. Claude-Session: https://claude.ai/code/session_01Atd9SQNyxBnmfeBcVYVTHt
Zious11
added a commit
that referenced
this pull request
Sep 6, 2026
…rged, #451 deferred, #407 request-changes posted Session resumed from PAUSED (D-555). Human directive: clear the carry-over PRs from maint-2026-09-05. - 3 held Dependabot GitHub-Actions bumps supply-chain reviewed MERGE-SAFE and merged to develop: #455 codeql-action (1c7d740), #449 scorecard-action (36bccab, also patches transitive CVE-2026-53488/ 47262/34986), #436 actions/checkout (9c49951). Held set now empty. - Docs-only PR #465 squash-merged (97361cd), resolving the 2 LOW STALE-DOC findings from maint-2026-09-05 Sweep 2. - PR #451 (dtolnay-pin) DEFERRED per explicit human decision — untouched. - PR #407 (fork-friendly-release-ops) given a full review; CHANGES_REQUESTED posted to the contributor; remains open under PR-407-FORK-RELEASE-OPS. - develop_head adc9428 -> 97361cd; backlog remains empty. - Two process observations recorded in cycles/maint-2026-09-05/lessons.md (L-3 PG-MERGE-WRAPPER-BYPASS, L-4 PG-MAINT-CLASSIFIER-MERGE-BLOCK recurrence). STATE.md is ~118KB / NEEDS-COMPACT. A /compact-state pass is advisable before the next burst; not performed in this burst. Single-commit burst (TD-VSDD-053). Claude-Session: https://claude.ai/code/session_01EQAaPvh9fwaG31jmkPicKW
arcaven
added a commit
to ArcavenAE/wirerust
that referenced
this pull request
Sep 8, 2026
…cope, dead refs, dedup) Blocking items from the 2026-09-06 review, plus the duplication item and the four minors. 1. Homebrew formulae had no OS guard. All five now declare `depends_on :macos`. The release pipeline builds only darwin-arm64 and darwin-amd64, so on Linux the Hardware::CPU.arm? else-branch downloaded a Mach-O that could not run. Also removes the stable formula's `version` line. Its tag is v<version>, so brew scans the same value from the URL and `brew audit --strict` rejects the duplicate. The four prerelease templates keep theirs; their tags do not scan to the declared value. Verified by rendering all five with realistic tags in a scratch tap: `brew audit --strict` and `brew style` clean on each. 2. Unknown-channel tags no longer advertise a `brew install` line. The default case arm now leaves FORMULA empty, so the install line stays "download below". The release title falls back to the bare project name rather than to a formula that was never updated. 3. Injection-guard scope gap. `sync-upstream.yml`'s conflict report now binds `steps.merge.outputs.files` through `env:`, and every other context in that workflow's run bodies is bound too. The guard self-discovers: it scans every workflow in .github/workflows/ on its existing structural criteria, with sign-and-publish.yml and backfill-release.yml kept as required files whose zero-in-scope result is still the broken-detection sentinel. Discovery finds sync-upstream.yml, ci.yml and release.yml. Negative control: reintroducing the inline expression makes the guard fail and name the exact step. 4. Dead spec references. All seven now point at a commit-pinned permalink to the external design doc rather than a path that does not exist here. 5. Deduplication. The signing logic was byte-identical between stable-sign and the backfill sign job, and differed from alpha-sign only by the binary prefix; the tap update was near-identical across three jobs. Both are now scripts: scripts/sign-and-notarize.sh and scripts/update-homebrew-formula.sh, with `set -euo pipefail` in both, which is the drift the review named. The signing script takes subcommands rather than running end to end, so each phase stays its own workflow step and its secrets stay scoped to that step. A single entry point would put the notarization credentials in scope for signing and the signing identity in scope for notarization. Verified: the step sequence is unchanged in both workflows, and per-step env keys are identical before and after apart from one added COMMIT_SHA. Minors: release notes are built with printf so continuation lines carry no YAML indentation and stop rendering as a code block; sync-upstream.yml gains its trailing newline; the rust-toolchain pin moves to the SHA open PR Zious11#451 uses, so whichever lands first the other needs no reconciliation. Not done: flipping harden-runner to `egress-policy: block`. Block mode needs a per-repo allowlist, and the base repo has run these jobs in audit mode with no detections history to build one from, so turning it on blind is how the signing jobs start failing on an unrelated day. Happy to do it as a follow-up once there is a run history to derive the allowlist from. Claude-Session: https://claude.ai/code/session_01YV58wMepvhR6qNYZhwPJkV
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This closes the one intentional gap in your action-pin-gate: the dtolnay/rust-toolchain refs are the only remote actions CI runs from a mutable ref, and the reason recorded in the allowlist comment (pinning would defeat rolling-channel tracking) no longer holds. The action's master branch accepts the channel through an explicit
toolchaininput (required, per its action.yml), so a commit pin and channel tracking now coexist. Recent npm-ecosystem supply-chain incidents made mutable action refs worth closing out where the cost is this low.What changes: all 9 dtolnay/rust-toolchain sites (8 in ci.yml, 1 in release.yml) move from
@stable/@nightlyto a commit pin (2c7215f, master as of 2026-08-04) with the channel passed viawith: toolchain:. The nightly doc-tests job already passed its dated nightly through that input, so it only changes the ref. The gate's allowlist empties, and its exemption comment is updated to say why the exemption retired rather than deleted quietly.Counted at this branch head:
Verification: the action-pin-gate script from this branch's ci.yml, extracted and run against the tree with
ALLOWLIST="", exits 0. Thetoolchaininput is declaredrequired: truein the pinned commit's action.yml, so a future site added without a channel fails loudly at startup rather than silently defaulting.One judgment call to flag: the pin is to the action's master branch at a dated commit (dtolnay publishes no releases), and master has advanced since. If you would rather track a different commit, or keep your documented exemption instead, happy to adjust or close; the same change has been running green on our fork since 2026-08-04.