Skip to content

Default install-whitaker to whitaker-installer 0.2.10 #644

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
leynos merged 2 commits into from
Oct 23, 2026
Merged

Default install-whitaker to whitaker-installer 0.2.10 #644

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8d56353
Default install-whitaker to whitaker-installer 0.2.10
leynos Oct 22, 2026
190c85d
Wrap the install-whitaker changelog entry
leynos Oct 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .github/actions/install-whitaker/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,12 @@ file.

## v1.0.0 (Unreleased)

- Default `installer-version` to 0.2.10 and pin its five release archive
digests, computed from an independent download and cross-checked against the
release sidecars. 0.2.10 updates the installer's managed checkout with a
fetch and hard reset rather than `git pull`, which aborted on stale cached
checkouts. 0.2.9 stays pinned and remains the floor.

- Enforce the estate's Whitaker install rule. The installer always receives
`--no-source-fallback`, whatever `ci-mode` says, so a missing published lint
library or Dylint tool archive fails before Cargo starts. The default
Expand Down
2 changes: 1 addition & 1 deletion .github/actions/install-whitaker/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,7 +83,7 @@ home would otherwise keep serving an installer built for an older version.
| Name | Type | Description | Required | Default |
| ------------------- | ------ | -------------------------------------------------------- | -------- | -------------- |
| `cargo-home` | string | Cargo home holding the cached installer binary | no | `~/.cargo` |
| `installer-version` | string | Version of `whitaker-installer`, 0.2.9 or later | no | `0.2.9` |
| `installer-version` | string | Version of `whitaker-installer`, 0.2.9 or later | no | `0.2.10` |
| `installer-sha256` | string | Digest for an asset the manifest does not pin | no | `""` |
| `suite-version` | string | Refused: any non-empty value fails the step | no | `""` |
| `cache-provider` | string | Built-in `github` or caller-owned `external` | no | `github` |
Expand Down
2 changes: 1 addition & 1 deletion .github/actions/install-whitaker/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ inputs:
action pins, and must be 0.2.9 or later: that is the first release with
--no-source-fallback, which the action always passes.
required: false
default: "0.2.9"
default: "0.2.10"

@sourcery-ai sourcery-ai Bot Oct 22, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Medium · CI keeps the old installer

When the Linux CI job restores a cached Whitaker checkout that causes 0.2.9’s git pull to abort, the Linux CI workflow passes WHITAKER_INSTALLER_VERSION=0.2.9 explicitly, overriding this default; its cached checkout is therefore still updated by the old installer’s git pull, and CI continues to fail on stale cached checkouts.

Update the CI version override to 0.2.10 or remove it so the workflow uses the new default.

Prompt for AI agents 
In `.github/actions/install-whitaker/action.yml` at line 15:

**CI keeps the old installer**

When the Linux CI job restores a cached Whitaker checkout that causes 0.2.9’s `git pull` to abort, the Linux CI workflow passes `WHITAKER_INSTALLER_VERSION=0.2.9` explicitly, overriding this default; its cached checkout is therefore still updated by the old installer’s `git pull`, and CI continues to fail on stale cached checkouts.

Update the CI version override to 0.2.10 or remove it so the workflow uses the new default.

@sourcery-ai sourcery-ai Bot Oct 22, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚪ Low · Guides name the old default

When a consumer consults the user guide to determine the default installer version, the action now defaults to 0.2.10, but the current user guide still says 0.2.9 is the default, so consumers consulting it are given the wrong version. Update the user-facing documentation to match.

Update the current user guide's default-version references to 0.2.10 while keeping the 0.2.9 minimum-version floor unchanged.

Also at .github/actions/install-whitaker/README.md:86.

Prompt for AI agents 
In `.github/actions/install-whitaker/action.yml` at line 15:

**Guides name the old default**

When a consumer consults the user guide to determine the default installer version, the action now defaults to 0.2.10, but the current user guide still says 0.2.9 is the default, so consumers consulting it are given the wrong version. Update the user-facing documentation to match.

Update the current user guide's default-version references to 0.2.10 while keeping the 0.2.9 minimum-version floor unchanged.

Also at `.github/actions/install-whitaker/README.md:86`.

Comment thread
coderabbitai[bot] marked this conversation as resolved.
Resolved
installer-sha256:
description: >-
SHA-256 digest of the whitaker-installer release archive for this
Expand Down
5 changes: 5 additions & 0 deletions .github/actions/install-whitaker/installer-digests.sha256
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,3 +9,8 @@
d7afbed4170a5a54a12f2298cce41cf00330d5629d645a46dde716123be722f9 whitaker-installer-x86_64-apple-darwin-v0.2.9.tgz
e84e5d9119b14ed6ddbe6067bd4bcce1c3e90be403096612d3cf9b37a0bf6451 whitaker-installer-x86_64-pc-windows-msvc-v0.2.9.zip
71ba9b6de2b9550c70a5bf1be606e2cb6afc9515f56c3fc7b5f5d6ca1fe39b0e whitaker-installer-x86_64-unknown-linux-gnu-v0.2.9.tgz
554b4720a3735e3f58220ae8479a482ad31083d58a17ad3c450da9b799ec704c whitaker-installer-aarch64-apple-darwin-v0.2.10.tgz
384b9800e54bc32a9f328954acce858f2c2057de75d4dcf99e1e6bb97398f4f5 whitaker-installer-aarch64-unknown-linux-gnu-v0.2.10.tgz
941fb3cfbe58a2ef95578bb6bab86498fb0b1719ef3e8542606cee1d726fd9cc whitaker-installer-x86_64-apple-darwin-v0.2.10.tgz
20ea775948f599c16b264016e56cfa0369cfdb3156a699193481e39023cb4605 whitaker-installer-x86_64-unknown-linux-gnu-v0.2.10.tgz
03ee2754d7f697a36339e956cc5ca8aedeb9ec2a1bb4e64e556d0dadf5a7ae9a whitaker-installer-x86_64-pc-windows-msvc-v0.2.10.zip
4 changes: 2 additions & 2 deletions .github/actions/install-whitaker/tests/test_install_whitaker.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@
"x86_64-pc-windows-msvc",
"x86_64-unknown-linux-gnu",
)
_PINNED_VERSIONS = ("0.2.9",)
_PINNED_VERSIONS = ("0.2.9", "0.2.10")

@sourcery-ai sourcery-ai Bot Oct 22, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 High · Incorrect archive digests pass

When a 0.2.10 manifest digest is replaced with a different 64-character hexadecimal value, TestPinnedDigestManifest.test_pins_every_supported_version_and_target checks only asset names and 64-character hexadecimal syntax, so an incorrect 0.2.10 digest still passes; the action then rejects the real archive and installation fails.

Assert the expected digest values for the newly pinned 0.2.10 assets, or independently verify the hashes of those assets in a test.

Prompt for AI agents 
In `.github/actions/install-whitaker/tests/test_install_whitaker.py` at line 34:

**Incorrect archive digests pass**

When a 0.2.10 manifest digest is replaced with a different 64-character hexadecimal value, `TestPinnedDigestManifest.test_pins_every_supported_version_and_target` checks only asset names and 64-character hexadecimal syntax, so an incorrect 0.2.10 digest still passes; the action then rejects the real archive and installation fails.

Assert the expected digest values for the newly pinned 0.2.10 assets, or independently verify the hashes of those assets in a test.



def _step_env(name: str) -> dict[str, str]:
Expand Down Expand Up @@ -70,7 +70,7 @@ def _step_script(name: str) -> str:
"always passes."
),
"required": False,
"default": "0.2.9",
"default": "0.2.10",
},
"installer-sha256": {
"description": (
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/test-install-whitaker.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ permissions:
contents: read

env:
WHITAKER_TEST_INSTALLER_VERSION: 0.2.9
WHITAKER_TEST_INSTALLER_VERSION: 0.2.10

@sourcery-ai sourcery-ai Bot Oct 22, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 High · Wrong installer version passes

When the action mistakenly installs a different supported version, such as 0.2.9, the install workflow requests 0.2.10, but its verification checks only that an installer file is executable; install-whitaker therefore passes if it installs 0.2.9 instead, so the test does not establish that the real 0.2.10 archive works.

Verify the installed binary's reported version or otherwise assert that the archive selected was the requested 0.2.10 asset.

Prompt for AI agents 
In `.github/workflows/test-install-whitaker.yml` at line 15:

**Wrong installer version passes**

When the action mistakenly installs a different supported version, such as 0.2.9, the install workflow requests 0.2.10, but its verification checks only that an installer file is executable; `install-whitaker` therefore passes if it installs 0.2.9 instead, so the test does not establish that the real 0.2.10 archive works.

Verify the installed binary's reported version or otherwise assert that the archive selected was the requested 0.2.10 asset.


jobs:
install-whitaker:
Expand Down
Loading