From 612a93e64df87ce78fdc9f82cda5391db0c33db4 Mon Sep 17 00:00:00 2001 From: Payton McIntosh Date: Sat, 31 Oct 2026 09:29:38 +0000 Subject: [PATCH] Repin install-whitaker and shared-actions to 5a99aed7 Move every shared-actions reference, the coverage tool cache key and the tests that name the pin to the approved 5a99aed78ce68dcebd3052b75c31e6f173162b1e (concordat QG-002). That revision carries the whitaker-installer 0.2.11 digests, so the installer-sha256 workaround for the older pin goes. --- .github/workflows/audit.yml | 2 +- .github/workflows/ci.yml | 25 +++++++------------ .github/workflows/coverage-main.yml | 8 +++--- .github/workflows/dependabot-automerge.yml | 2 +- .github/workflows/mutation-testing.yml | 2 +- .../codescene_uploader_test.py | 2 +- .../workflow_contracts/compiler_cache_test.py | 2 +- 7 files changed, 18 insertions(+), 25 deletions(-) diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml index 4c0c7954f..6e772fda6 100644 --- a/.github/workflows/audit.yml +++ b/.github/workflows/audit.yml @@ -39,7 +39,7 @@ jobs: # cache-provider stays "github": this job mounts no cache of its own, so # the shared action is the single owner of the Cargo paths it uses. - name: Install Rust toolchain - uses: leynos/shared-actions/.github/actions/setup-rust@6cec89bac47a21cf756d68d638a9a510998e57f8 + uses: leynos/shared-actions/.github/actions/setup-rust@5a99aed78ce68dcebd3052b75c31e6f173162b1e - name: Install cargo-audit env: GITHUB_TOKEN: ${{ github.token }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a253779d3..49524a9fb 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -39,14 +39,9 @@ env: # Earlier releases pin 6.0.1, whose dylint_driver build script clones # rust-lang/rust-clippy at "master"; that repository now has only "main", so # the driver build fails with `revspec 'master' not found` before any lint - # runs. The failure is independent of the code under review. + # runs. The pinned install-whitaker action carries 0.2.11's digests, so no + # digest is supplied here. WHITAKER_INSTALLER_VERSION: '0.2.11' - # The pinned install-whitaker commit predates 0.2.11, so its digest manifest - # has no entry for it. Both runner labels this job can select are x86_64 - # Linux, so one digest covers every arm. This is the published release - # digest, matching the `.sha256` sidecar published beside the archive: - # https://github.com/leynos/whitaker/releases/download/v0.2.11/whitaker-installer-x86_64-unknown-linux-gnu-v0.2.11.tgz.sha256 - WHITAKER_INSTALLER_SHA256: 'a32a665d01c4a2eb03a87c584d57329fc72a3aac421c8c2b15bbdb19e5410236' YAMLLINT_VERSION: '1.35.1' # Default GITHUB_TOKEN to no access; each job re-grants only what it needs. @@ -123,7 +118,6 @@ jobs: nixie=${{ env.NIXIE_VERSION }} uv=${{ env.UV_VERSION }} whitaker-installer=${{ env.WHITAKER_INSTALLER_VERSION }} - whitaker-installer-sha256=${{ env.WHITAKER_INSTALLER_SHA256 }} yamllint=${{ env.YAMLLINT_VERSION }} # The Makefile pins every `uv tool run` version, so its digest owns # the repository-local uv layers, and dylint.toml selects the @@ -266,7 +260,7 @@ jobs: # become a second owner of them. - name: Install Rust toolchain id: setup-rust - uses: leynos/shared-actions/.github/actions/setup-rust@6cec89bac47a21cf756d68d638a9a510998e57f8 + uses: leynos/shared-actions/.github/actions/setup-rust@5a99aed78ce68dcebd3052b75c31e6f173162b1e with: cache-provider: external # `setup-rust` owns sccache: it selects the backend by runner, starts the @@ -323,7 +317,7 @@ jobs: # distribution; replaces the former `cargo binstall merman-cli` and # bare `uv tool install nixie-cli` steps. - name: Install Nixie and Merman - uses: leynos/shared-actions/.github/actions/install-nixie@6cec89bac47a21cf756d68d638a9a510998e57f8 + uses: leynos/shared-actions/.github/actions/install-nixie@5a99aed78ce68dcebd3052b75c31e6f173162b1e with: nixie-version: ${{ env.NIXIE_VERSION }} merman-version: ${{ env.MERMAN_VERSION }} @@ -429,7 +423,7 @@ jobs: - name: Install mdtablefix # `make check-fmt` runs `mdtablefix --check --git`; 0.6.0 is the # first release with `--check` and `--git`. - uses: leynos/shared-actions/.github/actions/install-mdtablefix@6cec89bac47a21cf756d68d638a9a510998e57f8 + uses: leynos/shared-actions/.github/actions/install-mdtablefix@5a99aed78ce68dcebd3052b75c31e6f173162b1e with: version: "0.6.1" @@ -458,10 +452,9 @@ jobs: run: make lint-clippy - name: Install Whitaker - uses: leynos/shared-actions/.github/actions/install-whitaker@6cec89bac47a21cf756d68d638a9a510998e57f8 + uses: leynos/shared-actions/.github/actions/install-whitaker@5a99aed78ce68dcebd3052b75c31e6f173162b1e with: installer-version: ${{ env.WHITAKER_INSTALLER_VERSION }} - installer-sha256: ${{ env.WHITAKER_INSTALLER_SHA256 }} # This job's tool cache owns ~/.cargo/bin and ~/.local/share/whitaker. cache-provider: external - name: Whitaker lint @@ -726,7 +719,7 @@ jobs: # workflow one, so it is read here in the shell. RUNNER_SCOPE: ${{ runner.os }}-${{ runner.arch }}-${{ runner.environment }} CARGO_LOCK_HASH: ${{ hashFiles('rust-toolchain.toml', '**/Cargo.lock') }} - SHARED_ACTIONS_PIN: 6cec89bac47a21cf756d68d638a9a510998e57f8 + SHARED_ACTIONS_PIN: 5a99aed78ce68dcebd3052b75c31e6f173162b1e # The Makefile pins pg-embed-setup-unpriv, whose pg_worker binary # lands in the cargo bin directory this archive carries. MAKEFILE_HASH: ${{ hashFiles('Makefile') }} @@ -782,7 +775,7 @@ jobs: - name: Install Rust toolchain id: setup-rust - uses: leynos/shared-actions/.github/actions/setup-rust@6cec89bac47a21cf756d68d638a9a510998e57f8 + uses: leynos/shared-actions/.github/actions/setup-rust@5a99aed78ce68dcebd3052b75c31e6f173162b1e with: cache-provider: external # `setup-rust` owns sccache: it selects the backend by runner, starts the @@ -806,7 +799,7 @@ jobs: POSTGRESQL_RELEASES_URL: https://github.com/theseus-rs/postgresql-binaries run: bash scripts/warm-pg-embedded-cache.sh - name: Generate Rust coverage - uses: leynos/shared-actions/.github/actions/generate-coverage@6cec89bac47a21cf756d68d638a9a510998e57f8 + uses: leynos/shared-actions/.github/actions/generate-coverage@5a99aed78ce68dcebd3052b75c31e6f173162b1e env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} POSTGRESQL_VERSION: =${{ env.PG_VERSION }} diff --git a/.github/workflows/coverage-main.yml b/.github/workflows/coverage-main.yml index 5f15a961f..8abd5894d 100644 --- a/.github/workflows/coverage-main.yml +++ b/.github/workflows/coverage-main.yml @@ -63,7 +63,7 @@ jobs: # workflow one, so it is read here in the shell. RUNNER_SCOPE: ${{ runner.os }}-${{ runner.arch }}-${{ runner.environment }} CARGO_LOCK_HASH: ${{ hashFiles('rust-toolchain.toml', '**/Cargo.lock') }} - SHARED_ACTIONS_PIN: 6cec89bac47a21cf756d68d638a9a510998e57f8 + SHARED_ACTIONS_PIN: 5a99aed78ce68dcebd3052b75c31e6f173162b1e # The Makefile pins pg-embed-setup-unpriv, whose pg_worker binary # lands in the cargo bin directory this archive carries. MAKEFILE_HASH: ${{ hashFiles('Makefile') }} @@ -119,7 +119,7 @@ jobs: - name: Install Rust toolchain id: setup-rust - uses: leynos/shared-actions/.github/actions/setup-rust@6cec89bac47a21cf756d68d638a9a510998e57f8 + uses: leynos/shared-actions/.github/actions/setup-rust@5a99aed78ce68dcebd3052b75c31e6f173162b1e with: # This job owns ~/.cargo/registry, ~/.cargo/bin, and the uv layers. cache-provider: external @@ -144,7 +144,7 @@ jobs: POSTGRESQL_RELEASES_URL: https://github.com/theseus-rs/postgresql-binaries run: bash scripts/warm-pg-embedded-cache.sh - name: Generate Rust coverage - uses: leynos/shared-actions/.github/actions/generate-coverage@6cec89bac47a21cf756d68d638a9a510998e57f8 + uses: leynos/shared-actions/.github/actions/generate-coverage@5a99aed78ce68dcebd3052b75c31e6f173162b1e env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} POSTGRESQL_VERSION: =${{ env.PG_VERSION }} @@ -188,7 +188,7 @@ jobs: # be uploaded as the trunk's and become the baseline every pull # request is ratcheted against. if: steps.codescene_token.outputs.available == 'true' && github.ref == 'refs/heads/main' - uses: leynos/shared-actions/.github/actions/upload-codescene-coverage@6cec89bac47a21cf756d68d638a9a510998e57f8 + uses: leynos/shared-actions/.github/actions/upload-codescene-coverage@5a99aed78ce68dcebd3052b75c31e6f173162b1e with: # mode defaults to "upload", which is the only mode this estate # uses: under CV-005 no pull-request lane talks to CodeScene, so diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index c443c136a..ea4784fb8 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -28,6 +28,6 @@ jobs: # The token is not used for any external cloud auth. id-token: write if: ${{ github.event_name == 'workflow_dispatch' || github.actor == 'dependabot[bot]' }} - uses: leynos/shared-actions/.github/workflows/dependabot-automerge.yml@6cec89bac47a21cf756d68d638a9a510998e57f8 + uses: leynos/shared-actions/.github/workflows/dependabot-automerge.yml@5a99aed78ce68dcebd3052b75c31e6f173162b1e with: pull-request-number: ${{ inputs.pull-request-number || github.event.pull_request.number }} diff --git a/.github/workflows/mutation-testing.yml b/.github/workflows/mutation-testing.yml index b58a0f225..82eb4fbe1 100644 --- a/.github/workflows/mutation-testing.yml +++ b/.github/workflows/mutation-testing.yml @@ -18,7 +18,7 @@ jobs: permissions: contents: read id-token: write # OIDC workflow-source resolution - uses: leynos/shared-actions/.github/workflows/mutation-cargo.yml@6cec89bac47a21cf756d68d638a9a510998e57f8 + uses: leynos/shared-actions/.github/workflows/mutation-cargo.yml@5a99aed78ce68dcebd3052b75c31e6f173162b1e with: # `allow-no-mutants` is left at the action's default of false, so a # run that reaches cargo-mutants and enumerates nothing fails rather diff --git a/tests/workflow_contracts/codescene_uploader_test.py b/tests/workflow_contracts/codescene_uploader_test.py index 8bb778800..21d49afb9 100644 --- a/tests/workflow_contracts/codescene_uploader_test.py +++ b/tests/workflow_contracts/codescene_uploader_test.py @@ -33,7 +33,7 @@ #: The uploader revision this repository trusts. Named as an allowlist rather #: than matched as "any full SHA": the pin is the manifest, so a different #: revision is a different trust anchor whatever the shape of its identifier. -UPLOADER_PIN: typ.Final = "6cec89bac47a21cf756d68d638a9a510998e57f8" +UPLOADER_PIN: typ.Final = "5a99aed78ce68dcebd3052b75c31e6f173162b1e" UPLOADER_ACTION: typ.Final = ( "leynos/shared-actions/.github/actions/upload-codescene-coverage" ) diff --git a/tests/workflow_contracts/compiler_cache_test.py b/tests/workflow_contracts/compiler_cache_test.py index 404ddcade..6c6e647b6 100644 --- a/tests/workflow_contracts/compiler_cache_test.py +++ b/tests/workflow_contracts/compiler_cache_test.py @@ -18,7 +18,7 @@ #: The shared-actions commit `setup-rust` must pin: #546, which sits on #523. #: Asserted by value, so a bump has to update it and someone has to confirm the #: new revision still leaves this repository the sole owner of its caches. -SETUP_RUST_PIN = "6cec89bac47a21cf756d68d638a9a510998e57f8" +SETUP_RUST_PIN = "5a99aed78ce68dcebd3052b75c31e6f173162b1e" #: The one `uses` value every Rust job must carry: the exact repository, action #: path and pin. A suffix match would accept another repository's, or another