chore(deps): cascade running-process 4.8.1 and zccache 1.13.1 (#1239)

[zackees]

Closes #1239

Full dependency cascade per the issue's freeze-latest-main protocol, executed 2026-08-02.

Cascade record

Step	Repo	Frozen main	Released as	Release commit
1	zackees/running-process	ec665c69	4.8.1	359b4e3d (bump commit on frozen main)
2	zackees/zccache	ab5d2952 (+ parallel #1335 4.8.0 repin 0bf3ddcc, rebased over)	1.13.1	8cf6dd0e
3	fbuild (this PR)	—	—	pins below

• Workspace running-process pin → 4.8.1 @ 359b4e3d92660e54eb9b16b6e83de8ce26932ff8 — byte-identical to the pin inside zccache 1.13.1, so both dependency paths resolve one revision.
• All five zccache crate pins → 1.13.1 release commit 8cf6dd0ef5d6f2ff2980039290b9e498fb5a6b0e.
• client-async feature selection preserved.

Acceptance criteria mapping

• Selected running-process SHA was latest upstream main at cascade start (ec665c69; 4.8.1 = that + version bump) ✅
• That SHA has a published release (4.8.1, auto-release green) ✅
• zccache base was latest upstream main at its release start (rebased to include the coordinated #1335 repin rather than discard it) ✅
• zccache 1.13.1 released containing the new running-process pin ✅
• fbuild repinned to the exact release commits; Cargo.lock resolves exactly one running-process identity (verified: one [[package]] entry, 4.8.1 @ 359b4e3d) ✅
• Regression guard: new crates/fbuild-core/tests/dep_identity.rs parses the workspace Cargo.lock and fails when more than one running-process identity/source/revision resolves, or when the workspace pin drifts from the locked (transitively selected) revision ✅

Validation

• soldr cargo check --workspace --all-targets — clean at both the pre-release pin and the final release-commit pin.
• soldr cargo test -p fbuild-core --test dep_identity — passes (and fails correctly when pins drift, by construction of the assertion).
• zccache 1.13.1 shipped only after its own Linux/Windows/macOS CI was green; running-process 4.8.1 auto-release green (its macOS preflight flaked on the bump push — version-string-only change, release unaffected).

🤖 Generated with Claude Code

Summary by CodeRabbit

• Maintenance

  • Updated core process and build-cache components to newer revisions, with no feature changes.
  • Improved build reliability and consistency across supported build targets.

• Tests

  • Added regression coverage to detect conflicting component versions and ensure consistent dependency resolution.

• Documentation

  • Documented the new integration test and the conditions it verifies.

[coderabbitai]

Warning

Review limit reached

@zackees, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 58 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: d25664b1-7b19-41a5-a019-62fd3ff2aea2

📥 Commits

Reviewing files that changed from the base of the PR and between cb2af54 and 159a3b6.

📒 Files selected for processing (1)

• crates/fbuild-core/tests/dep_identity.rs

📝 Walkthrough

Walkthrough

The workspace updates the pinned running-process and zccache revisions. A new integration test checks for one locked running-process identity and verifies its revision against the workspace manifest. Test documentation describes the regression guard.

Changes

Dependency alignment and identity guard

Layer / File(s)	Summary
Update dependency pins Cargo.toml, crates/fbuild-build-*/Cargo.toml	The workspace updates running-process to version 4.8.1 and a new Git revision. The build crates update their pinned zccache revision.
Add dependency identity regression guard crates/fbuild-core/tests/dep_identity.rs, crates/fbuild-core/tests/README.md	The integration test parses Cargo.lock and Cargo.toml, asserts one running-process package identity, and checks the pinned revision. The README documents the test.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• FastLED/fbuild#1168: Updates running-process/zccache pins and adds related cache identity integration.
• FastLED/fbuild#1215: Repins zccache and aligns the workspace running-process revision.
• FastLED/fbuild#1171: Updates the workspace running-process dependency and adds dependency-identity coverage.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	❓ Inconclusive	The dependency pins, feature preservation, and regression guard match the issue, but ignored Cargo.lock and missing validation evidence prevent full verification.	Provide reviewable evidence for Cargo.lock consistency and the issue's required build, test, linkage, and cross-platform validation results.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the dependency cascade implemented by the pull request.
Out of Scope Changes check	✅ Passed	All reviewed changes support the linked issue by updating dependency pins, documenting the guard, or adding dependency identity validation.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/1239-dep-cascade

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}