release: v2026.9.0 — audit workflow repair and RUSTSEC cleanup - #9
Merged
Merged
Conversation
Version bump and changelog date for the work already on main: the Security Audit toolchain fix and the five advisories it surfaced once it could run. Also fixes the second half of the workflow misconfiguration. The audit job is a required status check on main, but it only triggered on push and schedule, so it never reported on a pull request — and a required check that never reports blocks the PR forever. Both PRs in this series had to be merged with --admin. It now runs on every pull request with no path filter; the push trigger keeps its filter. The matching branch protection context is updated separately, from "Security Audit" (the workflow name, which nothing publishes) to "Dependency Audit" (the job name, which is what actually reports). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DRDwc4sxA6s6BBTLVEWYUd
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cuts v2026.9.0, covering the audit workflow repair and the five advisories it surfaced, and fixes the branch protection misconfiguration that forced both prior PRs to merge with
--admin.Release
Cargo.toml/Cargo.lock: 2026.5.5 → 2026.9.0CHANGELOG.md:Unreleased→[2026.9.0] — 2026-09-06Misconfiguration fix
Main requires a status check named
Security Audit. Nothing publishes that name — the workflow's job reports asDependency Audit. Worse, the workflow only triggered onpushandschedule, so it never reported on a PR at all, and a required check that never reports blocks the PR permanently.Two halves, and both matter:
audit.ymlgains apull_requesttrigger with no path filter. A path filter here would reintroduce the same bug — a PR touching neitherCargo.tomlnorCargo.lockwould skip the job, the check would never report, and the PR would block. Thepushtrigger keeps its filter, since scheduled and push runs do not gate anything.Security Audit→Dependency Audit.This PR is the test. If
Dependency Auditappears in its checks and it merges without--admin, the fix holds.Verification
./scripts/preflight.shpasses in full on the pinned 1.94 toolchain — clean tree, channel check, changelog/version match, fmt, clippy-D warnings, 145 tests, release build../target/release/lin --versionreportslin 2026.9.0.Tagging
v2026.9.0after merge triggers the release workflow: four-target build, GitHub Release, crates.io publish, Homebrew tap update.🤖 Generated with Claude Code
https://claude.ai/code/session_01DRDwc4sxA6s6BBTLVEWYUd