From 4f5f470a69f7425159c0c432aa033f64ad52d7ce Mon Sep 17 00:00:00 2001 From: Floris Bruynooghe Date: Fri, 23 Oct 2026 14:45:53 +0200 Subject: [PATCH 1/7] Use blacksmith runners for minimal-crates workflow --- .github/workflows/minimal-crates.yaml | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) diff --git a/.github/workflows/minimal-crates.yaml b/.github/workflows/minimal-crates.yaml index 4ff54ba..0a1ba28 100644 --- a/.github/workflows/minimal-crates.yaml +++ b/.github/workflows/minimal-crates.yaml @@ -7,14 +7,6 @@ name: Min Crates on: workflow_call: - inputs: - windows-runner: - description: | - The runner to use for windows, windows-latest by default. - The string is parsed as JSON. - Do not use self-hosted as this does not use min-publish-age. - type: "string" - default: '"windows-latest"' workflow_dispatch: concurrency: @@ -46,12 +38,12 @@ jobs: os: ubuntu-latest release-os: linux release-arch: amd64 - runner: ubuntu-latest + runner: "blacksmith-8vcpu-ubuntu-2404" - name: macOS-arm-latest os: macOS-latest release-os: darwin release-arch: aarch64 - runner: macos-latest + runner: "blacksmith-6vcpu-macos-26" steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: @@ -69,7 +61,7 @@ jobs: minimal-crates-windows: timeout-minutes: 30 name: "Minimal Crates (Windows)" - runs-on: ${{ fromJSON(inputs.windows-runner) }} + runs-on: ${{ matrix.runner }} permissions: contents: read strategy: @@ -81,6 +73,7 @@ jobs: include: - name: windows-latest os: windows + runner: blacksmith-8vcpu-windows-2025 env: # sccache backend is selected at runtime in "Configure sccache backend": # local disk on self-hosted, GHA-backed on Blacksmith (ephemeral). From 16988266425493db93cc044fed99d2a736caede0 Mon Sep 17 00:00:00 2001 From: Floris Bruynooghe Date: Fri, 23 Oct 2026 15:34:51 +0200 Subject: [PATCH 2/7] And support fips builds --- .github/workflows/minimal-crates.yaml | 44 ++++++++++++++++++--------- 1 file changed, 29 insertions(+), 15 deletions(-) diff --git a/.github/workflows/minimal-crates.yaml b/.github/workflows/minimal-crates.yaml index 0a1ba28..3fb5d93 100644 --- a/.github/workflows/minimal-crates.yaml +++ b/.github/workflows/minimal-crates.yaml @@ -7,6 +7,18 @@ name: Min Crates on: workflow_call: + inputs: + crate-selection: + descripion: | + Cargo arguments to select the crates to test. + type: "string" + default: "--workspace --all-features --lib --bins" + fips: + description: | + Whether to install build dependencies for building the FIPS + crypto backend of rustls. + type: "bool" + default: false workflow_dispatch: concurrency: @@ -49,14 +61,21 @@ jobs: with: persist-credentials: false - uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 + continue-on-error: true + - uses: $/.github/workflows/sccache-probe - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1 with: toolchain: nightly + - name: Install Go (required for aws-lc-rs FIPS) + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 + if: ${{ inputs.fips }} + with: + go-version: "stable" + cache: false - name: cargo check run: | rm -f Cargo.lock - cargo +nightly check -Z minimal-versions \ - --workspace --all-features --lib --bins + cargo +nightly check -Z minimal-versions ${{ inputs.crate-selection }} minimal-crates-windows: timeout-minutes: 30 @@ -75,9 +94,6 @@ jobs: os: windows runner: blacksmith-8vcpu-windows-2025 env: - # sccache backend is selected at runtime in "Configure sccache backend": - # local disk on self-hosted, GHA-backed on Blacksmith (ephemeral). - RUSTC_WRAPPER: "sccache" # We avoid `rustup default` as that would rewrite the default o # the shared self-hosted runner. This only affects steps which # do not explicitly pass `+nightly`. @@ -105,18 +121,17 @@ jobs: - name: Install sccache uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 continue-on-error: true - with: - # Pinned: sccache >= 0.17.0 expands rustc @argfiles and breaks Windows' - # 32K command line limit: https://github.com/mozilla/sccache/issues/2397 - version: "v0.16.0" - uses: $/.github/workflows/sccache-probe - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0 with: - # Blacksmith's Windows image ships no pre-installed MSYS2 (C:\msys64), - # so install it there. Self-hosted keeps the pre-installed one (faster). - release: ${{ startsWith(runner.name, 'blacksmith-') }} - + # Blacksmith's Windows image ships no pre-installed MSYS2 (C:\msys64). + release: true + # - name: Install Go (required for aws-lc-rs FIPS) + # uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 + # with: + # go-version: "stable" + # cache: false - name: Install aws-lc-sys build dependencies shell: powershell run: | @@ -134,5 +149,4 @@ jobs: # the versions the lockfile has never seen. run: | rm -Force Cargo.lock - cargo +nightly check -Z minimal-versions ` - --workspace --all-features --lib --bins + cargo +nightly check -Z minimal-versions ${{ inputs.crate-selection }} From 0d22c331895bd5a2f285e475ac6f1fa5fc1f8208 Mon Sep 17 00:00:00 2001 From: Floris Bruynooghe Date: Fri, 23 Oct 2026 15:40:42 +0200 Subject: [PATCH 3/7] typo --- .github/workflows/minimal-crates.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/minimal-crates.yaml b/.github/workflows/minimal-crates.yaml index 3fb5d93..bec0ca6 100644 --- a/.github/workflows/minimal-crates.yaml +++ b/.github/workflows/minimal-crates.yaml @@ -9,7 +9,7 @@ on: workflow_call: inputs: crate-selection: - descripion: | + description: | Cargo arguments to select the crates to test. type: "string" default: "--workspace --all-features --lib --bins" From bfd35f9bdb47d3d6c27eae99f65ddcffdce8f708 Mon Sep 17 00:00:00 2001 From: Floris Bruynooghe Date: Fri, 23 Oct 2026 15:48:28 +0200 Subject: [PATCH 4/7] yay --- .github/workflows/minimal-crates.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/minimal-crates.yaml b/.github/workflows/minimal-crates.yaml index bec0ca6..2b97584 100644 --- a/.github/workflows/minimal-crates.yaml +++ b/.github/workflows/minimal-crates.yaml @@ -17,7 +17,7 @@ on: description: | Whether to install build dependencies for building the FIPS crypto backend of rustls. - type: "bool" + type: "boolean" default: false workflow_dispatch: From bce31984dc4ff0e3ed89119617d42a042193aeb5 Mon Sep 17 00:00:00 2001 From: Floris Bruynooghe Date: Fri, 23 Oct 2026 15:59:14 +0200 Subject: [PATCH 5/7] try avoid the injection according to zizmor --- .github/workflows/minimal-crates.yaml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/workflows/minimal-crates.yaml b/.github/workflows/minimal-crates.yaml index 2b97584..20632f1 100644 --- a/.github/workflows/minimal-crates.yaml +++ b/.github/workflows/minimal-crates.yaml @@ -73,9 +73,11 @@ jobs: go-version: "stable" cache: false - name: cargo check + env: + CRATE_SELECTION: ${{ inputs.crate-selection }} run: | rm -f Cargo.lock - cargo +nightly check -Z minimal-versions ${{ inputs.crate-selection }} + cargo +nightly check -Z minimal-versions ${CRATE_SELECTION} minimal-crates-windows: timeout-minutes: 30 @@ -145,8 +147,8 @@ jobs: echo "C:\Program Files\NASM" | Out-File -FilePath $Env:GITHUB_PATH -Encoding utf8 -Append - name: cargo check - # No --locked: re-resolving is the point, so -Z min-publish-age guards - # the versions the lockfile has never seen. + env: + CRATE_SELECTION: ${{ inputs.crate-selection }} run: | rm -Force Cargo.lock - cargo +nightly check -Z minimal-versions ${{ inputs.crate-selection }} + cargo +nightly check -Z minimal-versions ${ CRATE_SELECTION } From b8ffbc4a7cec8bc0c7c181a57fb2c0450cf7a7f7 Mon Sep 17 00:00:00 2001 From: Floris Bruynooghe Date: Fri, 23 Oct 2026 16:03:36 +0200 Subject: [PATCH 6/7] try not to flood the logs with download progress --- .github/workflows/minimal-crates.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/minimal-crates.yaml b/.github/workflows/minimal-crates.yaml index 20632f1..e98e7c0 100644 --- a/.github/workflows/minimal-crates.yaml +++ b/.github/workflows/minimal-crates.yaml @@ -141,8 +141,8 @@ jobs: if (!(Test-Path $chocoPath)) { $chocoPath = "$Env:SystemDrive\ProgramData\chocolatey\bin\choco.exe" } - & $chocoPath install cmake --installargs 'ADD_CMAKE_TO_PATH=System' -y - & $chocoPath install nasm -y + & $chocoPath install --no-progress cmake --installargs 'ADD_CMAKE_TO_PATH=System' -y + & $chocoPath install --no-progress nasm -y echo "C:\Program Files\CMake\bin" | Out-File -FilePath $Env:GITHUB_PATH -Encoding utf8 -Append echo "C:\Program Files\NASM" | Out-File -FilePath $Env:GITHUB_PATH -Encoding utf8 -Append From 866bd162622de2dc0df7aa34da228950a830eb92 Mon Sep 17 00:00:00 2001 From: Floris Bruynooghe Date: Wed, 28 Oct 2026 12:10:31 +0100 Subject: [PATCH 7/7] remove dead code --- .github/workflows/minimal-crates.yaml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/.github/workflows/minimal-crates.yaml b/.github/workflows/minimal-crates.yaml index e98e7c0..ef071f3 100644 --- a/.github/workflows/minimal-crates.yaml +++ b/.github/workflows/minimal-crates.yaml @@ -129,11 +129,6 @@ jobs: with: # Blacksmith's Windows image ships no pre-installed MSYS2 (C:\msys64). release: true - # - name: Install Go (required for aws-lc-rs FIPS) - # uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 - # with: - # go-version: "stable" - # cache: false - name: Install aws-lc-sys build dependencies shell: powershell run: |