From d3d193f32937340d3491ca3b7d44019d0b830dcd Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 19 Aug 2026 07:11:52 +0000 Subject: [PATCH 1/2] chore(deps): bump the actions group with 6 updates Bumps the actions group with 6 updates: | Package | From | To | | --- | --- | --- | | [Swatinem/rust-cache](https://github.com/swatinem/rust-cache) | `258712b0b7b1ddf8bddc9fc3b0faca682b2736c3` | `f0d9c3887740aee45f6153b24b3a6b815192ec16` | | [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.85.11` | `2.86.1` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `8.0.1` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `9.0.0` | `10.0.1` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.6` | `4.37.7` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.6` | `4.37.7` | Updates `Swatinem/rust-cache` from 258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 to f0d9c3887740aee45f6153b24b3a6b815192ec16 - [Release notes](https://github.com/swatinem/rust-cache/releases) - [Changelog](https://github.com/Swatinem/rust-cache/blob/master/CHANGELOG.md) - [Commits](https://github.com/swatinem/rust-cache/compare/258712b0b7b1ddf8bddc9fc3b0faca682b2736c3...f0d9c3887740aee45f6153b24b3a6b815192ec16) Updates `taiki-e/install-action` from 2.85.11 to 2.86.1 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/taiki-e/install-action/compare/7f4eb899022d8fe70b20c4f3de697aa85c309026...288e746965032cfcc232e09af2daf5f23c14d780) Updates `actions/download-artifact` from 4.3.0 to 8.0.1 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/v4.3.0...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c) Updates `astral-sh/setup-uv` from 9.0.0 to 10.0.1 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/c771a70e6277c0a99b617c7a806ffedaca235ff9...20cfd1bf945f4377ade1205e4dbc17946fc9a30d) Updates `github/codeql-action/init` from 4.37.6 to 4.37.7 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd) Updates `github/codeql-action/analyze` from 4.37.6 to 4.37.7 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd) --- updated-dependencies: - dependency-name: Swatinem/rust-cache dependency-version: f0d9c3887740aee45f6153b24b3a6b815192ec16 dependency-type: direct:production dependency-group: actions - dependency-name: taiki-e/install-action dependency-version: 2.86.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/download-artifact dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: astral-sh/setup-uv dependency-version: 10.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: github/codeql-action/init dependency-version: 4.37.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 34 ++++++++++----------- .github/workflows/codeql.yml | 4 +-- .github/workflows/nightly-rust-coverage.yml | 4 +-- .github/workflows/nightly-security.yml | 8 ++--- 4 files changed, 25 insertions(+), 25 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c9ecff8f4..9de83208e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -185,7 +185,7 @@ jobs: submodules: false - name: Cache Cargo registry and build artifacts - uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2 + uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2 with: key: platform-all-features save-if: ${{ github.ref == 'refs/heads/main' }} @@ -207,13 +207,13 @@ jobs: submodules: false - name: Cache Cargo registry and build artifacts - uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2 + uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2 with: key: platform-coverage save-if: ${{ github.ref == 'refs/heads/main' }} - name: Install pinned coverage tool - uses: taiki-e/install-action@7f4eb899022d8fe70b20c4f3de697aa85c309026 # v2.85.11 + uses: taiki-e/install-action@288e746965032cfcc232e09af2daf5f23c14d780 # v2.86.1 with: tool: cargo-llvm-cov@${{ env.CARGO_LLVM_COV_VERSION }} @@ -256,7 +256,7 @@ jobs: id-token: write steps: - name: Download platform coverage - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v8.0.0 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.0 with: name: platform-coverage path: target/platform-coverage @@ -314,13 +314,13 @@ jobs: toolchain: nightly - name: Cache Cargo registry and build artifacts - uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2 + uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2 with: key: platform-fuzz-${{ matrix.target }} save-if: ${{ github.ref == 'refs/heads/main' }} - name: Install pinned cargo-fuzz - uses: taiki-e/install-action@7f4eb899022d8fe70b20c4f3de697aa85c309026 # v2.85.11 + uses: taiki-e/install-action@288e746965032cfcc232e09af2daf5f23c14d780 # v2.86.1 with: tool: cargo-fuzz@${{ env.CARGO_FUZZ_VERSION }} @@ -356,14 +356,14 @@ jobs: submodules: false - name: Cache Cargo registry - uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2 + uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2 with: shared-key: workspace-registry cache-targets: false save-if: ${{ github.ref == 'refs/heads/main' }} - name: Install cargo-deny - uses: taiki-e/install-action@7f4eb899022d8fe70b20c4f3de697aa85c309026 # v2.85.11 + uses: taiki-e/install-action@288e746965032cfcc232e09af2daf5f23c14d780 # v2.86.1 with: tool: cargo-deny@0.19.8 @@ -394,7 +394,7 @@ jobs: submodules: false - name: Cache Cargo registry - uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2 + uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2 with: shared-key: workspace-registry cache-targets: false @@ -432,7 +432,7 @@ jobs: submodules: false - name: Cache Cargo registry - uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2 + uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2 with: shared-key: workspace-registry cache-targets: false @@ -466,7 +466,7 @@ jobs: submodules: false - name: Cache Cargo registry - uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2 + uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2 with: shared-key: workspace-registry cache-targets: false @@ -510,14 +510,14 @@ jobs: submodules: false - name: Cache Cargo registry - uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2 + uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2 with: shared-key: workspace-registry cache-targets: false save-if: ${{ github.ref == 'refs/heads/main' }} - name: Install uv - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 + uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: version: "0.11.16" @@ -544,7 +544,7 @@ jobs: submodules: false - name: Cache Cargo registry - uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2 + uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2 with: shared-key: workspace-registry cache-targets: false @@ -573,7 +573,7 @@ jobs: submodules: false - name: Cache Cargo registry - uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2 + uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2 with: shared-key: workspace-registry cache-targets: false @@ -599,7 +599,7 @@ jobs: submodules: false - name: Cache Cargo registry - uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2 + uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2 with: shared-key: workspace-registry cache-targets: false @@ -824,7 +824,7 @@ jobs: cache-dependency-path: docs/site/package-lock.json - name: Cache Cargo registry - uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2 + uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2 with: shared-key: workspace-registry cache-targets: false diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f769f9b1a..403d8ca26 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -38,13 +38,13 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 + uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} queries: security-and-quality - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 + uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/nightly-rust-coverage.yml b/.github/workflows/nightly-rust-coverage.yml index 1db37c54e..9a3e8bedb 100644 --- a/.github/workflows/nightly-rust-coverage.yml +++ b/.github/workflows/nightly-rust-coverage.yml @@ -99,14 +99,14 @@ jobs: submodules: false - name: Cache Cargo registry - uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2 + uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2 with: shared-key: workspace-registry cache-targets: false save-if: false - name: Install pinned coverage tool - uses: taiki-e/install-action@7f4eb899022d8fe70b20c4f3de697aa85c309026 # v2.85.11 + uses: taiki-e/install-action@288e746965032cfcc232e09af2daf5f23c14d780 # v2.86.1 with: tool: cargo-llvm-cov@${{ env.CARGO_LLVM_COV_VERSION }} diff --git a/.github/workflows/nightly-security.yml b/.github/workflows/nightly-security.yml index cb98b24ad..35ac91c9b 100644 --- a/.github/workflows/nightly-security.yml +++ b/.github/workflows/nightly-security.yml @@ -77,10 +77,10 @@ jobs: toolchain: nightly - name: Cache Cargo registry and build artifacts - uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2 + uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2 - name: Install cargo-fuzz - uses: taiki-e/install-action@7f4eb899022d8fe70b20c4f3de697aa85c309026 # v2.85.11 + uses: taiki-e/install-action@288e746965032cfcc232e09af2daf5f23c14d780 # v2.86.1 with: tool: cargo-fuzz@${{ env.CARGO_FUZZ_VERSION }} @@ -127,10 +127,10 @@ jobs: toolchain: nightly - name: Cache Cargo registry and build artifacts - uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2 + uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2 - name: Install cargo-fuzz - uses: taiki-e/install-action@7f4eb899022d8fe70b20c4f3de697aa85c309026 # v2.85.11 + uses: taiki-e/install-action@288e746965032cfcc232e09af2daf5f23c14d780 # v2.86.1 with: tool: cargo-fuzz@${{ env.CARGO_FUZZ_VERSION }} From a998b1e27938cad73f06c0258a70c41687cabb71 Mon Sep 17 00:00:00 2001 From: Jeremi Joslin Date: Thu, 20 Aug 2026 09:55:58 +0200 Subject: [PATCH 2/2] chore(ci): repin the coverage download-artifact gate The platform coverage OIDC isolation gate pins the exact actions/download-artifact commit allowed in the only job holding id-token: write, so bumping that action requires moving the gate in the same change or root CI stays red. The new pin is actions/download-artifact v8.0.1. The previous pin was v4.3.0 while its trailing comment read v8.0.0, so the comment now names the release the commit actually carries. Signed-off-by: Jeremi Joslin --- .github/workflows/ci.yml | 2 +- release/scripts/check-gates-inventory.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9de83208e..e79b0f41e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -256,7 +256,7 @@ jobs: id-token: write steps: - name: Download platform coverage - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.0 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: platform-coverage path: target/platform-coverage diff --git a/release/scripts/check-gates-inventory.py b/release/scripts/check-gates-inventory.py index 578f7c00b..8b0371db7 100644 --- a/release/scripts/check-gates-inventory.py +++ b/release/scripts/check-gates-inventory.py @@ -1063,7 +1063,7 @@ def platform_coverage_oidc_isolation_violations(workflow: str | None) -> list[st or not upload_steps_text.startswith(" - ") or upload_steps_text.count(" uses:") != 2 or len(upload_steps) != 2 - or "uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093" + or "uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c" not in upload_steps[0] or "uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f" not in upload_steps[1]