From e2f78208026f79bb127f2b4d413be7c575c90baf Mon Sep 17 00:00:00 2001 From: Saul Beck Date: Fri, 28 Aug 2026 14:31:57 +0100 Subject: [PATCH 1/7] CI: Fix zizmor warnings and bump deps --- .github/workflows/build.yaml | 14 ++++++-------- .github/workflows/pr_pre-commit.yaml | 9 +++++---- .github/workflows/security_audit.yaml | 11 ++++++----- 3 files changed, 17 insertions(+), 17 deletions(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index cd0c0b7..c960f49 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -1,8 +1,6 @@ --- name: Build and Test - -permissions: - contents: read +permissions: {} on: push: @@ -20,7 +18,7 @@ jobs: name: Unit Tests runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false token: ${{ secrets.GITHUB_TOKEN }} @@ -32,7 +30,7 @@ jobs: components: clippy - name: Setup Rust Cache - uses: Swatinem/rust-cache@23869a5bd66c73db3c0ac40331f3206eb23791dc # v2.9.1 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 - name: Build run: cargo build --release @@ -49,12 +47,12 @@ jobs: needs: [unit-tests] steps: - name: Install host dependencies - uses: awalsh128/cache-apt-pkgs-action@acb598e5ddbc6f68a970c5da0688d2f3a9f04d05 # v1.6.0 + uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3 with: packages: musl-tools version: ubuntu-latest - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false token: ${{ secrets.GITHUB_TOKEN }} @@ -66,7 +64,7 @@ jobs: targets: x86_64-unknown-linux-musl - name: Setup Rust Cache - uses: Swatinem/rust-cache@23869a5bd66c73db3c0ac40331f3206eb23791dc # v2.9.1 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: key: musl diff --git a/.github/workflows/pr_pre-commit.yaml b/.github/workflows/pr_pre-commit.yaml index 69dc18c..b8d42b2 100644 --- a/.github/workflows/pr_pre-commit.yaml +++ b/.github/workflows/pr_pre-commit.yaml @@ -1,5 +1,6 @@ --- name: pre-commit +permissions: {} on: pull_request: @@ -13,7 +14,7 @@ jobs: pre-commit: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false token: ${{ secrets.GITHUB_TOKEN }} @@ -25,14 +26,14 @@ jobs: components: rustfmt, clippy - name: Setup Rust Cache - uses: Swatinem/rust-cache@23869a5bd66c73db3c0ac40331f3206eb23791dc # v2.9.1 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 - name: Install cargo-deny - uses: taiki-e/install-action@7769b73c2ec98c38dfcf2e18c83cfd4880c038c1 # v2.75.27 + uses: taiki-e/install-action@37f7c5781271959fb65b6b35224e28652ff2b63d # v2.87.0 with: tool: cargo-deny - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.12" diff --git a/.github/workflows/security_audit.yaml b/.github/workflows/security_audit.yaml index cb68e5b..1eb8721 100644 --- a/.github/workflows/security_audit.yaml +++ b/.github/workflows/security_audit.yaml @@ -1,5 +1,6 @@ --- name: Daily Security Audit +permissions: {} on: schedule: @@ -7,15 +8,15 @@ on: - cron: '15 4 * * *' workflow_dispatch: -permissions: - contents: read - issues: write - jobs: audit: runs-on: ubuntu-latest + permissions: + contents: read + checks: write # Needed for rustsec/audit-check to publish a check run + issues: write # Needed for rustsec/audit-check to file an issue per advisory steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false token: ${{ secrets.GITHUB_TOKEN }} From ec881447a60396a03d900f72d2df1e5d0a7ef59f Mon Sep 17 00:00:00 2001 From: Saul Beck Date: Tue, 1 Sep 2026 08:19:53 +0100 Subject: [PATCH 2/7] Fix linting and upgrading chacha20 due to yanked crate --- .github/workflows/security_audit.yaml | 2 +- Cargo.lock | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/security_audit.yaml b/.github/workflows/security_audit.yaml index 1eb8721..d3667fb 100644 --- a/.github/workflows/security_audit.yaml +++ b/.github/workflows/security_audit.yaml @@ -13,7 +13,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read - checks: write # Needed for rustsec/audit-check to publish a check run + checks: write # Needed for rustsec/audit-check to publish a check run issues: write # Needed for rustsec/audit-check to file an issue per advisory steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 diff --git a/Cargo.lock b/Cargo.lock index 03b1bf8..749d9c6 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -387,9 +387,9 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724" [[package]] name = "chacha20" -version = "0.10.0" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601" +checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06" dependencies = [ "cfg-if", "cpufeatures", From 3a71407c28a08d7f0f54f0a52f53f83a11be192b Mon Sep 17 00:00:00 2001 From: Techassi Date: Tue, 1 Sep 2026 11:54:25 +0200 Subject: [PATCH 3/7] ci: Remove redundant token input --- .github/workflows/build.yaml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index c960f49..0570317 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -21,7 +21,6 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - token: ${{ secrets.GITHUB_TOKEN }} - name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} toolchain uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 @@ -55,7 +54,6 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - token: ${{ secrets.GITHUB_TOKEN }} - name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} toolchain uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 From 5f93e8f82746f379ed844b00d6b554fc49c8d22c Mon Sep 17 00:00:00 2001 From: Techassi Date: Tue, 1 Sep 2026 12:00:23 +0200 Subject: [PATCH 4/7] ci: Switch to our own pre-commit action --- .github/workflows/pr_pre-commit.yaml | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) diff --git a/.github/workflows/pr_pre-commit.yaml b/.github/workflows/pr_pre-commit.yaml index b8d42b2..0760fd5 100644 --- a/.github/workflows/pr_pre-commit.yaml +++ b/.github/workflows/pr_pre-commit.yaml @@ -19,22 +19,12 @@ jobs: persist-credentials: false token: ${{ secrets.GITHUB_TOKEN }} - - name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} toolchain - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 - with: - toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }} - components: rustfmt, clippy - - - name: Setup Rust Cache - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 - - name: Install cargo-deny uses: taiki-e/install-action@37f7c5781271959fb65b6b35224e28652ff2b63d # v2.87.0 with: tool: cargo-deny - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: stackabletech/actions/run-pre-commit@e8aed001d347bcf693e41b61f4098b0cb94b4ab6 # v0.18.0 with: + rust: ${{ env.RUST_TOOLCHAIN_VERSION }} python-version: "3.12" - - - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1 From ee2cd1a593c05ead477eef890169b4dd8ebb7700 Mon Sep 17 00:00:00 2001 From: Techassi Date: Tue, 1 Sep 2026 12:01:10 +0200 Subject: [PATCH 5/7] ci: Switch to prek --- .github/workflows/{pr_pre-commit.yaml => pr_prek.yaml} | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) rename .github/workflows/{pr_pre-commit.yaml => pr_prek.yaml} (77%) diff --git a/.github/workflows/pr_pre-commit.yaml b/.github/workflows/pr_prek.yaml similarity index 77% rename from .github/workflows/pr_pre-commit.yaml rename to .github/workflows/pr_prek.yaml index 0760fd5..86f4396 100644 --- a/.github/workflows/pr_pre-commit.yaml +++ b/.github/workflows/pr_prek.yaml @@ -1,5 +1,5 @@ --- -name: pre-commit +name: prek permissions: {} on: @@ -11,7 +11,7 @@ env: RUST_TOOLCHAIN_VERSION: "1.97.1" jobs: - pre-commit: + prek: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -24,7 +24,6 @@ jobs: with: tool: cargo-deny - - uses: stackabletech/actions/run-pre-commit@e8aed001d347bcf693e41b61f4098b0cb94b4ab6 # v0.18.0 + - uses: stackabletech/actions/run-prek@e8aed001d347bcf693e41b61f4098b0cb94b4ab6 # v0.18.0 with: rust: ${{ env.RUST_TOOLCHAIN_VERSION }} - python-version: "3.12" From 6fe7c85322e07bc8ceaf371b312d873e5bd0298c Mon Sep 17 00:00:00 2001 From: Techassi Date: Tue, 1 Sep 2026 12:07:10 +0200 Subject: [PATCH 6/7] ci: Fetch with depth 0 --- .github/workflows/pr_prek.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr_prek.yaml b/.github/workflows/pr_prek.yaml index 86f4396..4df64a1 100644 --- a/.github/workflows/pr_prek.yaml +++ b/.github/workflows/pr_prek.yaml @@ -17,7 +17,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - token: ${{ secrets.GITHUB_TOKEN }} + fetch-depth: 0 - name: Install cargo-deny uses: taiki-e/install-action@37f7c5781271959fb65b6b35224e28652ff2b63d # v2.87.0 From cc20ba45ed3f4cbd4c28554776bde95b9aefef1e Mon Sep 17 00:00:00 2001 From: Techassi Date: Tue, 1 Sep 2026 12:23:07 +0200 Subject: [PATCH 7/7] chore: Apply suggestion Co-authored-by: Lukas Krug --- .github/workflows/security_audit.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/security_audit.yaml b/.github/workflows/security_audit.yaml index d3667fb..95a4696 100644 --- a/.github/workflows/security_audit.yaml +++ b/.github/workflows/security_audit.yaml @@ -19,7 +19,6 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - token: ${{ secrets.GITHUB_TOKEN }} - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0 # Build against stable because cargo-audit sometimes depends on things