diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..e4a5a31 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,31 @@ +version: 2 +updates: + # Workflows pin every third-party action to a commit SHA, which is immutable + # but goes stale silently. Dependabot is the update owner that makes pinning + # sustainable: it reads the `# vX.Y.Z` annotation beside each SHA and opens a + # PR moving both when a newer release ships. + # + # `dtolnay/rust-toolchain` is the exception and is maintained by hand. It + # publishes no version series — the workflows pin `refs/heads/stable`, whose + # `action.yml` defaults `toolchain: stable` and lets rustup resolve the + # current release at run time. Its only tag, `v1`, makes `toolchain` a + # required input, so switching to it would break every call site that relies + # on that default. Dependabot cannot track a branch pin, so bumping that SHA + # is a manual step. + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + # One PR per week for all action bumps, not one per action. Each PR costs a + # full matrix run, and a queue of near-identical PRs is the fastest way to + # turn review into rubber-stamping. + groups: + actions: + patterns: + - "*" + # `default-days` is the only cooldown key GitHub Actions supports; the + # `semver-*-days` variants are ignored for this ecosystem. Seven days keeps + # freshly published releases out of the queue without delaying security + # updates, which cooldown never applies to. + cooldown: + default-days: 7 diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml index ed91672..0bdb204 100644 --- a/.github/workflows/labels.yml +++ b/.github/workflows/labels.yml @@ -14,8 +14,8 @@ jobs: sync: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: crazy-max/ghaction-github-labeler@v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: crazy-max/ghaction-github-labeler@548a7c3603594ec17c819e1239f281a3b801ab4d # v6.0.0 with: yaml-file: .github/labels.yml skip-delete: true diff --git a/.github/workflows/release-prepare.yml b/.github/workflows/release-prepare.yml index b3b0744..f27fcfa 100644 --- a/.github/workflows/release-prepare.yml +++ b/.github/workflows/release-prepare.yml @@ -72,14 +72,14 @@ jobs: label: windows-x64 ext: ".exe" steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust + target - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable with: targets: ${{ matrix.target }} - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: prefix-key: fsck-${{ matrix.target }} @@ -106,7 +106,7 @@ jobs: $name = "pagedb-fsck-${{ needs.validate-version.outputs.version }}-${{ matrix.label }}.zip" Compress-Archive -Path "pagedb-fsck${{ matrix.ext }}" -DestinationPath $name - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fsck-${{ matrix.label }} path: | diff --git a/.github/workflows/release-validate.yml b/.github/workflows/release-validate.yml index a32c14d..c65b9ec 100644 --- a/.github/workflows/release-validate.yml +++ b/.github/workflows/release-validate.yml @@ -30,12 +30,12 @@ jobs: version: ${{ steps.version.outputs.version }} is_full_release: ${{ steps.version.outputs.is_full_release }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.ref }} - name: Install Rust - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable - name: Validate tag against Cargo.toml id: version diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a788f5f..57e70a5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -68,12 +68,12 @@ jobs: runs-on: ubuntu-latest environment: crates.io steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.tag }} - name: Install Rust - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable # The verifying publish compiles the packaged lib + the pagedb-fsck bin # against crates.io deps. The io-uring VFS backend needs nothing extra, @@ -121,13 +121,13 @@ jobs: contents: write actions: read steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.tag }} fetch-depth: 0 - name: Download fsck artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: pattern: "fsck-*" run-id: ${{ inputs.prepare_run_id }} @@ -136,7 +136,7 @@ jobs: merge-multiple: true - name: Create GitHub Release - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 with: tag_name: ${{ inputs.tag }} name: pagedb ${{ needs.validate-version.outputs.version }} diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 10825f8..441543b 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -43,10 +43,10 @@ jobs: name: Lint, Format & Docs runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable with: components: rustfmt, clippy @@ -55,7 +55,7 @@ jobs: - name: Install LLVM/Clang run: sudo apt-get update && sudo apt-get install -y clang libclang-dev - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: prefix-key: lint @@ -111,17 +111,17 @@ jobs: matrix: os: [ubuntu-latest, macos-latest, windows-latest] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: prefix-key: test-${{ matrix.os }} - name: Install cargo-nextest - uses: taiki-e/install-action@v2 + uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2 with: tool: nextest @@ -132,7 +132,7 @@ jobs: - name: Upload nextest report if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: nextest-${{ matrix.os }} path: target/nextest/default/junit.xml @@ -157,17 +157,17 @@ jobs: # Only presence is checked, never the value. PAGEDB_INVARIANT_CHECKS: "1" steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: prefix-key: invariants - name: Install cargo-nextest - uses: taiki-e/install-action@v2 + uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2 with: tool: nextest @@ -176,7 +176,7 @@ jobs: - name: Upload nextest report if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: nextest-invariants path: target/nextest/default/junit.xml @@ -208,14 +208,14 @@ jobs: - target: armv7-linux-androideabi label: android-armv7 (AndroidVfs / thread-pool) steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust + target - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable with: targets: ${{ matrix.target }} - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: prefix-key: cross-${{ matrix.target }} @@ -237,14 +237,14 @@ jobs: features: "" label: wasi (WasiVfs) steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust + target - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable with: targets: ${{ matrix.target }} - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: prefix-key: wasm-${{ matrix.target }} @@ -264,12 +264,12 @@ jobs: - "--features compression" - "--all-features" steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: prefix-key: features @@ -281,17 +281,17 @@ jobs: name: Benchmark (dry run) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable # The isolated comparison package links RocksDB (librocksdb-sys), whose # build runs bindgen and needs libclang. - name: Install LLVM/Clang run: sudo apt-get update && sudo apt-get install -y clang libclang-dev - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: prefix-key: bench @@ -311,11 +311,11 @@ jobs: name: Dependency audit runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable - name: Install cargo-deny - uses: taiki-e/install-action@v2 + uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2 with: tool: cargo-deny - name: Run cargo-deny