From a38656e78e2d6c9c793534e746d60a11c04adbd5 Mon Sep 17 00:00:00 2001 From: Andrew Briscoe Date: Mon, 27 Jul 2026 18:25:02 -0600 Subject: [PATCH 1/2] ci: pin GitHub Actions and enable updates --- .github/dependabot.yml | 8 ++++ .github/workflows/labels.yml | 4 +- .github/workflows/release-prepare.yml | 8 ++-- .github/workflows/release-validate.yml | 4 +- .github/workflows/release.yml | 10 ++--- .github/workflows/test.yml | 56 +++++++++++++------------- 6 files changed, 49 insertions(+), 41 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..6cc0071 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,8 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml index ed91672..540f6e9 100644 --- a/.github/workflows/labels.yml +++ b/.github/workflows/labels.yml @@ -14,8 +14,8 @@ jobs: sync: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: crazy-max/ghaction-github-labeler@v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: crazy-max/ghaction-github-labeler@24d110aa46a59976b8a7f35518cb7f14f434c916 # v5.3.0 with: yaml-file: .github/labels.yml skip-delete: true diff --git a/.github/workflows/release-prepare.yml b/.github/workflows/release-prepare.yml index b3b0744..5c73577 100644 --- a/.github/workflows/release-prepare.yml +++ b/.github/workflows/release-prepare.yml @@ -72,14 +72,14 @@ jobs: label: windows-x64 ext: ".exe" steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust + target - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable with: targets: ${{ matrix.target }} - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 with: prefix-key: fsck-${{ matrix.target }} @@ -106,7 +106,7 @@ jobs: $name = "pagedb-fsck-${{ needs.validate-version.outputs.version }}-${{ matrix.label }}.zip" Compress-Archive -Path "pagedb-fsck${{ matrix.ext }}" -DestinationPath $name - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fsck-${{ matrix.label }} path: | diff --git a/.github/workflows/release-validate.yml b/.github/workflows/release-validate.yml index a32c14d..c65b9ec 100644 --- a/.github/workflows/release-validate.yml +++ b/.github/workflows/release-validate.yml @@ -30,12 +30,12 @@ jobs: version: ${{ steps.version.outputs.version }} is_full_release: ${{ steps.version.outputs.is_full_release }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.ref }} - name: Install Rust - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable - name: Validate tag against Cargo.toml id: version diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a788f5f..57e70a5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -68,12 +68,12 @@ jobs: runs-on: ubuntu-latest environment: crates.io steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.tag }} - name: Install Rust - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable # The verifying publish compiles the packaged lib + the pagedb-fsck bin # against crates.io deps. The io-uring VFS backend needs nothing extra, @@ -121,13 +121,13 @@ jobs: contents: write actions: read steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.tag }} fetch-depth: 0 - name: Download fsck artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: pattern: "fsck-*" run-id: ${{ inputs.prepare_run_id }} @@ -136,7 +136,7 @@ jobs: merge-multiple: true - name: Create GitHub Release - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 with: tag_name: ${{ inputs.tag }} name: pagedb ${{ needs.validate-version.outputs.version }} diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 10825f8..d95d49e 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -43,10 +43,10 @@ jobs: name: Lint, Format & Docs runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable with: components: rustfmt, clippy @@ -55,7 +55,7 @@ jobs: - name: Install LLVM/Clang run: sudo apt-get update && sudo apt-get install -y clang libclang-dev - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 with: prefix-key: lint @@ -111,17 +111,17 @@ jobs: matrix: os: [ubuntu-latest, macos-latest, windows-latest] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 with: prefix-key: test-${{ matrix.os }} - name: Install cargo-nextest - uses: taiki-e/install-action@v2 + uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2 with: tool: nextest @@ -132,7 +132,7 @@ jobs: - name: Upload nextest report if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: nextest-${{ matrix.os }} path: target/nextest/default/junit.xml @@ -157,17 +157,17 @@ jobs: # Only presence is checked, never the value. PAGEDB_INVARIANT_CHECKS: "1" steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 with: prefix-key: invariants - name: Install cargo-nextest - uses: taiki-e/install-action@v2 + uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2 with: tool: nextest @@ -176,7 +176,7 @@ jobs: - name: Upload nextest report if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: nextest-invariants path: target/nextest/default/junit.xml @@ -208,14 +208,14 @@ jobs: - target: armv7-linux-androideabi label: android-armv7 (AndroidVfs / thread-pool) steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust + target - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable with: targets: ${{ matrix.target }} - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 with: prefix-key: cross-${{ matrix.target }} @@ -237,14 +237,14 @@ jobs: features: "" label: wasi (WasiVfs) steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust + target - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable with: targets: ${{ matrix.target }} - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 with: prefix-key: wasm-${{ matrix.target }} @@ -264,12 +264,12 @@ jobs: - "--features compression" - "--all-features" steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 with: prefix-key: features @@ -281,17 +281,17 @@ jobs: name: Benchmark (dry run) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable # The isolated comparison package links RocksDB (librocksdb-sys), whose # build runs bindgen and needs libclang. - name: Install LLVM/Clang run: sudo apt-get update && sudo apt-get install -y clang libclang-dev - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 with: prefix-key: bench @@ -311,11 +311,11 @@ jobs: name: Dependency audit runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable - name: Install cargo-deny - uses: taiki-e/install-action@v2 + uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2 with: tool: cargo-deny - name: Run cargo-deny From 055b5b1ccda355338f3e7d40734c56978d2e0588 Mon Sep 17 00:00:00 2001 From: Farhan Syah Date: Tue, 28 Jul 2026 09:16:16 +0800 Subject: [PATCH 2/2] ci: track pinned action SHAs with Dependabot Group weekly action-SHA bumps into a single PR and bump crazy-max/ghaction-github-labeler and Swatinem/rust-cache to their latest pinned SHAs. --- .github/dependabot.yml | 23 +++++++++++++++++++++++ .github/workflows/labels.yml | 2 +- .github/workflows/release-prepare.yml | 2 +- .github/workflows/test.yml | 14 +++++++------- 4 files changed, 32 insertions(+), 9 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 6cc0071..e4a5a31 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,8 +1,31 @@ version: 2 updates: + # Workflows pin every third-party action to a commit SHA, which is immutable + # but goes stale silently. Dependabot is the update owner that makes pinning + # sustainable: it reads the `# vX.Y.Z` annotation beside each SHA and opens a + # PR moving both when a newer release ships. + # + # `dtolnay/rust-toolchain` is the exception and is maintained by hand. It + # publishes no version series — the workflows pin `refs/heads/stable`, whose + # `action.yml` defaults `toolchain: stable` and lets rustup resolve the + # current release at run time. Its only tag, `v1`, makes `toolchain` a + # required input, so switching to it would break every call site that relies + # on that default. Dependabot cannot track a branch pin, so bumping that SHA + # is a manual step. - package-ecosystem: "github-actions" directory: "/" schedule: interval: "weekly" + # One PR per week for all action bumps, not one per action. Each PR costs a + # full matrix run, and a queue of near-identical PRs is the fastest way to + # turn review into rubber-stamping. + groups: + actions: + patterns: + - "*" + # `default-days` is the only cooldown key GitHub Actions supports; the + # `semver-*-days` variants are ignored for this ecosystem. Seven days keeps + # freshly published releases out of the queue without delaying security + # updates, which cooldown never applies to. cooldown: default-days: 7 diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml index 540f6e9..0bdb204 100644 --- a/.github/workflows/labels.yml +++ b/.github/workflows/labels.yml @@ -15,7 +15,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: crazy-max/ghaction-github-labeler@24d110aa46a59976b8a7f35518cb7f14f434c916 # v5.3.0 + - uses: crazy-max/ghaction-github-labeler@548a7c3603594ec17c819e1239f281a3b801ab4d # v6.0.0 with: yaml-file: .github/labels.yml skip-delete: true diff --git a/.github/workflows/release-prepare.yml b/.github/workflows/release-prepare.yml index 5c73577..f27fcfa 100644 --- a/.github/workflows/release-prepare.yml +++ b/.github/workflows/release-prepare.yml @@ -79,7 +79,7 @@ jobs: with: targets: ${{ matrix.target }} - - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: prefix-key: fsck-${{ matrix.target }} diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index d95d49e..441543b 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -55,7 +55,7 @@ jobs: - name: Install LLVM/Clang run: sudo apt-get update && sudo apt-get install -y clang libclang-dev - - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: prefix-key: lint @@ -116,7 +116,7 @@ jobs: - name: Install Rust uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable - - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: prefix-key: test-${{ matrix.os }} @@ -162,7 +162,7 @@ jobs: - name: Install Rust uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable - - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: prefix-key: invariants @@ -215,7 +215,7 @@ jobs: with: targets: ${{ matrix.target }} - - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: prefix-key: cross-${{ matrix.target }} @@ -244,7 +244,7 @@ jobs: with: targets: ${{ matrix.target }} - - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: prefix-key: wasm-${{ matrix.target }} @@ -269,7 +269,7 @@ jobs: - name: Install Rust uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable - - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: prefix-key: features @@ -291,7 +291,7 @@ jobs: - name: Install LLVM/Clang run: sudo apt-get update && sudo apt-get install -y clang libclang-dev - - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: prefix-key: bench