From 244dd8939df276cef57f2bb94279a6fb6f7eaa55 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 3 Nov 2026 02:52:41 +0000 Subject: [PATCH 1/2] build(deps): update all non-major dependencies --- .github/workflows/ci.yml | 4 ++-- .github/workflows/mutants-full.yml | 2 +- .github/workflows/release-plz.yml | 28 ++++++++++++++-------------- 3 files changed, 17 insertions(+), 17 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c20ed3a..976e658 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -33,10 +33,10 @@ jobs: - name: install the repository Rust toolchain run: rustup toolchain install "$RUST_VERSION" --profile minimal --no-self-update - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3 - - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31 + - uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1 with: tool: cargo-nextest@0.9.149,cargo-deny@0.20.2,taplo-cli@0.10.0 - - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31 + - uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1 with: tool: just@1.59.0 fallback: none diff --git a/.github/workflows/mutants-full.yml b/.github/workflows/mutants-full.yml index 8f18140..7d325d1 100644 --- a/.github/workflows/mutants-full.yml +++ b/.github/workflows/mutants-full.yml @@ -31,7 +31,7 @@ jobs: - name: install the repository Rust toolchain run: rustup toolchain install "$RUST_VERSION" --profile minimal --no-self-update - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3 - - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31 + - uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1 with: tool: cargo-mutants@27.1.0,cargo-nextest - name: regenerate the complete mutation outcome inventory diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml index 559038e..71910e9 100644 --- a/.github/workflows/release-plz.yml +++ b/.github/workflows/release-plz.yml @@ -67,10 +67,10 @@ jobs: env: CANDIDATE_SHA: ${{ needs.candidate.outputs.revision }} run: cargo run --locked --quiet -p xtask -- ci source --revision "$CANDIDATE_SHA" --output "$GITHUB_OUTPUT" - - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31 + - uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1 with: tool: cargo-nextest@0.9.149,cargo-deny@0.20.2,taplo-cli@0.10.0 - - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31 + - uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1 with: tool: just@1.59.0 fallback: none @@ -128,10 +128,10 @@ jobs: CANDIDATE_SHA: ${{ needs.candidate.outputs.revision }} shell: bash run: cargo run --locked --quiet -p xtask -- ci source --revision "$CANDIDATE_SHA" --output "$GITHUB_OUTPUT" - - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31 + - uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1 with: tool: cargo-nextest@0.9.149 - - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31 + - uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1 with: tool: just@1.59.0 fallback: none @@ -167,10 +167,10 @@ jobs: env: CANDIDATE_SHA: ${{ needs.candidate.outputs.revision }} run: cargo run --locked --quiet -p xtask -- ci source --revision "$CANDIDATE_SHA" --output "$GITHUB_OUTPUT" - - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31 + - uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1 with: tool: cargo-nextest@0.9.149 - - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31 + - uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1 with: tool: just@1.59.0 fallback: none @@ -242,7 +242,7 @@ jobs: - name: install bare-metal target run: rustup target add thumbv7em-none-eabi - name: install pinned Just - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31 + uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1 with: tool: just@1.59.0 fallback: none @@ -400,11 +400,11 @@ jobs: env: CANDIDATE_SHA: ${{ needs.candidate.outputs.revision }} run: cargo run --locked --quiet -p xtask -- ci source --revision "$CANDIDATE_SHA" --output "$GITHUB_OUTPUT" - - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31 + - uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1 with: tool: cargo-llvm-cov@0.9.1,cargo-nextest@0.9.149 - name: install pinned Just - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31 + uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1 with: tool: just@1.59.0 fallback: none @@ -443,7 +443,7 @@ jobs: env: CANDIDATE_SHA: ${{ needs.candidate.outputs.revision }} run: cargo run --locked --quiet -p xtask -- ci source --revision "$CANDIDATE_SHA" --output "$GITHUB_OUTPUT" - - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31 + - uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1 with: tool: cargo-mutants@27.1.0,cargo-nextest@0.9.149 - name: confirm the committed full mutation inventory @@ -521,12 +521,12 @@ jobs: env: CANDIDATE_SHA: ${{ needs.candidate.outputs.revision }} run: cargo run --locked --quiet -p xtask -- ci source --revision "$CANDIDATE_SHA" --output "$GITHUB_OUTPUT" - - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31 + - uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1 with: tool: cargo-fuzz@0.13.2 - name: install the verified nightly toolchain run: rustup toolchain install "$NIGHTLY_TOOLCHAIN" --profile minimal --no-self-update - - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31 + - uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1 with: tool: just@1.59.0 fallback: none @@ -634,7 +634,7 @@ jobs: env: CANDIDATE_SHA: ${{ needs.candidate.outputs.revision }} run: cargo run --locked --quiet -p xtask -- ci source --revision "$CANDIDATE_SHA" --output "$GITHUB_OUTPUT" - - uses: release-plz/action@8b5bf233ecb5779f63508db7cd050e948ee77cc2 # v0.5.144 + - uses: release-plz/action@f67a7e724bdad4a0f6875f186060a0ca2770d76c # v0.5.147 with: command: release version: 0.3.174 @@ -688,7 +688,7 @@ jobs: persist-credentials: false - name: install the repository Rust toolchain run: rustup toolchain install "$RUST_VERSION" --profile minimal --no-self-update - - uses: release-plz/action@8b5bf233ecb5779f63508db7cd050e948ee77cc2 # v0.5.144 + - uses: release-plz/action@f67a7e724bdad4a0f6875f186060a0ca2770d76c # v0.5.147 with: command: release-pr version: 0.3.174 From 290304bd0962fa48ec7ff24a64717fffe75a0021 Mon Sep 17 00:00:00 2001 From: Yasunobu <42543015+P4suta@users.noreply.github.com> Date: Wed, 4 Nov 2026 19:57:53 +0900 Subject: [PATCH 2/2] fix(ci): track the immutable publisher contract pin --- renovate.json | 16 ++++++++++++++ xtask/tests/ci_workflow.rs | 43 ++++++++++++++++++++++++++++++++++---- 2 files changed, 55 insertions(+), 4 deletions(-) diff --git a/renovate.json b/renovate.json index 8ef66ee..47f28b1 100644 --- a/renovate.json +++ b/renovate.json @@ -7,6 +7,22 @@ "matchStrings": ["CARGO_SORT_VERSION:\\s*(?\\d+\\.\\d+\\.\\d+)"], "datasourceTemplate": "crate", "depNameTemplate": "cargo-sort" + }, + { + "customType": "regex", + "managerFilePatterns": ["/^xtask/tests/ci_workflow\\.rs$/"], + "matchStrings": [ + "/// renovate: datasource=github-tags depName=release-plz/action currentValue=(?v\\d+\\.\\d+\\.\\d+)\\s+const PUBLISHER_ACTION: &str =\\s*\"release-plz/action@(?[a-f0-9]{40})\";" + ], + "datasourceTemplate": "github-tags", + "depNameTemplate": "release-plz/action" + } + ], + "packageRules": [ + { + "matchDepNames": ["release-plz/action"], + "matchManagers": ["github-actions", "custom.regex"], + "groupName": "release-plz action bindings" } ] } diff --git a/xtask/tests/ci_workflow.rs b/xtask/tests/ci_workflow.rs index 8ceba30..d94a7b7 100644 --- a/xtask/tests/ci_workflow.rs +++ b/xtask/tests/ci_workflow.rs @@ -6,6 +6,9 @@ use std::path::Path; use anyhow::{Context, Result, ensure}; use yaml_rust2::{Yaml, YamlLoader}; +/// renovate: datasource=github-tags depName=release-plz/action currentValue=v0.5.147 +const PUBLISHER_ACTION: &str = "release-plz/action@f67a7e724bdad4a0f6875f186060a0ca2770d76c"; + fn workflow(name: &str) -> Result { let root = Path::new(env!("CARGO_MANIFEST_DIR")) .parent() @@ -244,10 +247,7 @@ fn release_contract(source: &Yaml) -> Result<()> { let steps = publisher["steps"].as_vec().context("publisher steps")?; let action = steps .iter() - .find(|step| { - step["uses"].as_str() - == Some("release-plz/action@8b5bf233ecb5779f63508db7cd050e948ee77cc2") - }) + .find(|step| step["uses"].as_str() == Some(PUBLISHER_ACTION)) .context("immutable publisher action")?; ensure!( action["with"]["version"].as_str() == Some("0.3.174"), @@ -752,6 +752,41 @@ fn publication_requires_complete_same_source_qualification() { ); } +#[test] +fn publisher_requires_the_reviewed_immutable_action_and_settings() { + let original = workflow("release-plz.yml").unwrap(); + release_contract(&original).unwrap(); + for reference in [ + "release-plz/action@8b5bf233ecb5779f63508db7cd050e948ee77cc2", + "release-plz/action@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "release-plz/action@v0.5", + "another/action@f67a7e724bdad4a0f6875f186060a0ca2770d76c", + ] { + let mut changed = original.clone(); + let Yaml::Array(steps) = &mut changed["jobs"]["release-plz-release"]["steps"] else { + unreachable!() + }; + let action = steps + .iter_mut() + .find(|step| step["uses"].as_str() == Some(PUBLISHER_ACTION)) + .unwrap(); + action["uses"] = Yaml::String(reference.to_owned()); + assert!(release_contract(&changed).is_err(), "publisher {reference}"); + } + for (setting, value) in [("version", "0.4.2"), ("command", "release-pr")] { + let mut changed = original.clone(); + let Yaml::Array(steps) = &mut changed["jobs"]["release-plz-release"]["steps"] else { + unreachable!() + }; + let action = steps + .iter_mut() + .find(|step| step["uses"].as_str() == Some(PUBLISHER_ACTION)) + .unwrap(); + action["with"][setting] = Yaml::String(value.to_owned()); + assert!(release_contract(&changed).is_err(), "publisher {setting}"); + } +} + #[test] fn removing_a_role_source_guard_or_publisher_binding_is_rejected() { let original = workflow("release-plz.yml").unwrap();