From f69204d91190aa79b1febf8ea3986936949d9c47 Mon Sep 17 00:00:00 2001 From: Yasunobu <42543015+P4suta@users.noreply.github.com> Date: Mon, 9 Nov 2026 02:32:25 +0900 Subject: [PATCH 1/3] build: pin reproducible developer tools --- .github/workflows/ci.yml | 2 +- .github/workflows/mutants-full.yml | 2 +- .github/workflows/release-plz.yml | 2 +- mise.toml | 47 +++++++++++++----------------- renovate.json | 20 +++++++++++-- 5 files changed, 41 insertions(+), 32 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c20ed3a..72ad909 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -58,7 +58,7 @@ jobs: echo /tmp >> "$GITHUB_PATH" - name: install pinned typos env: - TYPOS_VERSION: 1.51.1 + TYPOS_VERSION: 1.52.0 run: | curl -fsSL "https://github.com/crate-ci/typos/releases/download/v${TYPOS_VERSION}/typos-v${TYPOS_VERSION}-x86_64-unknown-linux-musl.tar.gz" \ | tar xz -C /tmp ./typos diff --git a/.github/workflows/mutants-full.yml b/.github/workflows/mutants-full.yml index 8f18140..1b2cf33 100644 --- a/.github/workflows/mutants-full.yml +++ b/.github/workflows/mutants-full.yml @@ -33,7 +33,7 @@ jobs: - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3 - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31 with: - tool: cargo-mutants@27.1.0,cargo-nextest + tool: cargo-mutants@27.1.0,cargo-nextest@0.9.149 - name: regenerate the complete mutation outcome inventory env: MUTANT_SHARD: ${{ matrix.shard }} diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml index 559038e..279b00c 100644 --- a/.github/workflows/release-plz.yml +++ b/.github/workflows/release-plz.yml @@ -92,7 +92,7 @@ jobs: echo /tmp >> "$GITHUB_PATH" - name: install pinned typos env: - TYPOS_VERSION: 1.51.1 + TYPOS_VERSION: 1.52.0 run: | curl -fsSL "https://github.com/crate-ci/typos/releases/download/v${TYPOS_VERSION}/typos-v${TYPOS_VERSION}-x86_64-unknown-linux-musl.tar.gz" \ | tar xz -C /tmp ./typos diff --git a/mise.toml b/mise.toml index 53eeaa2..4a8dd93 100644 --- a/mise.toml +++ b/mise.toml @@ -1,42 +1,35 @@ -# Native dev toolchain (mirrors what CI installs). The Rust toolchain itself is -# owned by rust-toolchain.toml. Install with `mise install`, then `just doctor`. +# rust-toolchain.toml selects the Rust compiler. +# Install developer tools with mise, then run just doctor. [tools] # Task runner, git hooks, and the format/lint tools the recipes shell out to. -just = "latest" -lefthook = "latest" -taplo = "latest" -biome = "latest" +just = "1.59.0" +lefthook = "2.2.2" +taplo = "0.10.0" +biome = "2.6.2" yamlfmt = "0.21.0" # pinned for format stability -actionlint = "latest" -typos = "latest" -jq = "latest" +actionlint = "1.7.12" +typos = "1.52.0" +jq = "1.8.2" # Lets the cargo: backend fetch prebuilt binaries instead of compiling. -cargo-binstall = "latest" +cargo-binstall = "1.26.0" # Cargo subcommands via the cargo: backend (no mise registry short names exist). -"cargo:cargo-nextest" = "latest" -"cargo:cargo-deny" = "latest" -"cargo:cargo-sort" = "latest" -"cargo:cargo-fuzz" = "latest" -"cargo:cargo-insta" = "latest" -"cargo:cargo-llvm-cov" = "latest" -# Conventional-Commits linter for the lefthook commit-msg hook — the local guard -# that keeps release tooling fed with well-formed commit messages. cargo backend, -# binstalled. -"cargo:committed" = "1" +"cargo:cargo-nextest" = "0.9.149" +"cargo:cargo-deny" = "0.20.2" +"cargo:cargo-sort" = "2.1.4" +"cargo:cargo-fuzz" = "0.13.2" +"cargo:cargo-insta" = "1.49.0" +"cargo:cargo-llvm-cov" = "0.9.1" +# Validate commit messages with Conventional Commits. +"cargo:committed" = "1.1.11" # Pinned (not `latest`): cargo-mutants gates PRs, and its generated mutants and output can shift across releases, so reproducibility beats an implicit floating version. # Review Renovate proposals for this pin deliberately against the mutation suite, as with yamlfmt and libwebp. "cargo:cargo-mutants" = "27.1.0" -# libwebp's `cwebp` / `dwebp` — the conformance oracle used to generate and -# verify golden fixtures. webmproject/libwebp publishes NO GitHub release assets -# (only git tags), so the ubi / github / aqua backends cannot fetch binaries; -# the official prebuilt archives on Google storage are pulled via the `http` -# backend instead. `strip_components = 1` drops the top-level -# `libwebp--/` directory so `bin/` (cwebp, dwebp, ...) is what -# lands on PATH. Verified working on this host (cwebp/dwebp resolve to 1.6.0). +# Official libwebp archives provide the reference executables. +# Drop the archive's top-level directory before exposing bin/. [tools."http:libwebp"] version = "1.6.0" strip_components = 1 diff --git a/renovate.json b/renovate.json index 8ef66ee..6149a86 100644 --- a/renovate.json +++ b/renovate.json @@ -3,10 +3,26 @@ "customManagers": [ { "customType": "regex", - "managerFilePatterns": ["/^\\.github/workflows/ci\\.yml$/"], - "matchStrings": ["CARGO_SORT_VERSION:\\s*(?\\d+\\.\\d+\\.\\d+)"], + "managerFilePatterns": ["/^\\.github/workflows/(ci|release-plz)\\.yml$/"], + "matchStrings": [ + "CARGO_SORT_VERSION:\\s*(?\\d+\\.\\d+\\.\\d+)", + "cargo install --locked --version (?\\d+\\.\\d+\\.\\d+) cargo-sort" + ], "datasourceTemplate": "crate", "depNameTemplate": "cargo-sort" + }, + { + "customType": "regex", + "managerFilePatterns": ["/^mise\\.toml$/"], + "matchStrings": [ + "\\[tools\\.\"http:libwebp\"\\]\\s*version\\s*=\\s*\"(?\\d+\\.\\d+\\.\\d+)\"", + "https://storage\\.googleapis\\.com/downloads\\.webmproject\\.org/releases/webp/libwebp-(?\\d+\\.\\d+\\.\\d+)-" + ], + "datasourceTemplate": "git-tags", + "depNameTemplate": "libwebp", + "packageNameTemplate": "https://chromium.googlesource.com/webm/libwebp", + "versioningTemplate": "semver", + "extractVersionTemplate": "^v(?\\d+\\.\\d+\\.\\d+)$" } ] } From 0c46a6179dc043b8d1fd5464826c063c312afc4e Mon Sep 17 00:00:00 2001 From: Yasunobu <42543015+P4suta@users.noreply.github.com> Date: Mon, 9 Nov 2026 03:25:27 +0900 Subject: [PATCH 2/3] build(tools): bind libwebp updates to its discovery source --- mise.toml | 11 +++++++---- renovate.json | 11 +++++------ 2 files changed, 12 insertions(+), 10 deletions(-) diff --git a/mise.toml b/mise.toml index 4a8dd93..b8baac0 100644 --- a/mise.toml +++ b/mise.toml @@ -32,20 +32,23 @@ cargo-binstall = "1.26.0" # Drop the archive's top-level directory before exposing bin/. [tools."http:libwebp"] version = "1.6.0" +version_list_url = "https://api.github.com/repos/webmproject/libwebp/tags" +version_json_path = ".[].name" +version_order = "semver" strip_components = 1 bin_path = "bin" [tools."http:libwebp".platforms.windows-x64] -url = "https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-1.6.0-windows-x64.zip" +url = "https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-{{ version }}-windows-x64.zip" [tools."http:libwebp".platforms.linux-x64] -url = "https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-1.6.0-linux-x86-64.tar.gz" +url = "https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-{{ version }}-linux-x86-64.tar.gz" [tools."http:libwebp".platforms.macos-arm64] -url = "https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-1.6.0-mac-arm64.tar.gz" +url = "https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-{{ version }}-mac-arm64.tar.gz" [tools."http:libwebp".platforms.macos-x64] -url = "https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-1.6.0-mac-x86-64.tar.gz" +url = "https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-{{ version }}-mac-x86-64.tar.gz" [settings.cargo] # Use cargo-binstall (prebuilt binaries) for cargo: backend tools, not source builds. diff --git a/renovate.json b/renovate.json index 6149a86..893c7c0 100644 --- a/renovate.json +++ b/renovate.json @@ -12,15 +12,14 @@ "depNameTemplate": "cargo-sort" }, { - "customType": "regex", + "customType": "jsonata", + "fileFormat": "toml", "managerFilePatterns": ["/^mise\\.toml$/"], "matchStrings": [ - "\\[tools\\.\"http:libwebp\"\\]\\s*version\\s*=\\s*\"(?\\d+\\.\\d+\\.\\d+)\"", - "https://storage\\.googleapis\\.com/downloads\\.webmproject\\.org/releases/webp/libwebp-(?\\d+\\.\\d+\\.\\d+)-" + "tools.`http:libwebp`.{\"depName\": \"http:libwebp\", \"currentValue\": version}" ], - "datasourceTemplate": "git-tags", - "depNameTemplate": "libwebp", - "packageNameTemplate": "https://chromium.googlesource.com/webm/libwebp", + "datasourceTemplate": "github-tags", + "packageNameTemplate": "webmproject/libwebp", "versioningTemplate": "semver", "extractVersionTemplate": "^v(?\\d+\\.\\d+\\.\\d+)$" } From e670338068c59470fa506b62ee5165900986f1eb Mon Sep 17 00:00:00 2001 From: Yasunobu <42543015+P4suta@users.noreply.github.com> Date: Mon, 9 Nov 2026 03:37:52 +0900 Subject: [PATCH 3/3] build(tools): select current compatible patch releases --- .github/workflows/ci.yml | 2 +- .github/workflows/mutants-full.yml | 2 +- .github/workflows/release-plz.yml | 10 +++++----- mise.toml | 6 +++--- 4 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 72ad909..79658b6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -35,7 +35,7 @@ jobs: - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3 - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31 with: - tool: cargo-nextest@0.9.149,cargo-deny@0.20.2,taplo-cli@0.10.0 + tool: cargo-nextest@0.9.151,cargo-deny@0.20.2,taplo-cli@0.10.0 - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31 with: tool: just@1.59.0 diff --git a/.github/workflows/mutants-full.yml b/.github/workflows/mutants-full.yml index 1b2cf33..8b052bf 100644 --- a/.github/workflows/mutants-full.yml +++ b/.github/workflows/mutants-full.yml @@ -33,7 +33,7 @@ jobs: - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3 - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31 with: - tool: cargo-mutants@27.1.0,cargo-nextest@0.9.149 + tool: cargo-mutants@27.1.0,cargo-nextest@0.9.151 - name: regenerate the complete mutation outcome inventory env: MUTANT_SHARD: ${{ matrix.shard }} diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml index 279b00c..ebeb0f2 100644 --- a/.github/workflows/release-plz.yml +++ b/.github/workflows/release-plz.yml @@ -69,7 +69,7 @@ jobs: run: cargo run --locked --quiet -p xtask -- ci source --revision "$CANDIDATE_SHA" --output "$GITHUB_OUTPUT" - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31 with: - tool: cargo-nextest@0.9.149,cargo-deny@0.20.2,taplo-cli@0.10.0 + tool: cargo-nextest@0.9.151,cargo-deny@0.20.2,taplo-cli@0.10.0 - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31 with: tool: just@1.59.0 @@ -130,7 +130,7 @@ jobs: run: cargo run --locked --quiet -p xtask -- ci source --revision "$CANDIDATE_SHA" --output "$GITHUB_OUTPUT" - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31 with: - tool: cargo-nextest@0.9.149 + tool: cargo-nextest@0.9.151 - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31 with: tool: just@1.59.0 @@ -169,7 +169,7 @@ jobs: run: cargo run --locked --quiet -p xtask -- ci source --revision "$CANDIDATE_SHA" --output "$GITHUB_OUTPUT" - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31 with: - tool: cargo-nextest@0.9.149 + tool: cargo-nextest@0.9.151 - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31 with: tool: just@1.59.0 @@ -402,7 +402,7 @@ jobs: run: cargo run --locked --quiet -p xtask -- ci source --revision "$CANDIDATE_SHA" --output "$GITHUB_OUTPUT" - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31 with: - tool: cargo-llvm-cov@0.9.1,cargo-nextest@0.9.149 + tool: cargo-llvm-cov@0.9.1,cargo-nextest@0.9.151 - name: install pinned Just uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31 with: @@ -445,7 +445,7 @@ jobs: run: cargo run --locked --quiet -p xtask -- ci source --revision "$CANDIDATE_SHA" --output "$GITHUB_OUTPUT" - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31 with: - tool: cargo-mutants@27.1.0,cargo-nextest@0.9.149 + tool: cargo-mutants@27.1.0,cargo-nextest@0.9.151 - name: confirm the committed full mutation inventory env: MUTANT_SHARD: ${{ matrix.shard }} diff --git a/mise.toml b/mise.toml index b8baac0..8745198 100644 --- a/mise.toml +++ b/mise.toml @@ -13,17 +13,17 @@ typos = "1.52.0" jq = "1.8.2" # Lets the cargo: backend fetch prebuilt binaries instead of compiling. -cargo-binstall = "1.26.0" +cargo-binstall = "1.26.2" # Cargo subcommands via the cargo: backend (no mise registry short names exist). -"cargo:cargo-nextest" = "0.9.149" +"cargo:cargo-nextest" = "0.9.151" "cargo:cargo-deny" = "0.20.2" "cargo:cargo-sort" = "2.1.4" "cargo:cargo-fuzz" = "0.13.2" "cargo:cargo-insta" = "1.49.0" "cargo:cargo-llvm-cov" = "0.9.1" # Validate commit messages with Conventional Commits. -"cargo:committed" = "1.1.11" +"cargo:committed" = "1.1.12" # Pinned (not `latest`): cargo-mutants gates PRs, and its generated mutants and output can shift across releases, so reproducibility beats an implicit floating version. # Review Renovate proposals for this pin deliberately against the mutation suite, as with yamlfmt and libwebp. "cargo:cargo-mutants" = "27.1.0"