Refresh the pinned dtolnay/rust-toolchain commit - #1045
Merged
Merged
Conversation
`dtolnay/rust-toolchain` moved its `v1` tag to `02cb101ec7c40f2c49e1d9714d64511d8e1b74de`. Our one call site, in `update_sandbox.yml`, still pins `6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772` with a `# v1` comment, so zizmor's `stale-action-refs` online audit reports it and the `Lint / Zizmor Online` job exits 13. The job is `continue-on-error: true`, so it does not block a merge, but it is red on every open pull request. This bumps the pin to the commit `v1` points at today. The upstream range `6c977a6c...02cb101e` is six commits. The only change to `action.yml` is passing `--force-non-host` to `rustup toolchain install` and `rustup default`. This call site asks for `toolchain: stable` on `ubuntu-latest`, which is a host toolchain, so the flag is a no-op here. Checked locally with the same online audit, at zizmor 1.29.0 rather than the 1.25.2 CI pins: - before: `283 findings (9 ignored, 272 suppressed): 0 informational, 1 low, 1 medium, 0 high` - after: `281 findings (9 ignored, 271 suppressed): 0 informational, 1 low, 0 medium, 0 high` The one medium finding is the stale pin. The remaining low finding is `adhoc-packages` in `claude-review.yml`, from an audit that 1.25.2 does not run; it does not appear in the CI log. Dependabot does not catch this: the pin is still tagged `v1`, so it sees no version bump.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dtolnay/rust-toolchainmoved itsv1tag to02cb101ec7c40f2c49e1d9714d64511d8e1b74de. Our one call site, inupdate_sandbox.yml, still pins6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772with a# v1comment, so zizmor'sstale-action-refsonline audit reports it and theLint / Zizmor Onlinejob exits 13. The job iscontinue-on-error: true, so it does not block a merge, but it is red on every open pull request.This bumps the pin to the commit
v1points at today.Upstream range
6c977a6c...02cb101eis six commits. The only change toaction.ymlis passing--force-non-hosttorustup toolchain installandrustup default. This call site asks fortoolchain: stableonubuntu-latest, which is a host toolchain, so the flag is a no-op here.Verification
Checked locally with the same online audit, at zizmor 1.29.0 rather than the 1.25.2 CI pins:
283 findings (9 ignored, 272 suppressed): 0 informational, 1 low, 1 medium, 0 high281 findings (9 ignored, 271 suppressed): 0 informational, 1 low, 0 medium, 0 highThe one medium finding is the stale pin. The remaining low finding is
adhoc-packagesinclaude-review.yml, from an audit that 1.25.2 does not run; it does not appear in the CI log. CI on this pull request is the real check.Dependabot does not catch this: the pin is still tagged
v1, so it sees no version bump.This is the same class of fix as #1044, which refreshed the
rui314/setup-moldpins.