From 816feea6a8048d04f05bec947f087b493ed3030a Mon Sep 17 00:00:00 2001 From: Everett Pompeii Date: Tue, 22 Sep 2026 03:06:22 +0000 Subject: [PATCH] Refresh the pinned dtolnay/rust-toolchain commit `dtolnay/rust-toolchain` moved its `v1` tag to `02cb101ec7c40f2c49e1d9714d64511d8e1b74de`. Our one call site, in `update_sandbox.yml`, still pins `6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772` with a `# v1` comment, so zizmor's `stale-action-refs` online audit reports it and the `Lint / Zizmor Online` job exits 13. The job is `continue-on-error: true`, so it does not block a merge, but it is red on every open pull request. This bumps the pin to the commit `v1` points at today. The upstream range `6c977a6c...02cb101e` is six commits. The only change to `action.yml` is passing `--force-non-host` to `rustup toolchain install` and `rustup default`. This call site asks for `toolchain: stable` on `ubuntu-latest`, which is a host toolchain, so the flag is a no-op here. Checked locally with the same online audit, at zizmor 1.29.0 rather than the 1.25.2 CI pins: - before: `283 findings (9 ignored, 272 suppressed): 0 informational, 1 low, 1 medium, 0 high` - after: `281 findings (9 ignored, 271 suppressed): 0 informational, 1 low, 0 medium, 0 high` The one medium finding is the stale pin. The remaining low finding is `adhoc-packages` in `claude-review.yml`, from an audit that 1.25.2 does not run; it does not appear in the CI log. Dependabot does not catch this: the pin is still tagged `v1`, so it sees no version bump. --- .github/workflows/update_sandbox.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/update_sandbox.yml b/.github/workflows/update_sandbox.yml index 047f817fb..5e66393a7 100644 --- a/.github/workflows/update_sandbox.yml +++ b/.github/workflows/update_sandbox.yml @@ -15,7 +15,7 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # zizmor: ignore[artipacked] this job commits and force-pushes the update/sandbox branch, so it needs the persisted GITHUB_TOKEN with: ref: devel - - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1 + - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1 with: toolchain: stable - uses: rui314/setup-mold@10ca16bf91dc22e05ebdc935cad9c75ea248f621 # v1