Repository navigation
Conversation
Closes #2032 I make every check `protect-develop` requires report on `merge_group`, so I can turn the merge queue on without losing any of them. - `ci.yml`, `line-limit.yml`, `dco.yml`, `podman-lane.yml` and `workflow-lint.yml` trigger on `merge_group: types: [checks_requested]`. No other workflow does; `release.yml` stays out. - `reusable-dco.yml` reads the range from whichever event fired (`pull_request` or `merge_group`). In the queue that range is the squash commit GitHub built, the one that lands on develop, so the trailer is now checked on the commit itself. Both steps fail when the range is empty; before this, an empty range listed no commits and the check passed without looking. I added no exemption for bot or GitHub commits: 200 of the last 200 first-parent commits on develop carry the trailer, Dependabot's included. - `podman-lane.yml`: `decide` diffs the merge group range the same way it diffs a pull request, and still boots the VM when the diff cannot be read. Concurrency is untouched: the queue ref is unique per group, so one group never cancels another. - `ci.yml`: the freshness and branch-health watchers skip `merge_group`. None of them is required, and they already run on the pull request. - `.github/scripts/check-merge-group-triggers.py`, run from workflow-lint: every workflow that emits a develop-required check must trigger on `merge_group` with `checks_requested`, and any other workflow carrying the trigger is refused. Tested in `tests/shell/reusable-workflow-lint-merge-group.test.sh` (26 cases) and wired into lint-shell. - `tests/workflow_branch_health.rs` pins the health callers' `if:` exactly, so I update it to the new shape; it still goes red when either caller loses the merge-queue exclusion or the self-branch half. - I also replace a comment in `reusable-workflow-lint.yml` that cited a local file for the "a gate that never failed is not tested" rule; it now cites the CI standard. What I ran: - `actionlint` 1.7.12 on every changed workflow (`-shellcheck= -pyflakes=` for podman-lane), `shellcheck` on the new test: clean. - The full lint-shell suite exactly as `test-command` runs it: 38/38. - `cargo test --locked --all-features --workspace`: green apart from two live-Podman build tests that failed on my local storage (`layer not known`) and passed on the previous run; this pull request changes no Rust source. - Sabotage on the new check, each one goes red with its own message: removing `merge_group` from podman-lane.yml, adding it to release.yml, and `types: [destroyed]` on dco.yml. - The DCO step extracted and run by hand: an empty range exits 1, the last five squash commits on develop pass, and a commit without a trailer fails. Known limit: the script's list of develop-required reusables is static, like the caller-if map next to it. If the ruleset starts requiring another check, both lists need the new entry, or that check will not report in the queue and the entry waits until the timeout. Nothing unchecked lands; the queue just stalls. What only the queue can show: that each required check appears in a real merge group and that the commit landing on develop is signed and carries the trailer. I check that on the first pull requests that go through it. Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com> --------- Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
Bumps [pycparser](https://github.com/eliben/pycparser) from 3.0 to 3.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/eliben/pycparser/releases">pycparser's releases</a>.</em></p> <blockquote> <h2>release_v3.01</h2> <h2>What's Changed</h2> <ul> <li>Drop an unneeded direct build depndency on wheel by <a href="https://github.com/hroncok"><code>@hroncok</code></a> in <a href="https://redirect.github.com/eliben/pycparser/pull/597">eliben/pycparser#597</a></li> <li>fix: handle integer suffix in #line directive without crashing by <a href="https://github.com/SAY-5"><code>@SAY-5</code></a> in <a href="https://redirect.github.com/eliben/pycparser/pull/601">eliben/pycparser#601</a></li> <li>Update default branch to main by <a href="https://github.com/myd7349"><code>@myd7349</code></a> in <a href="https://redirect.github.com/eliben/pycparser/pull/602">eliben/pycparser#602</a></li> <li>fix: raise ParseError instead of AssertionError on unmatched '}' by <a href="https://github.com/patchwright"><code>@patchwright</code></a> in <a href="https://redirect.github.com/eliben/pycparser/pull/604">eliben/pycparser#604</a></li> <li>Add support for Python 3.15 by <a href="https://github.com/kytta"><code>@kytta</code></a> in <a href="https://redirect.github.com/eliben/pycparser/pull/605">eliben/pycparser#605</a></li> <li>Fix empty compound literal (type){} raising ParseError by <a href="https://github.com/IMGillusion"><code>@IMGillusion</code></a> in <a href="https://redirect.github.com/eliben/pycparser/pull/606">eliben/pycparser#606</a></li> <li>Fix compound literal statements in C generator by <a href="https://github.com/Rayan-and-beyond"><code>@Rayan-and-beyond</code></a> in <a href="https://redirect.github.com/eliben/pycparser/pull/607">eliben/pycparser#607</a></li> <li>Keep the contents of adjacent u8 string literals by <a href="https://github.com/SashaMIT"><code>@SashaMIT</code></a> in <a href="https://redirect.github.com/eliben/pycparser/pull/609">eliben/pycparser#609</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/eliben/pycparser/compare/release_v3.00...release_v3.01">https://github.com/eliben/pycparser/compare/release_v3.00...release_v3.01</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/eliben/pycparser/commit/7c52c452cd66bcd8683ca336844c64b876d21c3a"><code>7c52c45</code></a> Update TODO</li> <li><a href="https://github.com/eliben/pycparser/commit/ffcd4ce5a104f8a395700e9da14854364632e0f7"><code>ffcd4ce</code></a> Add Make target to re-generate AST</li> <li><a href="https://github.com/eliben/pycparser/commit/b46e114c7ec5806d12f549edc205cfe337126928"><code>b46e114</code></a> Bump version to 3.01 for release</li> <li><a href="https://github.com/eliben/pycparser/commit/ddc78e180b719a2088df7a2a5801de69e82e5333"><code>ddc78e1</code></a> Update license year</li> <li><a href="https://github.com/eliben/pycparser/commit/1d7d54c1793ab897681ccfdc19fdbfa62e8a2b82"><code>1d7d54c</code></a> Add more testing for merging consecutive string literals</li> <li><a href="https://github.com/eliben/pycparser/commit/b6319dbab29783162c6f916e679480b66ff36287"><code>b6319db</code></a> Keep the contents of adjacent u8 string literals. (<a href="https://redirect.github.com/eliben/pycparser/issues/609">#609</a>)</li> <li><a href="https://github.com/eliben/pycparser/commit/f93324c195dd1c0d73cfe93cdf8e8a5aede377df"><code>f93324c</code></a> Fix compound literal statement generation (<a href="https://redirect.github.com/eliben/pycparser/issues/607">#607</a>)</li> <li><a href="https://github.com/eliben/pycparser/commit/70db2d81acf81b1fc66e3c0fd653d8b0dcb910a6"><code>70db2d8</code></a> Formatting</li> <li><a href="https://github.com/eliben/pycparser/commit/4d00573aa2433c7483533dae9385ee69256413e7"><code>4d00573</code></a> Fix empty compound literal (type){} raising ParseError (<a href="https://redirect.github.com/eliben/pycparser/issues/606">#606</a>)</li> <li><a href="https://github.com/eliben/pycparser/commit/af3ac8722eb4e4990f464fa5f7c756e8a3bc1519"><code>af3ac87</code></a> Remove executable bit on file and shebang</li> <li>Additional commits viewable in <a href="https://github.com/eliben/pycparser/compare/release_v3.00...release_v3.01">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…group (#2028) Bumps the cargo-patch-and-minor group with 1 update: [hyper](https://github.com/hyperium/hyper). Updates `hyper` from 1.11.1 to 1.12.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/hyperium/hyper/releases">hyper's releases</a>.</em></p> <blockquote> <h2>v1.12.0</h2> <h2>Features</h2> <ul> <li><strong>http1:</strong> add max_header_size limit for server and client (<a href="https://redirect.github.com/hyperium/hyper/issues/4183">#4183</a>) (<a href="https://github.com/hyperium/hyper/commit/d1cd14eff392be63a2318d690cc9380723ec61a1">d1cd14ef</a>, closes <a href="https://redirect.github.com/hyperium/hyper/issues/3832">#3832</a>)</li> </ul> <h2>Bug Fixes</h2> <ul> <li><strong>http1:</strong> <ul> <li>withdraw a stale want when the client dispatcher takes a request (<a href="https://redirect.github.com/hyperium/hyper/issues/4208">#4208</a>) (<a href="https://github.com/hyperium/hyper/commit/c44f1cc51c2bc45b502031a646d3d54315bd7a16">c44f1cc5</a>)</li> <li>remove content-length if transfer-encoding is auto-added (<a href="https://redirect.github.com/hyperium/hyper/issues/4224">#4224</a>) (<a href="https://github.com/hyperium/hyper/commit/69396fdd960629d69b09cc6c9b367ef8650c001d">69396fdd</a>)</li> <li>always remove content-length if transfer-encoding is sent (<a href="https://redirect.github.com/hyperium/hyper/issues/4223">#4223</a>) (<a href="https://github.com/hyperium/hyper/commit/a5d7fd7861598c0b8c857cb75240a75bcfbd96a3">a5d7fd78</a>)</li> <li>let a Connection close token win over a later keep-alive (<a href="https://redirect.github.com/hyperium/hyper/issues/4201">#4201</a>) (<a href="https://github.com/hyperium/hyper/commit/5dadff76d1cb5d21046218df3568569fbba8ed21">5dadff76</a>)</li> <li>preserve hop-by-hop when setting close or keep-alive (<a href="https://redirect.github.com/hyperium/hyper/issues/4196">#4196</a>) (<a href="https://github.com/hyperium/hyper/commit/74a39081ff1496970fb75da75c5282b23a9b69e5">74a39081</a>)</li> </ul> </li> <li><strong>http2:</strong> do not reserve capacity for idle Upgraded streams (<a href="https://redirect.github.com/hyperium/hyper/issues/4198">#4198</a>) (<a href="https://github.com/hyperium/hyper/commit/e89d0d93d9566210ee95aea234a00952ebc4a202">e89d0d93</a>)</li> </ul> <h2>Everything</h2> <ul> <li>docs: fix typo responsibile -> responsible by <a href="https://github.com/vaibhav8a"><code>@vaibhav8a</code></a> in <a href="https://redirect.github.com/hyperium/hyper/pull/4177">hyperium/hyper#4177</a></li> <li>style: replace single-character lifetime names with descriptive names by <a href="https://github.com/dox4"><code>@dox4</code></a> in <a href="https://redirect.github.com/hyperium/hyper/pull/4173">hyperium/hyper#4173</a></li> <li>refactor(http1): resolve collapsible_match lint by <a href="https://github.com/nakaryo716"><code>@nakaryo716</code></a> in <a href="https://redirect.github.com/hyperium/hyper/pull/4178">hyperium/hyper#4178</a></li> <li>hyper Improvement Proposals by <a href="https://github.com/seanmonstar"><code>@seanmonstar</code></a> in <a href="https://redirect.github.com/hyperium/hyper/pull/4131">hyperium/hyper#4131</a></li> <li>perf(body): simpler custom Incoming channel by <a href="https://github.com/seanmonstar"><code>@seanmonstar</code></a> in <a href="https://redirect.github.com/hyperium/hyper/pull/4168">hyperium/hyper#4168</a></li> <li>docs(maintainers): add 0x676e67 as a collaborator by <a href="https://github.com/seanmonstar"><code>@seanmonstar</code></a> in <a href="https://redirect.github.com/hyperium/hyper/pull/4184">hyperium/hyper#4184</a></li> <li>fix(ext): remove broken <code>OriginalHeaderOrder</code> doctest by <a href="https://github.com/cratelyn"><code>@cratelyn</code></a> in <a href="https://redirect.github.com/hyperium/hyper/pull/4188">hyperium/hyper#4188</a></li> <li>build(deps): remove unused <code>futures-channel</code> from <code>http1</code> feature by <a href="https://github.com/0x676e67"><code>@0x676e67</code></a> in <a href="https://redirect.github.com/hyperium/hyper/pull/4185">hyperium/hyper#4185</a></li> <li>chore(ci): update to cargo-check-external-types 0.5.0 by <a href="https://github.com/tottoto"><code>@tottoto</code></a> in <a href="https://redirect.github.com/hyperium/hyper/pull/4189">hyperium/hyper#4189</a></li> <li>style(lib): address ignored_unit_patterns lint by <a href="https://github.com/nakaryo716"><code>@nakaryo716</code></a> in <a href="https://redirect.github.com/hyperium/hyper/pull/4193">hyperium/hyper#4193</a></li> <li>Preserve hop-by-hop when setting close or keep-alive by <a href="https://github.com/dtolnay"><code>@dtolnay</code></a> in <a href="https://redirect.github.com/hyperium/hyper/pull/4196">hyperium/hyper#4196</a></li> <li>fix(http2): do not reserve capacity for idle Upgraded streams by <a href="https://github.com/Dev-next-gen"><code>@Dev-next-gen</code></a> in <a href="https://redirect.github.com/hyperium/hyper/pull/4198">hyperium/hyper#4198</a></li> <li>style(lib): Address clippy panics and missing_panics_doc lints by <a href="https://github.com/Siech0"><code>@Siech0</code></a> in <a href="https://redirect.github.com/hyperium/hyper/pull/4191">hyperium/hyper#4191</a></li> <li>docs: fix typos in capi README, MSRV and governance docs by <a href="https://github.com/toyeshhm"><code>@toyeshhm</code></a> in <a href="https://redirect.github.com/hyperium/hyper/pull/4204">hyperium/hyper#4204</a></li> <li>style(lib): Address trivial, low quantity clippy lints. by <a href="https://github.com/Siech0"><code>@Siech0</code></a> in <a href="https://redirect.github.com/hyperium/hyper/pull/4190">hyperium/hyper#4190</a></li> <li>chore(clippy): allow clippy lints following 1.99.0 release by <a href="https://github.com/dswij"><code>@dswij</code></a> in <a href="https://redirect.github.com/hyperium/hyper/pull/4219">hyperium/hyper#4219</a></li> <li>style: remove useless_borrows_in_formatting from the clippy allowlist by <a href="https://github.com/ump45nose"><code>@ump45nose</code></a> in <a href="https://redirect.github.com/hyperium/hyper/pull/4220">hyperium/hyper#4220</a></li> <li>style(h1): mark partial Debug impls as non-exhaustive by <a href="https://github.com/badimalex"><code>@badimalex</code></a> in <a href="https://redirect.github.com/hyperium/hyper/pull/4218">hyperium/hyper#4218</a></li> <li>style(lib): Address cast-possible-truncation clippy findings. by <a href="https://github.com/Siech0"><code>@Siech0</code></a> in <a href="https://redirect.github.com/hyperium/hyper/pull/4192">hyperium/hyper#4192</a></li> <li>feat(http1): add max_header_size limit for server and client by <a href="https://github.com/Aditya-9-6"><code>@Aditya-9-6</code></a> in <a href="https://redirect.github.com/hyperium/hyper/pull/4183">hyperium/hyper#4183</a></li> <li>fix(http1): let a Connection close token win over a later keep-alive by <a href="https://github.com/shoemoney"><code>@shoemoney</code></a> in <a href="https://redirect.github.com/hyperium/hyper/pull/4201">hyperium/hyper#4201</a></li> <li>fix(http1): always remove content-length if transfer-encoding is sent by <a href="https://github.com/seanmonstar"><code>@seanmonstar</code></a> in <a href="https://redirect.github.com/hyperium/hyper/pull/4223">hyperium/hyper#4223</a></li> <li>fix(http1): remove invalid content-length if transfer-encoding is auto-added by <a href="https://github.com/seanmonstar"><code>@seanmonstar</code></a> in <a href="https://redirect.github.com/hyperium/hyper/pull/4224">hyperium/hyper#4224</a></li> <li>fix(http1): withdraw a stale want when the client dispatcher takes a request by <a href="https://github.com/shodoco"><code>@shodoco</code></a> in <a href="https://redirect.github.com/hyperium/hyper/pull/4208">hyperium/hyper#4208</a></li> <li>perf(body): skip waking a closed peer when a channel end drops by <a href="https://github.com/0x676e67"><code>@0x676e67</code></a> in <a href="https://redirect.github.com/hyperium/hyper/pull/4225">hyperium/hyper#4225</a></li> <li>Prepare v1.12.0 by <a href="https://github.com/seanmonstar"><code>@seanmonstar</code></a> in <a href="https://redirect.github.com/hyperium/hyper/pull/4226">hyperium/hyper#4226</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/vaibhav8a"><code>@vaibhav8a</code></a> made their first contribution in <a href="https://redirect.github.com/hyperium/hyper/pull/4177">hyperium/hyper#4177</a></li> <li><a href="https://github.com/dox4"><code>@dox4</code></a> made their first contribution in <a href="https://redirect.github.com/hyperium/hyper/pull/4173">hyperium/hyper#4173</a></li> <li><a href="https://github.com/dtolnay"><code>@dtolnay</code></a> made their first contribution in <a href="https://redirect.github.com/hyperium/hyper/pull/4196">hyperium/hyper#4196</a></li> <li><a href="https://github.com/Dev-next-gen"><code>@Dev-next-gen</code></a> made their first contribution in <a href="https://redirect.github.com/hyperium/hyper/pull/4198">hyperium/hyper#4198</a></li> <li><a href="https://github.com/Siech0"><code>@Siech0</code></a> made their first contribution in <a href="https://redirect.github.com/hyperium/hyper/pull/4191">hyperium/hyper#4191</a></li> <li><a href="https://github.com/toyeshhm"><code>@toyeshhm</code></a> made their first contribution in <a href="https://redirect.github.com/hyperium/hyper/pull/4204">hyperium/hyper#4204</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/hyperium/hyper/blob/master/CHANGELOG.md">hyper's changelog</a>.</em></p> <blockquote> <h2>v1.12.0 (2026-10-06)</h2> <h4>Bug Fixes</h4> <ul> <li><strong>http1:</strong> <ul> <li>withdraw a stale want when the client dispatcher takes a request (<a href="https://redirect.github.com/hyperium/hyper/issues/4208">#4208</a>) (<a href="https://github.com/hyperium/hyper/commit/c44f1cc51c2bc45b502031a646d3d54315bd7a16">c44f1cc5</a>)</li> <li>remove content-length if transfer-encoding is auto-added (<a href="https://redirect.github.com/hyperium/hyper/issues/4224">#4224</a>) (<a href="https://github.com/hyperium/hyper/commit/69396fdd960629d69b09cc6c9b367ef8650c001d">69396fdd</a>)</li> <li>always remove content-length if transfer-encoding is sent (<a href="https://redirect.github.com/hyperium/hyper/issues/4223">#4223</a>) (<a href="https://github.com/hyperium/hyper/commit/a5d7fd7861598c0b8c857cb75240a75bcfbd96a3">a5d7fd78</a>)</li> <li>let a Connection close token win over a later keep-alive (<a href="https://redirect.github.com/hyperium/hyper/issues/4201">#4201</a>) (<a href="https://github.com/hyperium/hyper/commit/5dadff76d1cb5d21046218df3568569fbba8ed21">5dadff76</a>)</li> <li>preserve hop-by-hop when setting close or keep-alive (<a href="https://redirect.github.com/hyperium/hyper/issues/4196">#4196</a>) (<a href="https://github.com/hyperium/hyper/commit/74a39081ff1496970fb75da75c5282b23a9b69e5">74a39081</a>)</li> </ul> </li> <li><strong>http2:</strong> do not reserve capacity for idle Upgraded streams (<a href="https://redirect.github.com/hyperium/hyper/issues/4198">#4198</a>) (<a href="https://github.com/hyperium/hyper/commit/e89d0d93d9566210ee95aea234a00952ebc4a202">e89d0d93</a>)</li> </ul> <h4>Features</h4> <ul> <li><strong>http1:</strong> add max_header_size limit for server and client (<a href="https://redirect.github.com/hyperium/hyper/issues/4183">#4183</a>) (<a href="https://github.com/hyperium/hyper/commit/d1cd14eff392be63a2318d690cc9380723ec61a1">d1cd14ef</a>, closes <a href="https://redirect.github.com/hyperium/hyper/issues/3832">#3832</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/hyperium/hyper/commit/7f67699ce32d717081deb7018b4da7d679277ac0"><code>7f67699</code></a> v1.12.0</li> <li><a href="https://github.com/hyperium/hyper/commit/254bf1271bf4385edd743316ca7c508b3c77d6cb"><code>254bf12</code></a> perf(body): skip waking a closed peer when a channel end drops (<a href="https://redirect.github.com/hyperium/hyper/issues/4225">#4225</a>)</li> <li><a href="https://github.com/hyperium/hyper/commit/c44f1cc51c2bc45b502031a646d3d54315bd7a16"><code>c44f1cc</code></a> fix(http1): withdraw a stale want when the client dispatcher takes a request ...</li> <li><a href="https://github.com/hyperium/hyper/commit/69396fdd960629d69b09cc6c9b367ef8650c001d"><code>69396fd</code></a> fix(http1): remove content-length if transfer-encoding is auto-added (<a href="https://redirect.github.com/hyperium/hyper/issues/4224">#4224</a>)</li> <li><a href="https://github.com/hyperium/hyper/commit/a5d7fd7861598c0b8c857cb75240a75bcfbd96a3"><code>a5d7fd7</code></a> fix(http1): always remove content-length if transfer-encoding is sent (<a href="https://redirect.github.com/hyperium/hyper/issues/4223">#4223</a>)</li> <li><a href="https://github.com/hyperium/hyper/commit/5dadff76d1cb5d21046218df3568569fbba8ed21"><code>5dadff7</code></a> fix(http1): let a Connection close token win over a later keep-alive (<a href="https://redirect.github.com/hyperium/hyper/issues/4201">#4201</a>)</li> <li><a href="https://github.com/hyperium/hyper/commit/d1cd14eff392be63a2318d690cc9380723ec61a1"><code>d1cd14e</code></a> feat(http1): add max_header_size limit for server and client (<a href="https://redirect.github.com/hyperium/hyper/issues/4183">#4183</a>)</li> <li><a href="https://github.com/hyperium/hyper/commit/714c7cf46fd405c88eb34c2f243ae5b146ba8f07"><code>714c7cf</code></a> style(lib): address cast-possible-truncation clippy findings (<a href="https://redirect.github.com/hyperium/hyper/issues/4192">#4192</a>)</li> <li><a href="https://github.com/hyperium/hyper/commit/0d474402c20c17939c30aaecde56d1a3e21b2b0a"><code>0d47440</code></a> style(lib): mark partial Debug impls as non-exhaustive (<a href="https://redirect.github.com/hyperium/hyper/issues/4218">#4218</a>)</li> <li><a href="https://github.com/hyperium/hyper/commit/da3b1b197c954ac5454a92562fe3d729a87cba56"><code>da3b1b1</code></a> style(lib): remove useless_borrows_in_formatting from the clippy allowlist (#...</li> <li>Additional commits viewable in <a href="https://github.com/hyperium/hyper/compare/v1.11.1...v1.12.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the github-owned group with 2 updates: [actions/upload-artifact](https://github.com/actions/upload-artifact) and [actions/download-artifact](https://github.com/actions/download-artifact). Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/upload-artifact/releases">actions/upload-artifact's releases</a>.</em></p> <blockquote> <h2>v7.0.2</h2> <h2>What's Changed</h2> <ul> <li>Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.</li> <li>Updates <code>@actions/artifact</code> to v6.3.1.</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/tunc-d"><code>@tunc-d</code></a> made their first contribution in <a href="https://redirect.github.com/actions/upload-artifact/pull/821">actions/upload-artifact#821</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2">https://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/upload-artifact/commit/cf430e030ddbb5b0abf93d22962f4752f3646cd9"><code>cf430e0</code></a> Merge pull request <a href="https://redirect.github.com/actions/upload-artifact/issues/822">#822</a> from actions/tunc-d-prepare-upload-v7-0-2</li> <li><a href="https://github.com/actions/upload-artifact/commit/c2acdedd35a8824a1552c7137f8c18288c3ea469"><code>c2acded</code></a> chore: prepare v7.0.2 release</li> <li><a href="https://github.com/actions/upload-artifact/commit/4687c1bbaa0a58abb517d90b4bbade6754c80c1a"><code>4687c1b</code></a> Merge pull request <a href="https://redirect.github.com/actions/upload-artifact/issues/821">#821</a> from actions/tunc-d-upload-artifact-package-bump</li> <li><a href="https://github.com/actions/upload-artifact/commit/8cbe1bebdb858105d8fdd88f81404d4de4595719"><code>8cbe1be</code></a> Bump <code>@actions/artifact</code> to 6.3.1</li> <li>See full diff in <a href="https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9">compare view</a></li> </ul> </details> <br /> Updates `actions/download-artifact` from 8.0.1 to 8.0.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/download-artifact/releases">actions/download-artifact's releases</a>.</em></p> <blockquote> <h2>v8.0.2</h2> <h2>What's Changed</h2> <ul> <li>Update the readme by <a href="https://github.com/danwkennedy"><code>@danwkennedy</code></a> in <a href="https://redirect.github.com/actions/download-artifact/pull/473">actions/download-artifact#473</a></li> <li>Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.</li> <li>Update <code>@actions/artifact</code> to 6.3.1 by <a href="https://github.com/tunc-d"><code>@tunc-d</code></a> in <a href="https://redirect.github.com/actions/download-artifact/pull/492">actions/download-artifact#492</a></li> <li>Prepare download-artifact v8.0.2 by <a href="https://github.com/tunc-d"><code>@tunc-d</code></a> in <a href="https://redirect.github.com/actions/download-artifact/pull/493">actions/download-artifact#493</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/tunc-d"><code>@tunc-d</code></a> made their first contribution in <a href="https://redirect.github.com/actions/download-artifact/pull/492">actions/download-artifact#492</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2">https://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/download-artifact/commit/9000827ccba6bdab643e8b6fd33ac0654aef8333"><code>9000827</code></a> Merge pull request <a href="https://redirect.github.com/actions/download-artifact/issues/493">#493</a> from actions/tunc-d-prepare-download-v8-0-2</li> <li><a href="https://github.com/actions/download-artifact/commit/e455989ae00f5bdd4054f05d3e972c6bf8a62dc5"><code>e455989</code></a> Prepare download-artifact v8.0.2</li> <li><a href="https://github.com/actions/download-artifact/commit/a00b90c4a2f01d73a8c89552caabca6ea3b43137"><code>a00b90c</code></a> Merge pull request <a href="https://redirect.github.com/actions/download-artifact/issues/492">#492</a> from actions/tunc-d-download-artifact-package-bump</li> <li><a href="https://github.com/actions/download-artifact/commit/29bb7ce6af5345aeab5bb4774ce7249ee3ccc27f"><code>29bb7ce</code></a> Update <code>@actions/artifact</code> to 6.3.1</li> <li><a href="https://github.com/actions/download-artifact/commit/484a0b528fb4d7bd804637ccb632e47a0e638317"><code>484a0b5</code></a> Update the readme (<a href="https://redirect.github.com/actions/download-artifact/issues/473">#473</a>)</li> <li>See full diff in <a href="https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…an issue when the scheduled audit fails (#2036) Closes #2034 The scheduled audit on `main` went red on 2026-10-12 and nothing said so. I fix the cause and the silence. - **RUSTSEC-2024-0449** (`unsafe-libyaml` 0.2.11 unmaintained, via `serde_yaml_ng` 0.10.0, the latest release) is accepted explicitly, with the reason written down, in `deny.toml` and in a new `.cargo/audit.toml`. Both are needed: cargo-deny reads the first, cargo-audit reads the second, and `release.yml` runs `cargo audit --deny warnings` from the root, so an entry only in `deny.toml` would have failed the next release. `tests/audit_ignore_lists.rs` keeps the two lists equal; its parser ignores commented-out lines and reads both forms cargo-deny accepts (table and plain string). Moving off the crate is #2035, which removes both entries. - `audit.yml` runs daily instead of weekly. The schedule audits `main` and then starts a separate run of the same workflow on `develop` (`gh workflow run audit.yml --ref develop`), so each branch is audited in its own context. The scheduled job waits for that run and fails if it does not succeed or never appears, so a develop run cancelled in the queue is reported too. Checking develop out from main's scheduled run would execute develop's tree where every step can write the cache all branches read; CodeQL flagged exactly that on the first version of this pull request, and skipping the cache step did not clear it, because any step there can write the cache. - A new `report` job opens an issue when the scheduled run, for either branch, does not succeed (failure, cancelled or timed out), and when a manual dispatch fails; if the issue is already open it comments instead. The develop run started by the schedule does not report itself, and reporters run one at a time, so one failure gives one issue. `issues: write` is granted to that job only; it checks out nothing, installs nothing, and reads every value from `env`. - `freshness-audit` stays at 15 days for now. Lowering it to 3 here turned it red at once, because the last green scheduled run is 2026-10-05 and today's failed on this advisory. I lower it once the daily runs are green. - `.cargo/audit.toml` joins the paths that run the audit on a pull request. What I ran: - `cargo audit --deny warnings` and `cargo deny check` from the root: exit 0. Removing the id from either file turns its tool red on RUSTSEC-2024-0449 and fails `the_two_ignore_lists_agree_on_advisory_ids`. - The `report` script, extracted from the workflow, against a stub `gh`: it comments on the open issue's number, creates one with the labels when none is open, reports a `cancelled` run and a failed dispatch, and exits 1 when `gh` fails. The dispatch-and-wait step against a stub `gh`: exit 0 when the run appears and passes, 1 when it fails, 1 when it never appears. Commenting out the ignore in `.cargo/audit.toml`, or adding a plain-string id to `deny.toml`, fails the agreement test. - `actionlint` 1.7.12 on the three workflows; `cargo test --locked --all-features --workspace`: 3423 passed, 0 failed; the lint-shell suite as `test-command` runs it: 38/38; `check-merge-group-triggers.py` and `check-caller-with-defaults.py`: clean. None of the audit checks is required, so this changes no required check name. Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com> --------- Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
I bump Cargo.toml, Cargo.lock and debian/changelog to 5.10.19. The release carries hyper 1.12.0 (#2028), the HTTP client podup uses to talk to Podman, and gets #2036 onto main: a schedule runs the workflow from the default branch, so until main has it the daily audit does not run and the weekly one stays red on RUSTSEC-2024-0449. The rest is CI: the merge queue (#2033) and Dependabot bumps for workflow actions and a script dependency (#2029, #2030). Refs #2034 Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com> Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Releases 5.10.19.
I compared this binary with 5.10.18 across 21 live commands on a compose project: same exit codes and output, only timings differ.