From 8556d64afabc724ab9c4772cd9375a54e6f85393 Mon Sep 17 00:00:00 2001 From: Dan Fiedler Date: Wed, 12 Aug 2026 14:41:24 -0400 Subject: [PATCH 1/3] Pin GitHub Actions to full-length commit SHAs --- .github/dependabot.yml | 2 ++ .github/workflows/benchmark.yml | 4 ++-- .github/workflows/ci.yml | 22 +++++++++++----------- .github/workflows/cross-platform.yml | 2 +- .github/workflows/fuzz.yml | 10 +++++----- .github/workflows/release.yml | 8 ++++---- 6 files changed, 25 insertions(+), 23 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index f602321..354975d 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -36,3 +36,5 @@ updates: update-types: - "minor" - "patch" + cooldown: + default-days: 7 diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml index 0b764cd..a7648da 100644 --- a/.github/workflows/benchmark.yml +++ b/.github/workflows/benchmark.yml @@ -28,7 +28,7 @@ jobs: deployments: write steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust uses: actions-rust-lang/setup-rust-toolchain@v2 @@ -39,7 +39,7 @@ jobs: run: cargo bench --bench bench_main --all-features -- --output-format bencher | tee output.txt - name: Store benchmark result - uses: benchmark-action/github-action-benchmark@v1 + uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1.22.1 with: name: RulesXP Benchmark tool: 'cargo' diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3563e82..09e6dcf 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -40,7 +40,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Resolve toolchain id: resolve @@ -87,7 +87,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust uses: actions-rust-lang/setup-rust-toolchain@v2 @@ -105,7 +105,7 @@ jobs: cargo llvm-cov --all-features --workspace --lcov --output-path lcov.info --no-run - name: Upload coverage HTML - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: coverage-report path: coverage-html/ @@ -113,7 +113,7 @@ jobs: - name: Upload to Codecov if: env.CODECOV_TOKEN != '' - uses: codecov/codecov-action@v7 + uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 with: files: lcov.info fail_ci_if_error: true @@ -127,7 +127,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust uses: actions-rust-lang/setup-rust-toolchain@v2 @@ -146,7 +146,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust uses: actions-rust-lang/setup-rust-toolchain@v2 @@ -163,7 +163,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust nightly uses: actions-rust-lang/setup-rust-toolchain@v2 @@ -183,10 +183,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install cargo-audit - uses: taiki-e/install-action@v2 + uses: taiki-e/install-action@b20dedce73af6905cdc30d6611090c9b67557c8d # v2.85.12 with: tool: cargo-audit @@ -200,7 +200,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust nightly uses: actions-rust-lang/setup-rust-toolchain@v2 @@ -208,7 +208,7 @@ jobs: toolchain: nightly - name: Install cargo-hack and cargo-minimal-versions - uses: taiki-e/install-action@v2 + uses: taiki-e/install-action@b20dedce73af6905cdc30d6611090c9b67557c8d # v2.85.12 with: tool: cargo-hack,cargo-minimal-versions diff --git a/.github/workflows/cross-platform.yml b/.github/workflows/cross-platform.yml index 6c195e5..dcbc598 100644 --- a/.github/workflows/cross-platform.yml +++ b/.github/workflows/cross-platform.yml @@ -32,7 +32,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust uses: actions-rust-lang/setup-rust-toolchain@v2 diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index 4968fe7..c15fdc2 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -35,7 +35,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust nightly uses: actions-rust-lang/setup-rust-toolchain@v2 @@ -50,7 +50,7 @@ jobs: # - Restore key uses prefix match to find the most recent cache from any prior run # - Daily runs ensure we always have a recent corpus to build on - name: Restore corpus cache - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: fuzz/corpus/${{ matrix.target }} key: fuzz-corpus-${{ matrix.target }}-${{ github.run_id }} @@ -75,14 +75,14 @@ jobs: - name: Upload crash artifacts if: steps.check_crashes.outputs.crashes_found == 'true' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fuzz-crashes-${{ matrix.target }} path: fuzz/artifacts/${{ matrix.target }}/ - name: Upload corpus if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fuzz-corpus-${{ matrix.target }} path: fuzz/corpus/${{ matrix.target }}/ @@ -90,7 +90,7 @@ jobs: - name: Create issue for crashes if: steps.check_crashes.outputs.crashes_found == 'true' - uses: actions/github-script@v9 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | const fs = require('fs'); diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d54bfb4..7697d1e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -24,7 +24,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # The ancestry check needs enough history to prove the tag commit # is reachable from origin/main. @@ -58,7 +58,7 @@ jobs: echo "Version check passed: $CARGO_VERSION" - name: Authenticate with crates.io - uses: rust-lang/crates-io-auth-action@v1 + uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5 id: auth - name: Publish to crates.io @@ -80,7 +80,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Get tag name id: tag_name @@ -120,7 +120,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust uses: actions-rust-lang/setup-rust-toolchain@v2 From e3c5e602a7f808f9fd881b4e4c172d7e816344b8 Mon Sep 17 00:00:00 2001 From: Eugene Talagrand Date: Mon, 14 Sep 2026 16:57:55 -0700 Subject: [PATCH 2/3] ci: SHA-pin remaining GH actions and update to latest --- .github/workflows/benchmark.yml | 2 +- .github/workflows/ci.yml | 26 +++++++++++++------------- .github/workflows/cross-platform.yml | 2 +- .github/workflows/fuzz.yml | 2 +- .github/workflows/release.yml | 4 ++-- CHANGELOG.md | 2 +- 6 files changed, 19 insertions(+), 19 deletions(-) diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml index a7648da..6eee6d1 100644 --- a/.github/workflows/benchmark.yml +++ b/.github/workflows/benchmark.yml @@ -31,7 +31,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust - uses: actions-rust-lang/setup-rust-toolchain@v2 + uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0 - name: Run benchmark # We use --output-format bencher to make the output compatible with the diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 09e6dcf..e54a8a7 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -59,7 +59,7 @@ jobs: fi - name: Install Rust - uses: actions-rust-lang/setup-rust-toolchain@v2 + uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0 with: toolchain: ${{ steps.resolve.outputs.toolchain }} components: ${{ steps.resolve.outputs.should-run-full-checks == 'true' && 'clippy' || '' }} @@ -90,12 +90,12 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust - uses: actions-rust-lang/setup-rust-toolchain@v2 + uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0 with: components: llvm-tools-preview - name: Install cargo-llvm-cov - uses: taiki-e/install-action@v2 + uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375 # v2.87.12 with: tool: cargo-llvm-cov @@ -130,7 +130,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust - uses: actions-rust-lang/setup-rust-toolchain@v2 + uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0 with: components: rustfmt @@ -149,7 +149,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust - uses: actions-rust-lang/setup-rust-toolchain@v2 + uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0 - name: Build documentation run: cargo doc --all-features --no-deps @@ -166,7 +166,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust nightly - uses: actions-rust-lang/setup-rust-toolchain@v2 + uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0 with: toolchain: nightly @@ -186,7 +186,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install cargo-audit - uses: taiki-e/install-action@b20dedce73af6905cdc30d6611090c9b67557c8d # v2.85.12 + uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375 # v2.87.12 with: tool: cargo-audit @@ -203,12 +203,12 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust nightly - uses: actions-rust-lang/setup-rust-toolchain@v2 + uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0 with: toolchain: nightly - name: Install cargo-hack and cargo-minimal-versions - uses: taiki-e/install-action@b20dedce73af6905cdc30d6611090c9b67557c8d # v2.85.12 + uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375 # v2.87.12 with: tool: cargo-hack,cargo-minimal-versions @@ -222,10 +222,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install typos - uses: taiki-e/install-action@v2 + uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375 # v2.87.12 with: tool: typos-cli @@ -239,10 +239,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Run actionlint - uses: raven-actions/actionlint@v2 + uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0 ci-success: name: CI Success diff --git a/.github/workflows/cross-platform.yml b/.github/workflows/cross-platform.yml index dcbc598..979c180 100644 --- a/.github/workflows/cross-platform.yml +++ b/.github/workflows/cross-platform.yml @@ -35,7 +35,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust - uses: actions-rust-lang/setup-rust-toolchain@v2 + uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0 - name: Run tests run: cargo test --all-features --verbose diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index c15fdc2..50e2e63 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -38,7 +38,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust nightly - uses: actions-rust-lang/setup-rust-toolchain@v2 + uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0 with: toolchain: nightly diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7697d1e..4f131a8 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -40,7 +40,7 @@ jobs: fi - name: Install Rust - uses: actions-rust-lang/setup-rust-toolchain@v2 + uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0 with: toolchain: stable rustflags: '' @@ -123,7 +123,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust - uses: actions-rust-lang/setup-rust-toolchain@v2 + uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0 with: toolchain: stable target: ${{ matrix.target }} diff --git a/CHANGELOG.md b/CHANGELOG.md index e26c6bc..0f32293 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,7 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Changed - CI enforces production-code-only MSRV, stricter doc and workflow checks, least-privilege permissions & job timeouts -- Release flow uses SHA-pinning-friendly Rust installation, locked publication, pre-publish tag validation, and retry-safe GH releases +- CI uses SHA-pinned actions, locked publication, pre-publish tag validation, and retry-safe GH releases ## 0.3.1 From dd5adb7c4b5537a48e71c96b8b54982d3ff8b90c Mon Sep 17 00:00:00 2001 From: Eugene Talagrand Date: Mon, 14 Sep 2026 17:08:58 -0700 Subject: [PATCH 3/3] ci: Adapt to setup-rust-toolchain v2 behavioral changes (warnings and caches) --- .github/workflows/benchmark.yml | 2 ++ .github/workflows/fuzz.yml | 2 +- fuzz/Cargo.toml | 4 ++-- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml index 6eee6d1..bc8a5f2 100644 --- a/.github/workflows/benchmark.yml +++ b/.github/workflows/benchmark.yml @@ -36,6 +36,8 @@ jobs: - name: Run benchmark # We use --output-format bencher to make the output compatible with the # github-action-benchmark action's 'cargo' tool parser. + env: + CRITERION_HOME: ${{ runner.temp }}/criterion run: cargo bench --bench bench_main --all-features -- --output-format bencher | tee output.txt - name: Store benchmark result diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index 50e2e63..eb07440 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -31,7 +31,7 @@ jobs: strategy: fail-fast: false matrix: - target: ['eval_sexpr', 'eval_jsonlogic'] + target: ['eval-sexpr', 'eval-jsonlogic'] steps: - name: Checkout code diff --git a/fuzz/Cargo.toml b/fuzz/Cargo.toml index 70c826c..616c54b 100644 --- a/fuzz/Cargo.toml +++ b/fuzz/Cargo.toml @@ -14,14 +14,14 @@ path = ".." features = ["scheme", "jsonlogic"] [[bin]] -name = "eval_sexpr" +name = "eval-sexpr" path = "fuzz_targets/eval_sexpr.rs" test = false doc = false bench = false [[bin]] -name = "eval_jsonlogic" +name = "eval-jsonlogic" path = "fuzz_targets/eval_jsonlogic.rs" test = false doc = false