From 3e57cbf94161a06e5f42245a6fd814022871e80d Mon Sep 17 00:00:00 2001 From: Peter Tripp Date: Thu, 3 Sep 2026 11:57:28 -0400 Subject: [PATCH 1/6] ci: GitHub Actions workflow improvements --- .github/workflows/rust.yml | 39 +++++++++++---------- .github/workflows/validate-openapi-spec.yml | 8 +++-- 2 files changed, 27 insertions(+), 20 deletions(-) diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index 6b80dd575..f77d145e2 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -9,6 +9,9 @@ on: pull_request: branches: [main] +permissions: + contents: read + env: CARGO_TERM_COLOR: always RUST_BACKTRACE: 1 @@ -17,7 +20,7 @@ jobs: check-style: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Report cargo version run: cargo --version - name: Report rustfmt version @@ -28,12 +31,12 @@ jobs: clippy-lint: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Report cargo version run: cargo --version - name: Report Clippy version run: cargo clippy -- --version - - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: cache-bin: false # See Swatinem/rust-cache#341. - name: Run Clippy Lints @@ -42,10 +45,10 @@ jobs: check-docs: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Report cargo version run: cargo --version - - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: cache-bin: false # See Swatinem/rust-cache#341. - name: Check Docs @@ -54,9 +57,9 @@ jobs: build-and-test: runs-on: ${{ matrix.os }} env: - # rust-toolchain.toml overrides the dtolnay/rust-toolchain selection -- - # set this environment variable, which overrides rust-toolchain.toml. + # override rustup using toolchain specified in rust-toolchain.toml RUSTUP_TOOLCHAIN: ${{ matrix.toolchain }} + CARGO_INCREMENTAL: 0 strategy: matrix: # macos-14 for M1 runners @@ -72,15 +75,15 @@ jobs: # Keep this in sync with rust-version in Cargo.toml. toolchain: "1.88" steps: - - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 - - uses: dtolnay/rust-toolchain@v1 - with: - toolchain: ${{ matrix.toolchain }} + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - name: Install Rust toolchain + shell: bash + run: rustup toolchain install ${{ matrix.toolchain }} --profile minimal --no-self-update - name: Report cargo version run: cargo --version - name: Report rustc version run: rustc --version - - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: # Matrix instances other than OS need to be added to this explicitly key: ${{ matrix.features }} @@ -93,17 +96,17 @@ jobs: trybuild: runs-on: ubuntu-24.04 + env: + CARGO_INCREMENTAL: 0 steps: - - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 - # rust-toolchain.toml overrides dtolnay/rust-toolchain@stable, so in some - # sense using it is pointless. But it does a few other useful things such - # as disable incremental compilation, so we use it anyway. - - uses: dtolnay/rust-toolchain@stable + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + # Deliberately no RUSTUP_TOOLCHAIN here, uses rust-toolchain.toml to pin version. + # trybuild fixtures assert exact rustc diagnostics in committed .stderr files. - name: Report cargo version run: cargo --version - name: Report rustc version run: rustc --version - - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: cache-bin: false # See Swatinem/rust-cache#341. - name: Run trybuild tests diff --git a/.github/workflows/validate-openapi-spec.yml b/.github/workflows/validate-openapi-spec.yml index 7f7e75951..349e68773 100644 --- a/.github/workflows/validate-openapi-spec.yml +++ b/.github/workflows/validate-openapi-spec.yml @@ -7,12 +7,16 @@ on: - dropshot/tests/test_openapi_fuller.json workflow_dispatch: inputs: + +permissions: + contents: read + jobs: format: runs-on: ubuntu-latest steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - - uses: actions/setup-node@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '24' - name: Install our tools From d6d135c06f71ee0dc9698651e0c1a9be03caa4ff Mon Sep 17 00:00:00 2001 From: Peter Tripp Date: Tue, 1 Sep 2026 13:00:17 -0400 Subject: [PATCH 2/6] Switch back to dtolnay/rust-toolchain --- .github/workflows/rust.yml | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index f77d145e2..e5f154592 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -57,9 +57,9 @@ jobs: build-and-test: runs-on: ${{ matrix.os }} env: - # override rustup using toolchain specified in rust-toolchain.toml + # rust-toolchain.toml overrides the dtolnay/rust-toolchain selection -- + # set this environment variable, which overrides rust-toolchain.toml. RUSTUP_TOOLCHAIN: ${{ matrix.toolchain }} - CARGO_INCREMENTAL: 0 strategy: matrix: # macos-14 for M1 runners @@ -75,10 +75,10 @@ jobs: # Keep this in sync with rust-version in Cargo.toml. toolchain: "1.88" steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - name: Install Rust toolchain - shell: bash - run: rustup toolchain install ${{ matrix.toolchain }} --profile minimal --no-self-update + - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 + - uses: dtolnay/rust-toolchain@v1 + with: + toolchain: ${{ matrix.toolchain }} - name: Report cargo version run: cargo --version - name: Report rustc version @@ -96,12 +96,12 @@ jobs: trybuild: runs-on: ubuntu-24.04 - env: - CARGO_INCREMENTAL: 0 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - # Deliberately no RUSTUP_TOOLCHAIN here, uses rust-toolchain.toml to pin version. - # trybuild fixtures assert exact rustc diagnostics in committed .stderr files. + - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 + # rust-toolchain.toml overrides dtolnay/rust-toolchain@stable, so in some + # sense using it is pointless. But it does a few other useful things such + # as disable incremental compilation, so we use it anyway. + - uses: dtolnay/rust-toolchain@stable - name: Report cargo version run: cargo --version - name: Report rustc version From 02435691116a3501a681586528b60fda48881b9c Mon Sep 17 00:00:00 2001 From: Peter Tripp Date: Tue, 1 Sep 2026 13:00:17 -0400 Subject: [PATCH 3/6] All commits --- .github/workflows/rust.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index e5f154592..2d5a1dd9b 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -75,8 +75,8 @@ jobs: # Keep this in sync with rust-version in Cargo.toml. toolchain: "1.88" steps: - - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 - - uses: dtolnay/rust-toolchain@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1 with: toolchain: ${{ matrix.toolchain }} - name: Report cargo version @@ -97,11 +97,11 @@ jobs: trybuild: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # rust-toolchain.toml overrides dtolnay/rust-toolchain@stable, so in some # sense using it is pointless. But it does a few other useful things such # as disable incremental compilation, so we use it anyway. - - uses: dtolnay/rust-toolchain@stable + - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1 - name: Report cargo version run: cargo --version - name: Report rustc version From c68f34e1bf538664cf6d131a98b008eecda20891 Mon Sep 17 00:00:00 2001 From: Peter Tripp Date: Fri, 4 Sep 2026 10:15:46 -0400 Subject: [PATCH 4/6] Drop dtolnay/rust-toolchain again --- .github/workflows/rust.yml | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index 2d5a1dd9b..d9bca81f4 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -13,6 +13,7 @@ permissions: contents: read env: + CARGO_INCREMENTAL: 0 CARGO_TERM_COLOR: always RUST_BACKTRACE: 1 @@ -57,8 +58,8 @@ jobs: build-and-test: runs-on: ${{ matrix.os }} env: - # rust-toolchain.toml overrides the dtolnay/rust-toolchain selection -- - # set this environment variable, which overrides rust-toolchain.toml. + # Override rust-toolchain.toml, which otherwise takes precedence over the + # toolchain installed below. RUSTUP_TOOLCHAIN: ${{ matrix.toolchain }} strategy: matrix: @@ -76,9 +77,9 @@ jobs: toolchain: "1.88" steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1 - with: - toolchain: ${{ matrix.toolchain }} + - name: Install Rust toolchain + shell: bash + run: rustup toolchain install ${{ matrix.toolchain }} --profile minimal --no-self-update - name: Report cargo version run: cargo --version - name: Report rustc version @@ -98,10 +99,13 @@ jobs: runs-on: ubuntu-24.04 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - # rust-toolchain.toml overrides dtolnay/rust-toolchain@stable, so in some - # sense using it is pointless. But it does a few other useful things such - # as disable incremental compilation, so we use it anyway. - - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1 + # Deliberately no RUSTUP_TOOLCHAIN here: the toolchain is pinned by + # rust-toolchain.toml, since the trybuild fixtures assert exact rustc + # diagnostics against committed .stderr files. `rustup toolchain install` + # with no argument installs the toolchain named by that file; `rustup + # show` no longer installs it implicitly as of rustup 1.28. + - name: Install Rust toolchain from rust-toolchain.toml + run: rustup show active-toolchain || rustup toolchain install - name: Report cargo version run: cargo --version - name: Report rustc version From 5be368741797be9f9ce2227de3cdf23489247b37 Mon Sep 17 00:00:00 2001 From: Peter Tripp Date: Fri, 4 Sep 2026 10:19:07 -0400 Subject: [PATCH 5/6] Less toolchain trivia --- .github/workflows/rust.yml | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index d9bca81f4..07f4fd193 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -101,11 +101,9 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # Deliberately no RUSTUP_TOOLCHAIN here: the toolchain is pinned by # rust-toolchain.toml, since the trybuild fixtures assert exact rustc - # diagnostics against committed .stderr files. `rustup toolchain install` - # with no argument installs the toolchain named by that file; `rustup - # show` no longer installs it implicitly as of rustup 1.28. + # diagnostics against committed .stderr files. - name: Install Rust toolchain from rust-toolchain.toml - run: rustup show active-toolchain || rustup toolchain install + run: rustup toolchain install - name: Report cargo version run: cargo --version - name: Report rustc version From 252cf11e0216681b0678375370a40aab3dd78cff Mon Sep 17 00:00:00 2001 From: Peter Tripp Date: Tue, 1 Sep 2026 13:00:17 -0400 Subject: [PATCH 6/6] Better comments --- .github/workflows/rust.yml | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index 07f4fd193..81ff06e81 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -58,8 +58,7 @@ jobs: build-and-test: runs-on: ${{ matrix.os }} env: - # Override rust-toolchain.toml, which otherwise takes precedence over the - # toolchain installed below. + # Override rust-toolchain.toml using explicit RUSTUP_TOOLCHAIN RUSTUP_TOOLCHAIN: ${{ matrix.toolchain }} strategy: matrix: @@ -99,9 +98,8 @@ jobs: runs-on: ubuntu-24.04 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - # Deliberately no RUSTUP_TOOLCHAIN here: the toolchain is pinned by - # rust-toolchain.toml, since the trybuild fixtures assert exact rustc - # diagnostics against committed .stderr files. + # toolchain is pinned by rust-toolchain.toml which is required as the trybuild + # fixtures assert exact rustc diagnostics against committed .stderr files. - name: Install Rust toolchain from rust-toolchain.toml run: rustup toolchain install - name: Report cargo version