chore(ci): pin rust-cache to the v2.9.2 release, not a branch head - #353
Merged
Conversation
Dependabot's #350 wanted to move this pin to 258712b0, an untagged commit on master three commits past the newest release, while leaving the comment reading "# v2". Pinning by SHA is only worth doing if the SHA is something you can look up, so this pins the actual v2.9.2 release commit instead and names it in the comment. v2.9.2 -> 6323deb102c322ba6fcbdcafc7e3dddab59af2b6 (2026-08-06) v2 tag -> 6323deb102c322ba6fcbdcafc7e3dddab59af2b6 (same commit) #350 -> 258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 (untagged) The pin being replaced, e18b4977 from 2026-03-12, was untagged too, so this is not a regression dependabot introduced. It is the same pattern, five months on, and worth breaking now that we have looked at it. Closes #350. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces #350.
Why not just merge #350
Dependabot proposed moving the
Swatinem/rust-cachepin to258712b0. I checked that SHA against the GitHub API and no tag points at it. It is an untagged commit onmaster, dated 2026-08-12, three commits past the newest release, and the workflow comment would still have read# v2whilev2actually resolves to a different commit.SHA-pinning is worth the noise only when the SHA is something a reviewer can look up. Pinning an unreleased branch head labelled as a major version gives up that property.
To be fair to dependabot: the pin being replaced,
e18b4977from 2026-03-12, is untagged as well. This is not a regression it introduced, it is the same pattern five months on, and worth breaking now that we have looked at it.What this does
Pins all three usages in
.github/workflows/rust.ymlto the real release commit and names the version in the comment:v2.9.2is the latest release as of today, and thev2moving tag agrees with it.The one commit #350 would have picked up over
v2.9.2is "fix: stop cleanup timestamp pruning after the first entry (#377)", a cache-pruning fix. Nothing we depend on. It will arrive here the next time upstream cuts a release.Verification
Every SHA in this PR was resolved through the GitHub API rather than trusted from a comment:
CI exercises the change directly: all three cargo jobs use this action.
Closes #350.
🤖 Generated with Claude Code