Repository navigation
bump!: 🚀 upgrades available - #1614
Closed
hedgehog-dataplane-update[bot] wants to merge 22 commits into
Closed
hedgehog-dataplane-update[bot] wants to merge 22 commits into
hedgehog-dataplane-update[bot] wants to merge 22 commits into
Conversation
hedgehog-dataplane-update
Bot
added
automated
ci:+cross/full
dependencies
hedgehog-dataplane-update
Bot
added
the
dependencies
hedgehog-dataplane-update
Bot
requested review from
qmonnet
and removed request for
a team
July 1, 2026 21:39
daniel-noland
force-pushed
the
pr/daniel-noland/ci-security
branch
from
July 1, 2026 22:00
9556579 to
313bca6
Compare
hedgehog-dataplane-update
Bot
force-pushed
the
bump/cargo-upgrades
branch
3 times, most recently
from
July 1, 2026 22:43
2bd059a to
73f46cb
Compare
hedgehog-dataplane-update
Bot
changed the title
daniel-noland
force-pushed
the
pr/daniel-noland/ci-security
branch
from
July 1, 2026 23:19
462b9d5 to
22c1a70
Compare
hedgehog-dataplane-update
Bot
force-pushed
the
bump/cargo-upgrades
branch
from
July 1, 2026 23:19
73f46cb to
a47e593
Compare
hedgehog-dataplane-update
Bot
force-pushed
the
bump/cargo-upgrades
branch
from
July 1, 2026 23:24
a47e593 to
c1e5831
Compare
daniel-noland
force-pushed
the
pr/daniel-noland/ci-security
branch
from
July 1, 2026 23:26
22c1a70 to
f94f266
Compare
hedgehog-dataplane-update
Bot
force-pushed
the
bump/cargo-upgrades
branch
from
July 1, 2026 23:42
c1e5831 to
411e4ba
Compare
daniel-noland
force-pushed
the
pr/daniel-noland/ci-security
branch
from
July 2, 2026 00:47
f94f266 to
9fd2c20
Compare
hedgehog-dataplane-update
Bot
force-pushed
the
bump/cargo-upgrades
branch
from
July 2, 2026 01:12
411e4ba to
1b0d7eb
Compare
hedgehog-dataplane-update
Bot
force-pushed
the
bump/cargo-upgrades
branch
2 times, most recently
from
July 7, 2026 09:49
e9fb568 to
134bf49
Compare
daniel-noland
force-pushed
the
pr/daniel-noland/ci-security
branch
3 times, most recently
from
July 7, 2026 18:12
9107f5b to
683ca78
Compare
hedgehog-dataplane-update
Bot
force-pushed
the
bump/cargo-upgrades
branch
from
July 7, 2026 18:16
134bf49 to
75f6975
Compare
daniel-noland
force-pushed
the
pr/daniel-noland/ci-security
branch
from
July 7, 2026 18:32
f5565d2 to
873c90f
Compare
hedgehog-dataplane-update
Bot
force-pushed
the
bump/cargo-upgrades
branch
from
July 7, 2026 18:37
75f6975 to
92ab532
Compare
Pin every third-party `uses:` reference (marketplace actions and composite actions) to a specific commit SHA, with the resolved tag kept as a trailing comment for readability. Managed going forward via `pinact run` (config in .pinact.yaml). The one exception is the cross-repo reusable workflow `githedgehog/fabricator/.github/workflows/run-vlab.yaml`: we control that workflow and pinning it is not desired. It floats intentionally and should pose no meaningful security issue. .pinact.yaml also sets a 10-day `min_age` so `pinact run` never adopts an action release less than 10 days old. Also adds `pinact` to the nix devshell so it can be run locally. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Trim GITHUB_TOKEN permissions to what each job actually consumes, traced through the composite actions and justfile recipes: - bump.yml / version-bump.yml: the blanket contents/id-token/ pull-requests grants had no consumer -- the actual git push and PR creation go through a separately-minted, already-scoped GitHub App token, not GITHUB_TOKEN. Reduced to `contents: read` (needed for checkout on this private repo). - dev.yml: same story for the shared `check-perms` block (check, sanitize, test_each, concurrency, miri, wasm, cross) -- none of those jobs build or push containers, so checks/pull-requests/ packages/id-token were dead weight. `build` and `publish` keep `packages: write` since they push images via `just push-container`. `check_changes` keeps `pull-requests: read` for dorny/paths-filter's API-based file-list lookup on PR events. Also scope the three `create-github-app-token` steps (bump.yml, dev.yml, version-bump.yml) to `permission-contents`/ `permission-pull-requests` instead of inheriting the full GitHub App installation's permissions, and set `persist-credentials: false` on checkout steps that never push with the default token (bump.yml, dev.yml, fossa.yml, lint-validate-dependabot.yml), plus add zizmor to the nix devshell used to audit this. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Daniel Noland <daniel@githedgehog.com>
- Name the previously-anonymous cargo-upgrades, version, publish, commitlint, and validate jobs (zizmor anonymous-definition). - Add a concurrency group to mergeability.yml and lint-validate-dependabot.yml (zizmor concurrency-limits); the former falls back to github.run_id for merge_group events so an in-progress merge-queue check is never cancelled. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Give each linter its own just recipe (clippy, opengrep, pinact, zizmor) instead of burying cargo clippy alone in `lint`, then compose them in the justfile. This gives local parity with the individual CI lint jobs and a single place to tune each tool's flags. dev.yml's `check` job now calls the `clippy` recipe directly (it already ran individual recipes like fmt/test/doctest rather than the aggregate `lint`; this keeps that step's naming honest). lint-opengrep.yml now delegates to `just opengrep` instead of duplicating the scan invocation inline. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Fold actionlint, cargo-fmt's sibling checks, license-headers, opengrep, pinact, and zizmor into one non-matrixed `lint` job in dev.yml instead of six independent lint-*.yml workflows, each of which paid for its own nix-shell/cachix pull. One job now means one pull per PR instead of six. check-dependencies moves here too, off of the check job's debug/release matrix and out of build's inline step list. `build` (and therefore `publish`, which pushes to our container registry) now depends on the whole `lint` job via `needs:`, so a check-dependencies failure still blocks a container push. Adds .github/zizmor.yml carrying an unpinned-uses `ref-pin` policy for the fabricator run-vlab reusable workflow, so zizmor accepts its `@master` ref pin (which pinact can't SHA-pin; see the pinning commit). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Add a commitlint check to the same job, gated by a config (.commitlintrc.yaml) that mirrors the type list and header-length intent of the existing lint-commitlint.yml action. The main goal here is to let us run the commitlint action locally. Note ---- commitlint-rs's `--from`/`--to` flags are unusable in any non-interactive shell, CI included: its arg-handling checks stdin before checking --from/--to, and stdin is never a TTY there, so it silently lints empty/stray stdin content instead of the requested commit range. Worked around by feeding each commit's message to commitlint individually over stdin instead, which is the one invocation mode that actually works. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Steps in a job run sequentially and stop at the first failure, so as written, a fmt failure would hide whatever clippy/opengrep/zizmor/ pinact/actionlint/license-headers would have said -- a step backwards from the six independent jobs this replaced, which all ran in parallel and reported together. Mark each check `continue-on-error` and add a final step that checks every step's outcome and fails the job if any of them didn't succeed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Extract the dependency-bump logic that lived inline in bump.yml into just recipes so it can be run and tested locally: - `bump-cargo-deps` runs `cargo update` plus per-package `cargo upgrade`, committing each bump separately, and (in CI) emits the PR-body summary via GITHUB_OUTPUT. It uses mktemp scratch files and guards the GITHUB_* writes so it is safe to run outside Actions. - `bump-actions` runs `pinact run --update` to refresh pinned action SHAs; available for manual/local use. bump.yml now calls `just bump-cargo-deps` and drives check-dependencies through the shared `just` composite action instead of duplicating the recipe bodies inline. It also switches the app-token input from the deprecated `app-id` to `client-id` and adds the `ci:+vlab` label to generated PRs. Also bumps the dependabot cooldown from 7 to 10 days to match the pinact `min_age`, so automated dependency PRs wait the same window before adopting a fresh release. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Daniel Noland <daniel@githedgehog.com>
The cross compile job isn't run that frequently, but when failures happen it is very annoying to debug because the max-parallel setting of 1 makes failures take a long time. Increasing to 2 is very helpful here and doesn't tax CI too much. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>
name old req compatible latest new req ==== ======= ========== ====== ======= crossbeam-utils 0.8.21 0.8.22 0.8.22 0.8.22 Signed-off-by: Daniel Noland <daniel@githedgehog.com>
name old req compatible latest new req ==== ======= ========== ====== ======= inotify 0.11.2 0.11.3 0.11.3 0.11.3 Signed-off-by: Daniel Noland <daniel@githedgehog.com>
name old req compatible latest new req ==== ======= ========== ====== ======= reedline 0.48.0 0.48.0 0.49.0 0.49.0 Signed-off-by: Daniel Noland <daniel@githedgehog.com>
We handle this via the commitlint-rs binary now. Signed-off-by: Daniel Noland <daniel@githedgehog.com>
These seetings seem to have been removed upstream. Signed-off-by: Daniel Noland <daniel@githedgehog.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>
name old req compatible latest new req ==== ======= ========== ====== ======= pyroscope 2.0.6 2.1.0 2.1.0 2.1.0 Signed-off-by: Daniel Noland <daniel@githedgehog.com>
The linker seems to be driving our CI out of memory on the fuzz profile. We can increase the number of codegen units and reduce the optimization level a bit to help address this. Signed-off-by: Daniel Noland <daniel@githedgehog.com>
This reduces memory load by increasing codegen-units over release mode. The memory requirement or release builds are causing CI failures unfortunately. Signed-off-by: Daniel Noland <daniel@githedgehog.com>
The lto jobs are running our github actions runners out of memory. Need to reduce max parallelism to account for that. Signed-off-by: Daniel Noland <daniel@githedgehog.com>
An error occurred while trying to automatically change base from
pr/daniel-noland/ci-security
to
main
July 7, 2026 21:29
An error occurred while trying to automatically change base from
pr/daniel-noland/ci-security
to
main
July 8, 2026 08:09
Signed-off-by: github-actions[bot] <224724778+hedgehog-dataplane-update[bot]@users.noreply.github.com>
Signed-off-by: github-actions[bot] <224724778+hedgehog-dataplane-update[bot]@users.noreply.github.com>
hedgehog-dataplane-update
Bot
force-pushed
the
bump/cargo-upgrades
branch
from
July 8, 2026 08:14
92ab532 to
de0c96a
Compare
Member
|
@daniel-noland Is this PR still relevant? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.