Skip to content

Measure the build: feature powerset, dependency budget, coverage (#18 §D5/§E2/§E8) - #28

Merged
YellowSnnowmann merged 12 commits into
tinyhumansai:mainfrom
YellowSnnowmann:ci/18-feature-powerset-budget-and-coverage
Aug 18, 2026
Merged

Measure the build: feature powerset, dependency budget, coverage (#18 §D5/§E2/§E8)#28
YellowSnnowmann merged 12 commits into
tinyhumansai:mainfrom
YellowSnnowmann:ci/18-feature-powerset-budget-and-coverage

Measure the build: feature powerset, dependency budget, coverage

868bd95
Select commit
Loading
Failed to load commit list.
TinySweeper / tinysweeper/security completed Aug 17, 2026 in 0s

3 findings

Reviewed 0 files; 0 findings. 34 files could not be reviewed: .github/workflows/ci.yml, adapters/tinycortex/src/engine/mod.rs, Cargo.toml, adapters/remote/Cargo.toml, adapters/tinycortex/Cargo.toml, api/Cargo.toml, conformance/Cargo.toml, core/Cargo.toml, crates/tinymemory-module/Cargo.toml, .gitignore, adapters/remote/src/lib.rs, adapters/tinycortex/src/lib.rs, api/src/host/config.rs, conformance/src/lib.rs, conformance/src/reference/mod.rs, conformance/src/suite/mod.rs, core/src/store/namespace_store/events.rs, core/src/store/namespace_store/segments.rs, core/src/tree/score/embed/mod.rs, crates/tinymemory-module/src/lib.rs, crates/tinymemory-module/src/provider.rs, crates/tinymemory-module/src/service/mod.rs, examples/basic.rs, scripts/ci/dependency-budget.sh, src/registry/mod.rs, adapters/remote/src/failure_test.rs, adapters/tinycortex/src/engine/test.rs, api/src/host/test_support.rs, conformance/tests/reference_drivers.rs, src/registry/test.rs, tests/capability_negotiation.rs, tests/driver_selection.rs, tests/null_provider.rs, tests/taint_end_to_end.rs. 1 file was not security-reviewed: README.md (prose or tabular data).

Finding Where
medium dtolnay/rust-toolchain is pinned to stable, which is mutable .github/workflows/ci.yml:137
medium Swatinem/rust-cache is pinned to v2, which is mutable .github/workflows/ci.yml:141
medium taiki-e/install-action is pinned to v2, which is mutable .github/workflows/ci.yml:143
![medium](https://img.shields.io/badge/medium-fbca04?style=flat-square) `dtolnay/rust-toolchain` is pinned to `stable`, which is mutable

.github/workflows/ci.yml:137 uncertain

[RULE] unpinned-action

A tag or branch can be repointed by whoever owns dtolnay, and the new code runs with this workflow's secrets. Pin to a full commit SHA and let Dependabot bump it.

![medium](https://img.shields.io/badge/medium-fbca04?style=flat-square) `Swatinem/rust-cache` is pinned to `v2`, which is mutable

.github/workflows/ci.yml:141 uncertain

[RULE] unpinned-action

A tag or branch can be repointed by whoever owns Swatinem, and the new code runs with this workflow's secrets. Pin to a full commit SHA and let Dependabot bump it.

![medium](https://img.shields.io/badge/medium-fbca04?style=flat-square) `taiki-e/install-action` is pinned to `v2`, which is mutable

.github/workflows/ci.yml:143 uncertain

[RULE] unpinned-action

A tag or branch can be repointed by whoever owns taiki-e, and the new code runs with this workflow's secrets. Pin to a full commit SHA and let Dependabot bump it.

tinysweeper 0.1.0