From 59e6aadb7203c40573e31032d32d33d39ccec8a3 Mon Sep 17 00:00:00 2001
From: leynos <leynos@rohga>
Date: Wed, 8 Jul 2026 12:54:37 +0200
Subject: [PATCH 1/2] Adopt the Whitaker Dylint suite in the lint gate and CI

Harden the lint target so the Whitaker Dylint suite is a mandatory
part of `make lint` rather than a soft, skip-if-absent extra. The
recipe now uses a `WHITAKER ?= whitaker` tool variable alongside the
other tool variables and reuses the existing `RUST_FLAGS` and
`CARGO_FLAGS` conventions, so warnings are denied across all targets
and features.

Wire the suite into CI before the lint step: cache the pinned
`whitaker-installer` binary and the cargo-binstall download cache,
install it via `cargo binstall` with a build-from-source fallback for
runners without binstall, and run `whitaker-installer` to provision
the suite. The repository does not use the Cranelift backend, so the
default installer invocation suffices.

The suite (v0.2.5) reports no findings on this codebase, so no code
changes were required. Part of the estate-wide Whitaker rollout; see
leynos/netsuke#410 for the reference adoption.
---
 .github/workflows/ci.yml | 21 +++++++++++++++++++++
 Makefile                 |  7 +++----
 2 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 76097a7..6b4292f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,6 +13,7 @@ jobs:
     env:
       CARGO_TERM_COLOR: always
       BUILD_PROFILE: debug
+      WHITAKER_INSTALLER_VERSION: '0.2.5'
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - name: Setup Rust
@@ -26,6 +27,26 @@ jobs:
             **/*.md
             !**/target/**
             !**/dist/**
+      - name: Cache whitaker-installer
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v4.3.0
+        with:
+          path: |
+            ~/.cargo/bin/whitaker-installer
+            ~/.cache/cargo-binstall
+          key: whitaker-installer-${{ runner.os }}-${{ runner.arch }}-${{ env.WHITAKER_INSTALLER_VERSION }}
+      - name: Install the Whitaker Dylint suite
+        run: |
+          if ! command -v whitaker-installer >/dev/null 2>&1; then
+            if cargo binstall --version >/dev/null 2>&1; then
+              cargo binstall --no-confirm whitaker-installer@${{ env.WHITAKER_INSTALLER_VERSION }}
+            else
+              echo "cargo-binstall unavailable; building whitaker-installer from crates.io"
+              cargo install --locked whitaker-installer --version ${{ env.WHITAKER_INSTALLER_VERSION }}
+            fi
+          fi
+          # The repository does not use the Cranelift backend, so the
+          # default installer invocation suffices.
+          whitaker-installer
       - name: Lint
         run: make lint
       - name: Test and Measure Coverage
diff --git a/Makefile b/Makefile
index 9252e5b..9942faf 100644
--- a/Makefile
+++ b/Makefile
@@ -16,6 +16,7 @@ CARGO_FLAGS ?= --all-targets --all-features
 CLIPPY_FLAGS ?= $(CARGO_FLAGS) -- $(RUST_FLAGS)
 TEST_FLAGS ?= $(CARGO_FLAGS)
 TEST_CMD := $(if $(shell $(CARGO) nextest --version 2>/dev/null),nextest run,test)
+WHITAKER ?= whitaker
 MDLINT ?= markdownlint-cli2
 NIXIE ?= nixie
 DOT ?= dot
@@ -40,12 +41,10 @@ endif
 target/%/$(TARGET): ## Build binary in debug or release mode
 	$(CARGO) build $(BUILD_JOBS) $(if $(findstring release,$(@)),--release) --bin $(TARGET)
 
-lint: ## Run Clippy with warnings denied
+lint: ## Run Clippy and the Whitaker Dylint suite with warnings denied
 	RUSTDOCFLAGS="$(RUSTDOC_FLAGS)" $(CARGO) doc --no-deps
 	$(CARGO) clippy $(CLIPPY_FLAGS)
-	@command -v whitaker >/dev/null 2>&1 && \
-		RUSTFLAGS="$(RUST_FLAGS)" whitaker --all -- $(CARGO_FLAGS) || \
-		{ echo "whitaker not found on PATH; skipping whitaker lint. Install whitaker to run this check."; }
+	RUSTFLAGS="$(RUST_FLAGS)" $(WHITAKER) --all -- $(CARGO_FLAGS)
 
 typecheck: ## Type-check without building
 	RUSTFLAGS="$(RUST_FLAGS)" $(CARGO) check $(CARGO_FLAGS)

From 9a47e14a70a402c908ab2b7e9cec07c02ff94069 Mon Sep 17 00:00:00 2001
From: leynos <leynos@rohga>
Date: Wed, 8 Jul 2026 13:26:27 +0200
Subject: [PATCH 2/2] Harden the Whitaker install step

Replace inline `${{ env.WHITAKER_INSTALLER_VERSION }}` interpolation in the
run block with the plain shell variable `"${WHITAKER_INSTALLER_VERSION}"`;
the job-level `env:` already exports it, and zizmor flags run-block template
interpolation as a template-injection hazard. Add `--locked` to the
cargo-binstall invocation so that binstall's compile fallback resolves
dependencies from the published lockfile, keeping fallback builds
reproducible.
---
 .github/workflows/ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6b4292f..f7b268a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -38,10 +38,10 @@ jobs:
         run: |
           if ! command -v whitaker-installer >/dev/null 2>&1; then
             if cargo binstall --version >/dev/null 2>&1; then
-              cargo binstall --no-confirm whitaker-installer@${{ env.WHITAKER_INSTALLER_VERSION }}
+              cargo binstall --no-confirm --locked "whitaker-installer@${WHITAKER_INSTALLER_VERSION}"
             else
               echo "cargo-binstall unavailable; building whitaker-installer from crates.io"
-              cargo install --locked whitaker-installer --version ${{ env.WHITAKER_INSTALLER_VERSION }}
+              cargo install --locked whitaker-installer --version "${WHITAKER_INSTALLER_VERSION}"
             fi
           fi
           # The repository does not use the Cranelift backend, so the