Align Dependabot coverage and add the dev-fast build fragment by leynos · Pull Request #434 · leynos/mdtablefix

leynos · 2026-08-13T19:45:02Z

Summary

This branch applies Wave 1 of the Rust estate baseline remediation
(Operation Parabellum, phase 2). It aligns
.github/dependabot.yml
with the canonical Dependabot reference: one update stanza per package
ecosystem the repository uses (cargo, rust-toolchain, github-actions), each stanza labelled
dependencies plus its channel label, and GitHub Actions updates batched
into a single pull request via a wildcard group. It also adds the opt-in dev-fast build
fragment with dev-build and dev-test Make targets, signposted in
AGENTS.md.

Review walkthrough

Start with
.github/dependabot.yml
for the ecosystem coverage and labels.
Then review
tools/dev-fast/config.toml
— a copy of the canonical fragment — and the dev-build/dev-test
targets appended to the
Makefile.
Finish with the signposting section appended to
AGENTS.md.

Validation

Audited the amended tree with the Concordat rule packages
dependabot-baseline and rust-dev-fast-baseline: dependabot-baseline compliant, rust-dev-fast-baseline compliant.

Notes

The canonical labels (including the Dependabot channel labels this
configuration references) were created on the repository ahead of this
pull request, so no stanza names a missing label.
The dev-fast fragment is strictly opt-in local tooling: it is only
applied when passed explicitly with --config, so continuous
integration, release, coverage, and verification builds are untouched.
The targets need a nightly toolchain and, on Linux, a mold binary on
the PATH; repositories still pinned to stable gain the wiring now and
the capability when Wave 2 moves the pin to nightly.

Summary by Sourcery

Align Dependabot configuration with Rust toolchain updates and introduce an opt-in fast development build workflow.

New Features:

Add dev-build and dev-test Make targets for accelerated local debug builds using an opt-in Cargo config fragment.
Provide a canonical dev-fast Cargo configuration fragment enabling Cranelift and mold for development builds.
Document fast development build usage and constraints in AGENTS.md.

Enhancements:

Extend Dependabot coverage to track rust-toolchain updates with appropriate labels and weekly scheduling.

Bring `.github/dependabot.yml` to the estate baseline: one update stanza per package ecosystem the repository uses, each labelled `dependencies` plus its channel label, with GitHub Actions updates batched into a single pull request via a wildcard group. Add the opt-in dev-fast build fragment at `tools/dev-fast/config.toml` (Cranelift codegen for the dev profile and the mold linker on Linux) with `dev-build` and `dev-test` Make targets that pass it explicitly via `--config`, and signpost the workflow in `AGENTS.md`. Release, coverage, and verification builds are unaffected: the fragment is never auto-discovered.

coderabbitai · 2026-08-13T19:45:13Z

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: dde5dbb7-8efa-4a70-9019-742e5d480ae2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}

sourcery-ai · 2026-08-13T19:45:25Z

Reviewer's Guide

Updates Dependabot configuration to align with canonical Rust estate coverage and introduces an opt-in dev-fast build configuration with Make targets and documentation signposting.

Sequence diagram for the opt-in dev-fast build process

sequenceDiagram
  actor Developer
  participant Makefile
  participant Cargo
  participant DevFastConfigToml

  Developer->>Makefile: make dev-build
  Makefile->>Cargo: cargo --config DEV_FAST_CONFIG build
  Cargo->>DevFastConfigToml: load tools/dev-fast/config.toml
  DevFastConfigToml-->>Cargo: [unstable] codegen-backend, [profile.dev] cranelift
  alt [target_os = "linux"]
    DevFastConfigToml-->>Cargo: [target.'cfg(target_os = "linux")'] rustflags -fuse-ld=mold
  end
  Cargo-->>Developer: dev debug binaries built with Cranelift (mold on Linux)

  Developer->>Makefile: make dev-test
  Makefile->>Cargo: cargo --config DEV_FAST_CONFIG test
  Cargo->>DevFastConfigToml: apply same dev-fast settings for tests
  Cargo-->>Developer: tests run with Cranelift (mold on Linux)

File-Level Changes

Change	Details	Files
Add opt-in accelerated debug build and test targets wired to a dev-fast Cargo config fragment.	Define DEV_FAST_CONFIG variable defaulting to tools/dev-fast/config.toml. Add phony dev-build and dev-test Make targets invoking cargo with --config $(DEV_FAST_CONFIG) for build and test. Create tools/dev-fast/config.toml with Cranelift dev profile and mold linker configuration gated behind Linux target cfg. Document nightly toolchain and mold requirements, and warn against applying dev-fast config globally via .cargo/config.toml in AGENTS.md.	`Makefile` `tools/dev-fast/config.toml` `AGENTS.md`
Extend Dependabot coverage to the rust-toolchain ecosystem with canonical labeling.	Add a rust-toolchain update stanza targeting repository root directory. Apply dependencies and rust-toolchain labels to the new stanza to match canonical channel labeling. Schedule rust-toolchain updates to run weekly in Dependabot configuration.	`.github/dependabot.yml`

Tips and commands

Interacting with Sourcery

Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it. You can also reply to a
review comment with @sourcery-ai issue to create an issue from it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time. You can also comment
@sourcery-ai title on the pull request to (re-)generate the title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time exactly where you
want it. You can also comment @sourcery-ai summary on the pull request to
(re-)generate the summary at any time.
Generate reviewer's guide: Comment @sourcery-ai guide on the pull
request to (re-)generate the reviewer's guide at any time.
Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
pull request to resolve all Sourcery comments. Useful if you've already
addressed all the comments and don't want to see them anymore.
Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
request to dismiss all existing Sourcery reviews. Especially useful if you
want to start fresh with a new review - don't forget to comment
@sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

Enable or disable review features such as the Sourcery-generated pull request
summary, the reviewer's guide, and others.
Change the review language.
Add, remove or edit custom review instructions.
Adjust other review settings.

Getting Help

Contact our support team for questions or feedback.
Visit our documentation for detailed guides and information.
Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

Estate review flagged two defects in the fragment's deployed comments: a stale "copy this fragment" instruction that reads as nonsense once the file is in place, and a mis-statement of Cargo's rustflags semantics (Cargo joins the entries of every matching `[target.*]` table; only the joined result takes precedence over `[build].rustflags` rather than merging). Both are corrected in the canonical source; take its bytes verbatim. No configuration key changes.

coderabbitai Bot mentioned this pull request Aug 13, 2026

Align Dependabot coverage and add the dev-fast build fragment leynos/statelet#45

Merged

Navigation Menu

Align Dependabot coverage and add the dev-fast build fragment - #434

Align Dependabot coverage and add the dev-fast build fragment#434
leynos wants to merge 2 commits into
mainfrom
parabellum-wave-1

leynos commented Aug 13, 2026 •

edited by sourcery-ai Bot

Loading

Uh oh!

coderabbitai Bot commented Aug 13, 2026 •

edited

Loading

Review skipped

Uh oh!

sourcery-ai Bot commented Aug 13, 2026

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

leynos commented Aug 13, 2026 • edited by sourcery-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Review walkthrough

Validation

Notes

Summary by Sourcery

Uh oh!

coderabbitai Bot commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

sourcery-ai Bot commented Aug 13, 2026

Reviewer's Guide

Sequence diagram for the opt-in dev-fast build process

File-Level Changes

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

leynos commented Aug 13, 2026 •

edited by sourcery-ai Bot

Loading

coderabbitai Bot commented Aug 13, 2026 •

edited

Loading