From 23db8a04b1ca80ce848392202ecca108103cb62c Mon Sep 17 00:00:00 2001
From: leynos <leynos@rohga>
Date: Wed, 8 Jul 2026 12:38:42 +0200
Subject: [PATCH 1/3] Adopt the Whitaker Dylint suite in the lint gate and CI

Align the repository with the estate-wide Whitaker rollout pattern
established in leynos/netsuke#410. The repository skeleton already ran
Whitaker in `make lint` and CI, but it installed the installer from a
pinned git revision and carried bespoke PATH-resolution plumbing in the
Makefile.

- Simplify the Makefile to the standard `WHITAKER ?= whitaker` tool
  variable and drop the USER_WHITAKER/USER_BIN_PATH indirection; the
  lint recipe now invokes the wrapper directly after Clippy with
  warnings denied, matching the other tool variables.
- Replace the git-revision installer in CI with the released
  whitaker-installer 0.2.5 via `cargo binstall` (provided by the shared
  setup-rust action), caching only the installer binary and the
  cargo-binstall cache under the estate-standard cache key.

The suite reports no findings on this codebase, so no code changes or
dylint.toml exclusions were required.
---
 .github/workflows/ci.yml | 25 +++++++++----------------
 Makefile                 |  9 +++------
 2 files changed, 12 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 343bc64..7d30e5a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,7 +13,7 @@ jobs:
     env:
       CARGO_TERM_COLOR: always
       BUILD_PROFILE: debug
-      WHITAKER_INSTALLER_REV: f768c2e53c47df13658af1168a67851d388750bf
+      WHITAKER_INSTALLER_VERSION: '0.2.5'
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
         with:
@@ -57,31 +57,24 @@ jobs:
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
         with:
           python-version: '3.x'
-      - name: Cache Whitaker installation
-        id: cache-whitaker
+      - name: Cache Whitaker installer
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae
         with:
           path: |
             ~/.cargo/bin/whitaker-installer
-            ~/.local/bin/whitaker
-            ~/.dylint_drivers
-            ~/.local/share/whitaker
-          key: whitaker-v2-${{ runner.os }}-${{ env.WHITAKER_INSTALLER_REV }}
+            ~/.cache/cargo-binstall
+          key: whitaker-installer-${{ runner.os }}-${{ runner.arch }}-${{ env.WHITAKER_INSTALLER_VERSION }}
       - name: Install Whitaker
         env:
           RUSTFLAGS: ""
         run: |
           set -euo pipefail
-          echo "Whitaker cache hit: ${{ steps.cache-whitaker.outputs.cache-hit }}"
-          if [ "${{ steps.cache-whitaker.outputs.cache-hit }}" != "true" ]; then
-            echo "Installing Whitaker installer at ${WHITAKER_INSTALLER_REV}"
-            cargo install --locked \
-              --git https://github.com/leynos/whitaker \
-              --rev "${WHITAKER_INSTALLER_REV}" \
-              whitaker-installer
+          if command -v whitaker-installer >/dev/null 2>&1; then
+            echo "whitaker-installer already present; skipping cargo binstall"
+          else
+            cargo binstall --no-confirm whitaker-installer@${{ env.WHITAKER_INSTALLER_VERSION }}
           fi
-          whitaker-installer --cranelift
-          echo "Whitaker binary: $(command -v whitaker || true)"
+          whitaker-installer
       - name: Audit dependencies
         if: github.actor != 'dependabot[bot]'
         run: make audit
diff --git a/Makefile b/Makefile
index 16f2030..2508167 100644
--- a/Makefile
+++ b/Makefile
@@ -5,8 +5,6 @@ SHELL := bash
 
 TARGET ?= librentaneko.rlib
 
-USER_WHITAKER := $(HOME)/.local/bin/whitaker
-USER_BIN_PATH := $(HOME)/.cargo/bin:$(HOME)/.local/bin:$(HOME)/.bun/bin
 CARGO ?= cargo
 BUILD_JOBS ?=
 RUST_FLAGS ?=
@@ -21,7 +19,7 @@ COVERAGE_LINKER_FLAGS ?= -fuse-ld=lld
 COVERAGE_RUST_FLAGS ?= $(RUST_FLAGS) -C link-arg=$(COVERAGE_LINKER_FLAGS)
 MDLINT ?= markdownlint-cli2
 NIXIE ?= nixie
-WHITAKER ?= $(or $(shell command -v whitaker 2>/dev/null),$(wildcard $(USER_WHITAKER)),whitaker)
+WHITAKER ?= whitaker
 
 build: target/debug/$(TARGET) ## Build debug binary
 release: target/release/$(TARGET) ## Build release binary
@@ -46,11 +44,10 @@ coverage: ## Generate lcov coverage with lld for llvm-tools compatibility
 		LDFLAGS="$(COVERAGE_LINKER_FLAGS)" \
 		$(CARGO) llvm-cov --lcov --output-path lcov.info $(TEST_FLAGS)
 
-lint: ## Run Clippy with warnings denied
+lint: ## Run Clippy and the Whitaker Dylint suite with warnings denied
 	RUSTDOCFLAGS="$(RUSTDOC_FLAGS)" $(CARGO) doc --no-deps
 	$(CARGO) clippy $(CLIPPY_FLAGS)
-	@echo "Whitaker binary: $(WHITAKER)"
-	PATH="$(USER_BIN_PATH):$(PATH)" RUSTFLAGS="$(RUST_FLAGS)" $(WHITAKER) --all -- $(CARGO_FLAGS)
+	RUSTFLAGS="$(RUST_FLAGS)" $(WHITAKER) --all -- $(CARGO_FLAGS)
 
 typecheck: ## Type-check without building
 	RUSTFLAGS="$(RUST_FLAGS)" $(CARGO) check $(CARGO_FLAGS)

From cac42cfce744c6cbb371ea86331f7ad18a3ac1f3 Mon Sep 17 00:00:00 2001
From: leynos <leynos@rohga>
Date: Wed, 8 Jul 2026 12:47:56 +0200
Subject: [PATCH 2/3] Provision the Cranelift component for Whitaker's
 toolchain

This project builds with the Cranelift debug backend, so the Dylint
driver's pinned nightly needs `rustc-codegen-cranelift` installed.
Restore the installer's `--cranelift` flag, which the standardized
install step had dropped.
---
 .github/workflows/ci.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7d30e5a..225b58d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -74,7 +74,10 @@ jobs:
           else
             cargo binstall --no-confirm whitaker-installer@${{ env.WHITAKER_INSTALLER_VERSION }}
           fi
-          whitaker-installer
+          # --cranelift provisions rustc-codegen-cranelift on Whitaker's pinned
+          # toolchain; this project builds with the Cranelift debug backend.
+
+          whitaker-installer --cranelift
       - name: Audit dependencies
         if: github.actor != 'dependabot[bot]'
         run: make audit

From 1048292e8fa9d15e82073643d4dff3f89945ab9e Mon Sep 17 00:00:00 2001
From: leynos <leynos@rohga>
Date: Wed, 8 Jul 2026 13:23:22 +0200
Subject: [PATCH 3/3] Harden the Whitaker install step

Pass WHITAKER_INSTALLER_VERSION to the run block through the shell
environment rather than inline `${{ env }}` template expansion, which
zizmor flags as a template-injection risk; the job-level `env:` block
already exports the variable. Add `--locked` to the cargo binstall
invocation so that its compile-from-source fallback resolves
dependencies from the published lockfile, keeping fallback builds
reproducible.
---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 225b58d..7d51526 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -72,7 +72,7 @@ jobs:
           if command -v whitaker-installer >/dev/null 2>&1; then
             echo "whitaker-installer already present; skipping cargo binstall"
           else
-            cargo binstall --no-confirm whitaker-installer@${{ env.WHITAKER_INSTALLER_VERSION }}
+            cargo binstall --no-confirm --locked "whitaker-installer@${WHITAKER_INSTALLER_VERSION}"
           fi
           # --cranelift provisions rustc-codegen-cranelift on Whitaker's pinned
           # toolchain; this project builds with the Cranelift debug backend.