Update setup-rust dependencies for Node.js 24

.github/actions/setup-rust/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## v1.0.16 - 2026-08-02
+
+- Update actions/cache, sccache-action, and setup-msys2 to releases that use
+  the GitHub Actions Node.js 24 runtime.
+
 ## v1.0.15 - 2026-07-29
 
 - Add `rustflags` input forwarded to `actions-rust-lang/setup-rust-toolchain`.

.github/actions/setup-rust/README.md

@@ -130,10 +130,11 @@ cache compiler output. It sets `SCCACHE_GHA_ENABLED=true` and
 `RUSTC_WRAPPER=sccache` so subsequent build steps benefit from the cache. The
 compiled objects are stored in `~/.cache/sccache` and cached with a **separate
 cache key** from the directories above. This directory holds the sccache cache
-space and does not share data with the Rust dependency cache; the sccache step
-itself uses
-`mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad`,
-pinned to a specific commit for reproducibility.
+space and does not share data with the Rust dependency cache. The revised
+Node.js-backed actions are pinned to specific commits for reproducibility:
+`actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9`,
+`mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba`
+and `msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884`.
 
 ### Extent and limitations
 

.github/actions/setup-rust/action.yml

@@ -168,8 +168,8 @@ runs:
         echo "NIGHTLY_SYSROOT=$(rustc +$OPENBSD_NIGHTLY --print sysroot)" >> "$GITHUB_ENV"
       shell: bash
     - name: Cache cargo registry
-      # v4.3.0
-      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
+      # v6.1.0
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
       with:
         path: |
           ~/.cargo/registry
@@ -181,12 +181,12 @@ runs:
     # x86_64-apple-darwin binaries were dropped after sccache v0.12.0
     - name: Run sccache (x86_64 macOS)
       if: ${{ inputs.use-sccache == 'true' && github.event_name != 'release' && runner.os == 'macOS' && runner.arch == 'X64' }}
-      uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad
+      uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba
       with:
         version: v0.12.0
     - name: Run sccache
       if: ${{ inputs.use-sccache == 'true' && github.event_name != 'release' && !(runner.os == 'macOS' && runner.arch == 'X64') }}
-      uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad
+      uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba
     - name: Install system dependencies
       if: ${{ inputs.install-postgres-deps == 'true' && runner.os == 'Linux' }}
       run: sudo apt-get update && sudo apt-get install -y --no-install-recommends libpq-dev
@@ -206,8 +206,8 @@ runs:
 
     - name: Install MSYS2 toolchain and SQLite
       if: ${{ inputs.install-sqlite-deps == 'true' && runner.os == 'Windows' }}
-      # v2.30.0
-      uses: msys2/setup-msys2@4f806de0a5a7294ffabaff804b38a9b435a73bda
+      # v2.32.0
+      uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884
       with:
         msystem: MINGW64
         update: true
@@ -226,8 +226,8 @@ runs:
     - name: Cache OpenBSD stdlib
       if: ${{ inputs.with-openbsd == 'true' && runner.os == 'Linux' }}
       id: openbsd-stdlib-cache
-      # v4.3.0
-      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
+      # v6.1.0
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
       with:
         path: ${{ env.NIGHTLY_SYSROOT }}/lib/rustlib/x86_64-unknown-openbsd
         key: openbsd-stdlib-${{ runner.os }}-${{ hashFiles('rust-toolchain.toml') }}

.github/actions/setup-rust/tests/test_setup_rust_manifest.py

@@ -16,6 +16,19 @@
 PINNED_BINSTALL_SHA256 = (
     "d3a93702160e0ec03e2a4e996855db1f01adee801fb84a43add24e0877ef8eae"
 )
+NODE24_ACTION_REVISIONS = {
+    "Cache cargo registry": "actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9",
+    "Run sccache (x86_64 macOS)": (
+        "mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba"
+    ),
+    "Run sccache": (
+        "mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba"
+    ),
+    "Install MSYS2 toolchain and SQLite": (
+        "msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884"
+    ),
+    "Cache OpenBSD stdlib": ("actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9"),
+}
 
 
 def _load_steps() -> list[dict[str, object]]:
@@ -198,6 +211,18 @@ def test_manifest_exposes_toolchain_input() -> None:
     assert "toolchain" in inputs
 
 
+@pytest.mark.parametrize(
+    ("step_name", "expected_revision"),
+    NODE24_ACTION_REVISIONS.items(),
+)
+def test_node_actions_use_pinned_node24_revisions(
+    step_name: str,
+    expected_revision: str,
+) -> None:
+    """Node-based dependencies should use the verified Node.js 24 revisions."""
+    assert _get_step(step_name).get("uses") == expected_revision
+
+
 def test_install_postgres_deps_is_linux_only() -> None:
     """Postgres packages should only install on Linux when requested."""
     condition = _get_step_condition("Install system dependencies")