Skip to content

Hash-pin all action references, address other zizmor findings #723

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
KodrAus merged 6 commits into from
Apr 14, 2026
+45 −17
Merged

Hash-pin all action references, address other zizmor findings #723

Changes from 5 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
982d3c2
Hash-pin all actions with `pinact run -v`
woodruffw Apr 11, 2026
cb0a8cc
Convert actions into pinnable forms
woodruffw Apr 11, 2026
01390c7
Drop credentials from checkout
woodruffw Apr 11, 2026
cf9d690
Bump actions/checkout, fix dtolnay/rust-toolchain usage
woodruffw Apr 12, 2026
68d367d
Bump MSRV to 1.71
woodruffw Apr 13, 2026
6545a11
Bump MSRV in Cargo.lock
woodruffw Apr 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 44 additions & 16 deletions .github/workflows/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,11 +34,15 @@ jobs:
os: windows-latest
rust: stable-x86_64-pc-windows-gnu
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@master
- uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.2
with:
persist-credentials: false
- uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
with:
toolchain: ${{ matrix.rust }}
- uses: taiki-e/install-action@cargo-hack
- uses: taiki-e/install-action@0abfcd587b70a713fdaa7fb502c885e2112acb15 # v2.75.7
with:
tool: cargo-hack
- run: cargo hack test --feature-powerset --exclude-features max_level_off,max_level_error,max_level_warn,max_level_info,max_level_debug,max_level_trace,release_max_level_off,release_max_level_error,release_max_level_warn,release_max_level_info,release_max_level_debug,release_max_level_trace
- run: cargo run --verbose --manifest-path test_max_level_features/Cargo.toml
- run: cargo run --verbose --manifest-path test_max_level_features/Cargo.toml --release
Expand All @@ -47,9 +51,12 @@ jobs:
name: Check Format and Clippy
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
- uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.2
with:
persist-credentials: false
- uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
with:
toolchain: stable
components: clippy
- run: cargo fmt -- --check
- run: cargo fmt --manifest-path test_max_level_features/Cargo.toml -- --check
Expand All @@ -60,8 +67,12 @@ jobs:
name: Check Documentation
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
- uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.2
with:
persist-credentials: false
- uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
with:
toolchain: stable
- name: Run rustdoc
env:
RUSTDOCFLAGS: "-D warnings"
Expand All @@ -71,8 +82,12 @@ jobs:
name: Feature check
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@nightly
- uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.2
with:
persist-credentials: false
- uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
with:
toolchain: nightly
- run: cargo build --verbose -Z avoid-dev-deps --features kv
- run: cargo build --verbose -Z avoid-dev-deps --features "kv std"
- run: cargo build --verbose -Z avoid-dev-deps --features "kv kv_sval"
Expand All @@ -84,8 +99,12 @@ jobs:
name: Minimal versions
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@nightly
- uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.2
with:
persist-credentials: false
- uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
with:
toolchain: nightly
- run: cargo build --verbose -Z minimal-versions --features kv
- run: cargo build --verbose -Z minimal-versions --features "kv std"
- run: cargo build --verbose -Z minimal-versions --features "kv kv_sval"
Expand All @@ -97,11 +116,16 @@ jobs:
name: MSRV
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@1.68.0
- uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.2
with:
persist-credentials: false
- uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
with:
components: clippy
- uses: taiki-e/install-action@cargo-hack
toolchain: "1.71"
Copy link
Copy Markdown
Contributor

@KodrAus KodrAus Apr 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We'll just need to update the value in our Cargo.toml too to 1.71

Copy link
Copy Markdown
Contributor Author

@woodruffw woodruffw Apr 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, done!

- uses: taiki-e/install-action@0abfcd587b70a713fdaa7fb502c885e2112acb15 # v2.75.7
with:
tool: cargo-hack
- run: cargo hack test --feature-powerset --exclude-features max_level_off,max_level_error,max_level_warn,max_level_info,max_level_debug,max_level_trace,release_max_level_off,release_max_level_error,release_max_level_warn,release_max_level_info,release_max_level_debug,release_max_level_trace
- run: cargo run --verbose --manifest-path test_max_level_features/Cargo.toml
- run: cargo run --verbose --manifest-path test_max_level_features/Cargo.toml --release
Expand All @@ -110,8 +134,12 @@ jobs:
name: Embedded
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: dtolnay/rust-toolchain@stable
- uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.2
with:
persist-credentials: false
- uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
with:
toolchain: stable
- run: rustup target add thumbv6m-none-eabi riscv32imc-unknown-none-elf
- run: cargo build --verbose --target=thumbv6m-none-eabi
- run: cargo build --verbose --target=riscv32imc-unknown-none-elf