From ea2b56ff111f9538f9958308ff34a9ebd8d4b4d2 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 3 Aug 2026 14:21:48 +0100 Subject: [PATCH] fix(ci): unbreak Rust CI, DB Checks and Stress Testing after the dep sweep Four faults, all introduced by the Dependabot run #110-#116 that landed after #109 merged. Each is measured from a CI run log and reproduced locally; none is a guess. 1. opentelemetry_sdk was bumped alone (#110, 0.27.1 -> 0.32.1) Its three siblings stayed on 0.27, and these crates only work version-aligned. src/observability.rs is 0.27-era code and stopped compiling with exactly three errors (run 30792934376): TracerProvider is no longer in opentelemetry_sdk::trace (E0432), Resource::new is private (E0624), and the Vec bound no longer holds (E0271). opentelemetry_sdk::runtime::Tokio is gone too. Reverted to 0.27, which realigns manifest, lockfile and code. Moving the whole family to 0.32 is a real piece of work -- four bumps plus an observability.rs rewrite -- and is left for its own PR. This is what took DB Checks red: it builds without --locked, so it resolved 0.32 fresh and died at compile. 2. Cargo.lock no longer satisfied Cargo.toml Rust CI builds with --locked and died at resolution before running a single check: error: cannot update the lock file ... because --locked was passed Reproduced on a pristine origin/main worktree (exit 101), then repaired by letting cargo resolve. The lock loses four entries and gains none: opentelemetry 0.32.0 and opentelemetry_sdk 0.32.1 (per fault 1), plus two orphans -- is-terminal 0.4.17 and portable-atomic 1.14.0 -- that criterion 0.8.2 no longer pulls. 533 -> 529 packages. No crate is upgraded by this commit. 3. dtolnay/rust-toolchain SHA-pinned with no `toolchain:` input Stress Testing failed with `error: invalid toolchain name ''`. The action infers its toolchain from the ref that called it (@stable -> "stable"); pinned to a SHA there is no name to infer. #116 moved stress-test.yml onto a revision that no longer tolerates the omission. The repo carried three different SHAs of this action across five workflows, and only publish.yml passed the input. `toolchain: stable` is now stated at every call site, so behaviour no longer depends on which SHA the pin happens to point at and the next actions bump cannot re-break it. release.yml was armed with the same latent fault -- `targets:` alone does not satisfy it. 4. criterion 0.8.2 deprecated criterion::black_box (#115) Invisible until now, because resolution failed before clippy ran. The shared standards reusable runs `cargo clippy --locked --all-targets -- -D warnings`, which turns the 14 deprecation warnings in benches/echidnabot_bench.rs into 14 hard errors. Fixing only faults 1-3 would have moved Rust CI's failure to a later step, not made it green. The bench now imports std::hint::black_box. Prevention: the cargo ecosystem in dependabot.yml had no `groups:` block at all, which is precisely what let #110 split a must-move-together family. opentelemetry* and tower* are now grouped. Verified locally -- the same four commands the standards reusable runs: cargo check --locked --all-targets exit 0 cargo fmt --all -- --check exit 0 cargo clippy --locked --all-targets -D warn exit 0 cargo test --locked (5 named suites) exit 0, 91 passed, 0 failed The bare library suite is deliberately not run: it is a known hang (>20 min, exit 124) and is excluded by both rust-ci.yml and publish.yml. Not addressed, needing separate diagnosis: ClusterFuzzLite batch fuzzing is red with `could not compile sqlx (lib)` under the ASan/fuzzing flags. Unrelated to any of the above. Co-Authored-By: Claude Opus 5 --- .github/dependabot.yml | 14 +++++++ .github/workflows/cargo-audit.yml | 5 +++ .github/workflows/db-checks.yml | 5 +++ .github/workflows/release.yml | 4 ++ .github/workflows/stress-test.yml | 6 +++ Cargo.lock | 66 +++++-------------------------- Cargo.toml | 10 ++++- benches/echidnabot_bench.rs | 5 ++- 8 files changed, 57 insertions(+), 58 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 4c9114d..3113ed7 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -13,6 +13,20 @@ updates: directory: "/" schedule: interval: "weekly" + # Some crates only work version-aligned, so they must be proposed as one + # PR. Ungrouped, Dependabot bumped opentelemetry_sdk 0.27 -> 0.32 alone + # (#110) while its three siblings stayed on 0.27; the crate stopped + # compiling and DB Checks went red. Group families here rather than + # relying on review to catch the split. + groups: + opentelemetry: + patterns: + - "opentelemetry*" + - "tracing-opentelemetry" + tower: + patterns: + - "tower" + - "tower-http" ignore: - dependency-name: "*" update-types: ["version-update:semver-patch"] diff --git a/.github/workflows/cargo-audit.yml b/.github/workflows/cargo-audit.yml index 2668ec3..8c2886c 100644 --- a/.github/workflows/cargo-audit.yml +++ b/.github/workflows/cargo-audit.yml @@ -23,7 +23,12 @@ jobs: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 - name: Install Rust toolchain + # `toolchain:` is mandatory when this action is pinned to a SHA — see + # the note in stress-test.yml. This SHA currently tolerates its absence; + # stating it explicitly keeps the step working across future re-pins. uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable + with: + toolchain: stable - name: Install cargo-audit run: cargo install cargo-audit --locked - name: Run cargo audit diff --git a/.github/workflows/db-checks.yml b/.github/workflows/db-checks.yml index 027e7bc..c2c2ced 100644 --- a/.github/workflows/db-checks.yml +++ b/.github/workflows/db-checks.yml @@ -39,7 +39,12 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust toolchain + # `toolchain:` is mandatory when this action is pinned to a SHA — see + # the note in stress-test.yml. This SHA currently tolerates its absence; + # stating it explicitly keeps the step working across future re-pins. uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable + with: + toolchain: stable - name: Cache cargo uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e7e4bc0..1ca7814 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -46,8 +46,12 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust toolchain + # `toolchain:` is mandatory when this action is pinned to a SHA — see + # the note in stress-test.yml. Supplying `targets:` alone does not + # satisfy it. uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # stable with: + toolchain: stable targets: ${{ matrix.target }} - name: Install cross-compilation tools if: matrix.target == 'aarch64-unknown-linux-gnu' diff --git a/.github/workflows/stress-test.yml b/.github/workflows/stress-test.yml index 92999ef..a3d8776 100644 --- a/.github/workflows/stress-test.yml +++ b/.github/workflows/stress-test.yml @@ -12,7 +12,13 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 - name: Install Rust toolchain + # `toolchain:` is mandatory when this action is pinned to a SHA: it + # normally infers the toolchain from the ref that called it (@stable -> + # "stable"), and a SHA carries no such name. Without it the action fails + # with `error: invalid toolchain name ''`. uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable 1.91 + with: + toolchain: stable - name: Install stress testing tools run: | diff --git a/Cargo.lock b/Cargo.lock index 95d0ed5..ceb8382 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1145,9 +1145,9 @@ dependencies = [ "hmac", "mockall", "octocrab", - "opentelemetry 0.27.1", + "opentelemetry", "opentelemetry-otlp", - "opentelemetry_sdk 0.32.1", + "opentelemetry_sdk", "proptest", "rand 0.8.6", "reqwest", @@ -2019,17 +2019,6 @@ version = "2.12.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2" -[[package]] -name = "is-terminal" -version = "0.4.17" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46" -dependencies = [ - "hermit-abi", - "libc", - "windows-sys 0.52.0", -] - [[package]] name = "is_terminal_polyfill" version = "1.70.2" @@ -2594,20 +2583,6 @@ dependencies = [ "tracing", ] -[[package]] -name = "opentelemetry" -version = "0.32.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b0142c63252a9e054e68a4c61a5778f7b14f576274d593f8ce883d191a099682" -dependencies = [ - "futures-core", - "futures-sink", - "js-sys", - "pin-project-lite", - "thiserror 2.0.18", - "tracing", -] - [[package]] name = "opentelemetry-otlp" version = "0.27.0" @@ -2617,9 +2592,9 @@ dependencies = [ "async-trait", "futures-core", "http", - "opentelemetry 0.27.1", + "opentelemetry", "opentelemetry-proto", - "opentelemetry_sdk 0.27.1", + "opentelemetry_sdk", "prost", "thiserror 1.0.69", "tokio", @@ -2633,8 +2608,8 @@ version = "0.27.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a6e05acbfada5ec79023c85368af14abd0b307c015e9064d249b2a950ef459a6" dependencies = [ - "opentelemetry 0.27.1", - "opentelemetry_sdk 0.27.1", + "opentelemetry", + "opentelemetry_sdk", "prost", "tonic", ] @@ -2650,29 +2625,14 @@ dependencies = [ "futures-executor", "futures-util", "glob", - "opentelemetry 0.27.1", + "opentelemetry", "percent-encoding", "rand 0.8.6", "serde_json", "thiserror 1.0.69", -] - -[[package]] -name = "opentelemetry_sdk" -version = "0.32.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9b59f80e1ac4d5ff7a2db8fb6c80badb7f0f3f858211fba08dd9aaec750894f9" -dependencies = [ - "futures-channel", - "futures-executor", - "futures-util", - "opentelemetry 0.32.0", - "percent-encoding", - "portable-atomic", - "rand 0.9.4", - "thiserror 2.0.18", "tokio", "tokio-stream", + "tracing", ] [[package]] @@ -2899,12 +2859,6 @@ dependencies = [ "windows-sys 0.61.2", ] -[[package]] -name = "portable-atomic" -version = "1.14.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3d20d5497ef88037a52ff98267d066e7f11fcc5e99bbfbd58a42336193aacec3" - [[package]] name = "potential_utf" version = "0.1.5" @@ -4570,8 +4524,8 @@ checksum = "97a971f6058498b5c0f1affa23e7ea202057a7301dbff68e968b2d578bcbd053" dependencies = [ "js-sys", "once_cell", - "opentelemetry 0.27.1", - "opentelemetry_sdk 0.27.1", + "opentelemetry", + "opentelemetry_sdk", "smallvec", "tracing", "tracing-core", diff --git a/Cargo.toml b/Cargo.toml index 83a851a..28c8991 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -82,9 +82,17 @@ tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] } # Enable by setting `OTEL_EXPORTER_OTLP_ENDPOINT` or [observability] # `otlp_endpoint` in echidnabot.toml. When unset, only the fmt layer # is installed, so logs continue to work without a collector. +# +# These four crates only work version-aligned: opentelemetry_sdk 0.N pairs with +# opentelemetry/opentelemetry-otlp 0.N and tracing-opentelemetry 0.N+1. Bumping +# one alone breaks the build — #110 moved opentelemetry_sdk to 0.32 on its own +# and src/observability.rs stopped compiling (TracerProvider renamed, +# Resource::new made private, opentelemetry_sdk::runtime removed). Dependabot +# now proposes them as one group; see the `opentelemetry` group in +# .github/dependabot.yml. Moving the family to 0.32 is tracked separately. opentelemetry = { version = "0.27", features = ["trace"] } opentelemetry-otlp = { version = "0.27", features = ["grpc-tonic", "trace"] } -opentelemetry_sdk = { version = "0.32", features = ["rt-tokio", "trace"] } +opentelemetry_sdk = { version = "0.27", features = ["rt-tokio", "trace"] } tracing-opentelemetry = "0.28" rand = "0.8" diff --git a/benches/echidnabot_bench.rs b/benches/echidnabot_bench.rs index 1a29037..6a2da65 100644 --- a/benches/echidnabot_bench.rs +++ b/benches/echidnabot_bench.rs @@ -13,13 +13,16 @@ //! Run locally: `cargo bench` //! Compare: `cargo bench -- --save-baseline main` then `cargo bench -- --baseline main` -use criterion::{black_box, criterion_group, criterion_main, BenchmarkId, Criterion, Throughput}; +use criterion::{criterion_group, criterion_main, BenchmarkId, Criterion, Throughput}; use echidnabot::api::rate_limit::WebhookRateLimiter; use echidnabot::dispatcher::ProverKind; use echidnabot::scheduler::ProofJob; use echidnabot::store::models::goal_fingerprint; use hmac::{Hmac, Mac}; use sha2::Sha256; +// criterion 0.8 deprecated its own `black_box` re-export in favour of the std +// one; CI runs clippy with `-D warnings`, so the re-export is an error here. +use std::hint::black_box; use std::net::{IpAddr, Ipv4Addr}; use uuid::Uuid;