[hyperpolymath]

What was wrong

dtolnay/rust-toolchain@v1 declares toolchain as required with no default. Here toolchain: v1 was set (not a toolchain rustup can install), and one step set none.

Changes

• bench.yml, release.yml, security.yml: toolchain: v1 → stable (existing targets: kept).
• security.yml: add toolchain: stable to the clippy step that had none.

Testing

YAML parses; standards' check-lock-sync.sh reports no new failures.

---

Generated by Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 7889b39c-b4d4-4e04-90c7-cc59b0e3d5c7

📥 Commits

Reviewing files that changed from the base of the PR and between f1894b9 and 57810d3.

📒 Files selected for processing: 12

• crates/presswerk-core/benches/core_bench.rs
• crates/presswerk-core/tests/aspect_test.rs
• crates/presswerk-core/tests/e2e_test.rs
• crates/presswerk-core/tests/property_test.rs
• crates/presswerk-document/benches/document_bench.rs
• crates/presswerk-print/benches/ipp_bench.rs
• crates/presswerk-print/src/capabilities.rs
• crates/presswerk-print/src/discovery.rs
• crates/presswerk-print/src/ipp_client.rs
• crates/presswerk-print/src/ipp_server.rs
• crates/presswerk-print/src/retry.rs
• crates/presswerk-security/benches/security_bench.rs

💤 Files with no reviewable changes: 1

• crates/presswerk-print/src/ipp_server.rs

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout: 10

• GitHub Check: semgrep-cloud-platform/scan
• GitHub Check: scan / shell-secrets
• GitHub Check: scan / gitleaks
• GitHub Check: governance / Live Actions policy (credentialed advisory)
• GitHub Check: scan / rust-secrets
• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: Validate K9 contracts
• GitHub Check: fmt
• GitHub Check: Groove manifest check
• GitHub Check: Test

⚠️ CI failures not shown inline: 40

GitHub Actions: CodeQL Security Analysis / 0_analyze (actions, none).txt: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 SecurityEvents: write
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile. lockfile verification did not produce a result for this action

GitHub Actions: Rust CI / 4_rust-ci _ Detect Cargo.toml.txt: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Hypatia Security Scan / 0_hypatia _ Hypatia Neurosymbolic Analysis.txt: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Actions: read
 Contents: read
 Metadata: read
 SecurityEvents: write
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]lockfile verification did not produce a result for this action. Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile. lockfile verification did not produce a result for this action. lockfile verification did not produce a result for this action. lockfile verification did not produce a result for this action

GitHub Actions: CodeQL Security Analysis / analyze (actions, none): ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 SecurityEvents: write
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile. lockfile verification did not produce a result for this action

GitHub Actions: Rust CI / rust-ci _ Detect Cargo.toml: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Hypatia Security Scan / hypatia _ Hypatia Neurosymbolic Analysis: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Actions: read
 Contents: read
 Metadata: read
 SecurityEvents: write
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]lockfile verification did not produce a result for this action. Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile. lockfile verification did not produce a result for this action. lockfile verification did not produce a result for this action. lockfile verification did not produce a result for this action

GitHub Actions: Secret Scanner / 0_scan _ shell-secrets.txt: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Secret Scanner / scan _ shell-secrets: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Secret Scanner / 1_scan _ gitleaks.txt: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Secret Scanner / scan _ gitleaks: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Secret Scanner / 2_scan _ rust-secrets.txt: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Secret Scanner / scan _ rust-secrets: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 1_governance _ Live Actions policy (credentialed advisory).txt: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / governance _ Live Actions policy (credentialed advisory): ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 2_governance _ Trusted-base reduction policy.txt: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / governance _ Trusted-base reduction policy: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 3_governance _ Licence consistency.txt: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / governance _ Licence consistency: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 4_governance _ Security policy checks.txt: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / governance _ Security policy checks: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 5_governance _ Check Workflow Staleness.txt: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / governance _ Check Workflow Staleness: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 6_governance _ Language _ package anti-pattern policy.txt: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / governance _ Language _ package anti-pattern policy: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 7_governance _ Debt ratchet.txt: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / governance _ Debt ratchet: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 8_governance _ Exemption ratchet.txt: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / governance _ Exemption ratchet: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 9_governance _ Code quality + docs.txt: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile. lockfile verification did not produce a result for this action

GitHub Actions: Governance / governance _ Code quality + docs: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile. lockfile verification did not produce a result for this action

GitHub Actions: Governance / 10_governance _ Well-Known (RFC 9116 + RSR).txt: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 11_governance _ Workflow security linter.txt: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / governance _ Workflow security linter: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 12_governance _ Actions lockfile verify.txt: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / governance _ Actions lockfile verify: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 13_governance _ Allowlist Preflight.txt: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / governance _ Allowlist Preflight: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 14_governance _ Guix packaging policy (Nix retired).txt: ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / governance _ Guix packaging policy (Nix retired): ci: give dtolnay/rust-toolchain a valid toolchain input

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

🔇 Additional comments: 11

crates/presswerk-core/benches/core_bench.rs: 1

7-9: LGTM!

Also applies to: 44-44, 103-103, 117-122, 139-139, 190-190

crates/presswerk-core/tests/aspect_test.rs: 1

127-127: LGTM!

Also applies to: 134-134, 298-301, 339-343

crates/presswerk-core/tests/e2e_test.rs: 1

34-34: LGTM!

Also applies to: 116-116

crates/presswerk-core/tests/property_test.rs: 1

19-22: LGTM!

Also applies to: 28-32, 132-135, 183-183

crates/presswerk-document/benches/document_bench.rs: 1

8-10: LGTM!

crates/presswerk-print/benches/ipp_bench.rs: 1

7-9: LGTM!

crates/presswerk-print/src/capabilities.rs: 1

292-295: LGTM!

Also applies to: 323-326, 336-340

crates/presswerk-security/benches/security_bench.rs: 1

7-9: LGTM!

crates/presswerk-print/src/ipp_client.rs: 1

16-16: LGTM!

Also applies to: 78-80, 135-185, 190-198, 202-202, 246-248, 280-282, 316-319, 328-328, 396-411

crates/presswerk-print/src/discovery.rs: 1

17-17: LGTM!

Also applies to: 213-213, 221-221, 229-229, 239-239, 277-277

crates/presswerk-print/src/retry.rs: 1

58-58: LGTM!

Also applies to: 226-234

📝 Summary

Summary by CodeRabbit

• Bug Fixes
  • Invalid IPP requests now return a clear error when their operations or attributes cannot be constructed.
  • Jobs in an invalid state are no longer retried automatically; they are flagged as requiring user action.
• Chores
  • Benchmarking, release builds and security checks now use the stable Rust toolchain.

The changes select the Rust stable toolchain in CI workflows, update IPP request error handling and printer discovery, classify invalid-state errors as requiring user action, and revise benchmarks and tests.

Changes: Rust project updates

Layer / File(s)	Summary
Stable toolchain selection .github/workflows/bench.yml, .github/workflows/release.yml, .github/workflows/security.yml	The benchmark, Linux release and cargo-audit jobs now use stable instead of v1. The clippy job now explicitly selects stable.
IPP request construction errors crates/presswerk-print/src/ipp_client.rs	IPP operation and print-job attribute construction failures now map to request errors prefixed with “invalid IPP operation”. A test checks the error returned for a 256-character job name.
Printer error handling and discovery crates/presswerk-print/src/retry.rs, crates/presswerk-print/src/discovery.rs, crates/presswerk-print/src/ipp_server.rs	Invalid-state errors now produce GiveUp(ErrorClass::UserAction). Discovery uses ResolvedService and converts the selected address to an IP address. The HTTP parsing test removes a redundant rebinding.
Benchmark and test updates crates/presswerk-core/benches/core_bench.rs, crates/presswerk-document/benches/document_bench.rs, crates/presswerk-print/benches/ipp_bench.rs, crates/presswerk-security/benches/security_bench.rs, crates/presswerk-core/tests/*, crates/presswerk-print/src/capabilities.rs	Benchmarks import black_box from std::hint and update selected inputs and settings construction. Tests use struct-update syntax and range checks; two property tests remove specific bounds assertions.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 57810

This change fixes CI toolchain inputs and tightens printer error handling and discovery. No concrete merge-blocking risk was identified.

Security architecture risk: 🔵 Low · up to 57810

The inspected changes preserve printer selection and reject invalid IPP operations before network transmission. No introduced security concern was established. Risk remains low rather than conclusively minimal because external dependency behavior and runtime recovery were not fully verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — A local-network mDNS advertiser can influence the discovered printer destination, port, resource path, and advertised IPP/IPPS service. This trust relationship predates the PR; the inspected comparison does not establish expanded destination reachability or authority.

Trust Boundaries and Controls

• observed — Discovery preserves the fullname registry key, resolved-service insertion, removed-service deletion, address-selection order, and browse-channel-derived TLS flag. The wildcard event arm does not alter those existing mutation branches.

Resilience and Maintainability Implications

• observed — InvalidState now requires user action instead of automatic retry. The inspected protocol-send branches propagate IPP errors directly, and the application send task records failure without retrying or downgrading the protocol in response to a construction error.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 79.31% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 29 functions across 11 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description check		The description clearly explains the invalid Rust toolchain inputs and the CI workflow changes.
Title check		The title clearly and concisely describes the main CI change.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches: 💡 2

📝 Generate docstrings: 💡

• Commit to this branch
• Create a new PR

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-19T17:34:58.139459Z	f1894b9	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Add Carrot credits or activate Agent usage billing to use Autofix

[coderabbitai]

✅ Coding Agent task started: View task and status

The task will inspect the CI failures, validate its fix, and commit the fix to this branch automatically.

Note: Fixing CI failures is a beta feature and may encounter errors. Expect some limitations and changes as we gather feedback and continue to improve it.

⏭️ Checks skipped: 1 · already failing on `main` (not caused by this PR)

• GitHub Actions: Hypatia Security Scan / 0_hypatia _ Hypatia Neurosymbolic Analysis.txt