ci: bump the github-actions group across 1 directory with 3 updates - #1073
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the github-actions group with 3 updates in the / directory: [docker/login-action](https://github.com/docker/login-action), [actions/setup-node](https://github.com/actions/setup-node) and [actions-rust-lang/setup-rust-toolchain](https://github.com/actions-rust-lang/setup-rust-toolchain). Updates `docker/login-action` from 3864d6aed8ff134b2ed894ce00c87695c709c870 to 783ae9cac559640a24c9212dfa6cd9e998252f9a - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@3864d6a...783ae9c) Updates `actions/setup-node` from 6 to 7 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v6...v7) Updates `actions-rust-lang/setup-rust-toolchain` from 1 to 2 - [Release notes](https://github.com/actions-rust-lang/setup-rust-toolchain/releases) - [Changelog](https://github.com/actions-rust-lang/setup-rust-toolchain/blob/main/CHANGELOG.md) - [Commits](actions-rust-lang/setup-rust-toolchain@v1...v2) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 783ae9cac559640a24c9212dfa6cd9e998252f9a dependency-type: direct:production dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions-rust-lang/setup-rust-toolchain dependency-version: '2' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Review · Status🟩 CompletedIronLoop completed the review and posted it to GitHub. ResultRun detailsAutomatic trigger · attempt 1 of 3 · completed in 4m 26s |
![ironloopai[bot]](https://avatars.githubusercontent.com/in/4116490?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review · Summary
Found one Rust toolchain compatibility regression.
Findings: 🟡 Low 1
Code-specific findings are attached to the diff.
Validation
- ❌ Cargo 1.92 warning-control probe — Cargo 1.92 allowed an unused-variable warning with
CARGO_BUILD_WARNINGS=deny; Cargo 1.97 rejected it as intended.
Review details
- Run:
06c71e0f-54ac-4a0e-9b65-7c92c29070b0 - Attempts: 1
| steps: | ||
| - uses: actions/checkout@v7 | ||
| - uses: actions-rust-lang/setup-rust-toolchain@v1 | ||
| - uses: actions-rust-lang/setup-rust-toolchain@v2 |
There was a problem hiding this comment.
🟡 Low · Preserve warning denial for Rust 1.92
This checkout pins Rust/Cargo 1.92.0, but v2 replaces v1’s RUSTFLAGS=-D warnings behavior with CARGO_BUILD_WARNINGS, which Cargo only honors from 1.97 onward. The security-audit job therefore silently stops treating Cargo warnings as errors. Keep v1 or explicit RUSTFLAGS until the toolchain is upgraded.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| steps: | ||
| - uses: actions/checkout@v7 | ||
| - uses: actions-rust-lang/setup-rust-toolchain@v1 | ||
| - uses: actions-rust-lang/setup-rust-toolchain@v2 |
There was a problem hiding this comment.
This third-party action is pinned to a mutable major tag rather than a full commit SHA. This same PR pins docker/login-action to a full commit SHA (build/promote/retag/rollback), so apply the same supply-chain standard here: a tag can be re-pointed at malicious code, while a commit SHA cannot. Also note .github/actions/setup-rust-ci/action.yml (used by test.yml) still uses @v1, so the repo now mixes v1 and v2 — verify v2 didn't change defaults that affect this job, and consider updating/pinning the composite action for consistency.
Suggestion:
| - uses: actions-rust-lang/setup-rust-toolchain@v2 | |
| - uses: actions-rust-lang/setup-rust-toolchain@<full-commit-sha> # v2.x.y |
|
|
||
| - name: Log in to Docker registry | ||
| uses: docker/login-action@3864d6aed8ff134b2ed894ce00c87695c709c870 | ||
| uses: docker/login-action@783ae9cac559640a24c9212dfa6cd9e998252f9a |
There was a problem hiding this comment.
The new SHA is not annotated with the release it corresponds to. Other SHA-pinned actions in this file carry a version comment (sigstore/cosign-installer # v4.1.2, peter-evans/repository-dispatch # v4.0.1); adding one here (and on the same lines in promote.yml, retag.yml, and rollback.yml) lets reviewers and future audits tell which login-action release is in use without an external lookup.
Suggestion:
| uses: docker/login-action@783ae9cac559640a24c9212dfa6cd9e998252f9a | |
| uses: docker/login-action@783ae9cac559640a24c9212dfa6cd9e998252f9a # v3.x.y |
|
|
||
| - name: Setup Node.js | ||
| uses: actions/setup-node@v6 | ||
| uses: actions/setup-node@v7 |
There was a problem hiding this comment.
While bumping setup-node to v7, note that the pinned runtime Node.js 20 reached end-of-life in April 2026 and no longer receives security patches. If the @alibaba-group/open-code-review CLI supports it, move to an active LTS ('22' or '24') in the same change.
Suggestion:
| uses: actions/setup-node@v7 | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: '22' |
| steps: | ||
| - uses: actions/checkout@v7 | ||
| - uses: actions-rust-lang/setup-rust-toolchain@v1 | ||
| - uses: actions-rust-lang/setup-rust-toolchain@v2 |
There was a problem hiding this comment.
This bump to @v2 creates a version split in the repo: the shared composite action .github/actions/setup-rust-ci/action.yml (used by all 5 jobs in test.yml) still pins actions-rust-lang/setup-rust-toolchain@v1. Two different majors of the same third-party action now run side by side, so whatever changed in v2 (default toolchain resolution, rustflags/caching defaults) applies only to this audit workflow, and v2 fixes never reach the main CI path. Please align both call sites in this PR — ideally pinning both to the same full commit SHA, matching the docker/login-action SHA-pinning standard applied in this same PR (and note .github/actions/setup-rust-ci/action.yml:24 also pins a mutable tag).
Bumps the github-actions group with 3 updates in the / directory: docker/login-action, actions/setup-node and actions-rust-lang/setup-rust-toolchain.
Updates
docker/login-actionfrom 3864d6aed8ff134b2ed894ce00c87695c709c870 to 783ae9cac559640a24c9212dfa6cd9e998252f9aCommits
783ae9cMerge pull request #1064 from docker/dependabot/github_actions/codeql-actions...b1725c2build(deps): bump the codeql-actions group across 1 directory with 2 updates0a596b2Merge pull request #1073 from quentin-laplanche-docker/ci/remove-docker-notation5d1ee94ci: replace registry container action referenceaf63523Merge pull request #1061 from docker/dockerhub-oidc-logs72edfa6chore: update generated content2b7517alog Docker Hub OIDC token exchange progresseed2509Merge pull request #1068 from crazy-max/dockerhub-oidc-increase-expire-in07573e7chore: update generated content99ffd0fraise Docker Hub OIDC max expiry to 6 hoursUpdates
actions/setup-nodefrom 6 to 7Release notes
Sourced from actions/setup-node's releases.
... (truncated)
Commits
8207627Migrate to ESM and upgrade dependencies (#1574)04be95cAdd cache-primary-key and cache-matched-key as outputs (#1577)7c2c68ddocs: Update caching recommendations to mitigate cache poisoning risks (#1567)6a61c03Merge pull request #1569 from jasongin/update-actions-cache-5.1.030eb73bResolve high-severity audit issues4e1a87aUpdate dist360237fStrict equality4f8aac5Bump@actions/cacheto 5.1.0, log cache write deniedf4a67bbOnly usemirrorTokeningetManifestif it's provided (#1548)0355742Remove dummy NODE_AUTH_TOKEN export (#1558)Updates
actions-rust-lang/setup-rust-toolchainfrom 1 to 2Release notes
Sourced from actions-rust-lang/setup-rust-toolchain's releases.
... (truncated)
Changelog
Sourced from actions-rust-lang/setup-rust-toolchain's changelog.
Commits
ecabd13Prepare changelog for 2.0.0 releasedc00391Add error matcher for Rust panics70de7ebMerge pull request #103 from ChihweiLHBird/reuse-rustc-verbose-outputc420b69Merge pull request #105 from actions-rust-lang/use-build-warningsd94d10aUse CARGO_BUILD_WARNINGS for enforcing warning free compilations34430aaReuse rustc verbose output instead of invoking rustc three times.0267444Merge pull request #102 from actions-rust-lang/dependabot/github_actions/Swat...5fa2882Bump Swatinem/rust-cache from 2.9.1 to 2.9.28439c15Merge pull request #100 from actions-rust-lang/dependabot/github_actions/acti...c8f944aBump actions/checkout from 7.0.0 to 7.0.1Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions