From 8ce00676e73f7f2f12d99070ae39168ad1709f46 Mon Sep 17 00:00:00 2001 From: Vyncint Ng <115854244+vyncint@users.noreply.github.com> Date: Mon, 5 Oct 2026 06:57:51 +0700 Subject: [PATCH] ci: repin dtolnay/rust-toolchain to where v1 points now The action's `v1` tag is a moving tag. On 2026-10-01 at 22:51 UTC it moved from 02cb101e to 7e38f4b4 when upstream merged one pull request, and zizmor's online audits began failing on every use: the `# v1` comment no longer named the pinned commit (ref-version-mismatch), and the commit no longer pointed at any tag (stale-action-refs). The zizmor job, and with it the required gate, fails on any run since. The 10 pin(s) move to 7e38f4b43b4d. The SHA was read from the upstream tag, which is a plain commit, and the upstream change between the two commits is one file, action.yml, +16/-1: a retry loop around `rustup toolchain install` for the release server's checksum error. termlens made the same change as vyncint/termlens#554. Signed-off-by: Vyncint Ng <115854244+vyncint@users.noreply.github.com> --- .github/workflows/ci.yml | 12 ++++++------ .github/workflows/install.yml | 2 +- .github/workflows/release.yml | 4 ++-- .github/workflows/stress.yml | 2 +- 4 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 369474c..c06aa6e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,7 +22,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false - - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1 + - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1 with: toolchain: stable components: rustfmt @@ -35,7 +35,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false - - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1 + - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1 with: toolchain: stable components: clippy @@ -56,7 +56,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false - - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1 + - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1 with: toolchain: stable - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 @@ -104,7 +104,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false - - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1 + - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1 with: toolchain: stable components: clippy @@ -131,7 +131,7 @@ jobs: msrv="$(sed -n 's/^rust-version *= *"\(.*\)"/\1/p' Cargo.toml)" echo "MSRV: ${msrv}" echo "msrv=${msrv}" >> "$GITHUB_OUTPUT" - - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1 + - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1 with: toolchain: ${{ steps.msrv.outputs.msrv }} - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 @@ -146,7 +146,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false - - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1 + - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1 with: toolchain: stable - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 diff --git a/.github/workflows/install.yml b/.github/workflows/install.yml index 6e9b4e4..abada98 100644 --- a/.github/workflows/install.yml +++ b/.github/workflows/install.yml @@ -113,7 +113,7 @@ jobs: echo "version=$version" >> "$GITHUB_OUTPUT" echo "msrv=$msrv" >> "$GITHUB_OUTPUT" echo "verifying mossaic $version, which declares Rust $msrv" - - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1 + - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1 with: toolchain: ${{ matrix.toolchain == 'msrv' && steps.crate.outputs.msrv || 'stable' }} - name: cargo install, from an empty directory diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7a1dcb9..4c1e102 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -22,7 +22,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false - - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1 + - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1 with: toolchain: stable - name: Compare tag against the crate version @@ -90,7 +90,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false - - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1 + - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1 with: toolchain: stable # crates.io Trusted Publishing: the action exchanges this job's OIDC diff --git a/.github/workflows/stress.yml b/.github/workflows/stress.yml index c2100ee..1e0832c 100644 --- a/.github/workflows/stress.yml +++ b/.github/workflows/stress.yml @@ -86,7 +86,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false - - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1 + - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1 with: toolchain: stable - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2